Security & safety
Safe to point at production. Here's exactly why.
Hardn is built so that scanning your live site is boring: no surprises, no load, no changes. These rules are enforced in code on every scan.
Your first scan is free, no card needed. You prove you own the site before Hardn touches it.
The rules
Six rules, enforced on every scan
- 01
No scan without proof of ownership
You prove control of a site with a DNS TXT record or a file on the site itself. Hardn checks it when you add the site and again before every scan, including scheduled ones. If the proof disappears, scheduled scans pause and we email your admins.
- 02
Read-only, always
The scanner sends only GET, HEAD and OPTIONS requests. It never submits forms, never sends attack payloads, never tries passwords, and never changes or deletes anything. Links that look destructive (log out, delete, unsubscribe) are skipped.
- 03
Locked to your scope
A scan stays on the host you verified and its www twin. It doesn't follow links to other sites, skips any paths you exclude, and refuses private, internal and cloud-metadata addresses even if your DNS points at them.
- 04
Gentle limits
Every scan has a cap on requests per second, total requests and total time, so it never puts load on your site: at most five requests a second, 2,000 requests and 20 minutes for a public scan.
- 05
Deep scans with your test accounts
For a deep scan you give Hardn your own test logins. Secrets are encrypted at rest, handed to the scanner only for the run, never shown in the app again and masked in all evidence.
- 06
Evidence, with secrets masked
Each finding records what the scanner actually saw so you can check it. Tokens, cookies and keys in that evidence are redacted before it's stored.
Where your data lives
On AWS and Supabase, with as little of it as possible
Hosting
- The scanners run on AWS in US East
- The API runs on AWS; the database is Supabase, encrypted at rest
- The scanner servers hold no database keys
What we keep
- Your account, your sites and scan results
- Evidence, with secrets masked
- An audit log of every change; no copies of your pages
Fix reports
- Written by Claude through Anthropic's commercial API
- Hardn sends the finding and its masked evidence
- Never your test-account secrets
Coverage
What Hardn checks
TLS & certificates
- Certificate validity, chain and expiry
- Legacy protocol versions (TLS 1.0/1.1)
- HTTP to HTTPS redirect
Security headers
- Strict-Transport-Security strength
- Content-Security-Policy quality
- Clickjacking protection
- MIME sniffing, referrer and permissions policies
- Server and framework version disclosure
Cookies & sessions
- Secure flag on cookies served over HTTPS
- HttpOnly and SameSite on session cookies
Page content
- Mixed content on HTTPS pages
- Third-party scripts without integrity checks
- Outdated JavaScript libraries with known flaws
- Secrets and API keys in JavaScript bundles
- Exposed source maps
- CMS version disclosure
Exposed files & data
- Exposed .git, .env and backup files
- Directory listings
- Verbose error pages and stack traces
- robots.txt pointing at sensitive paths
- A security.txt for researchers
DNS & email
- SPF and DMARC policy
- CAA records
- DNSSEC
Access control
- Permissive CORS (credentials allowed from any origin)
- Data reachable without signing in (deep scan)
- One customer reading another's data (deep scan)
Report a problem
Found a problem in Hardn itself?
| support@hardn.si | |
| Subject | Start it with “Security” |
| Please | Give us a chance to fix it before you publish |
| Company | Infonex Pty Ltd trading as Hardn, ABN 93 632 080 427 |
Scanning other people's sites with Hardn isn't allowed. See the acceptable use policy.
See your site's grade in a few minutes
Add your site, prove you own it, and Hardn runs 27 read-only checks. You get a grade, every issue it found and the steps to fix each one. Your first scan is free.