Security at Loudlark

Every customer works in a workspace, and the workspace is a hard boundary. Postgres enforces it with row-level security, so a bug in application code cannot read across it.

• Every table that holds customer data carries a workspace id and has row-level security enabled and forced, with at least one policy and none for the public role.
• The roles the application connects with own no tables and cannot bypass row-level security.
• Every query runs inside a tenant context. With no context set, a query reads and writes nothing.
• Our tests attack the tables that hold customer data as the real application roles: one workspace cannot read, insert, update or delete another's rows, and each attack has a control that proves the test could have succeeded.

A scan has no workspace and no account. It runs as a role that is refused every customer table.

• It can read and write only the rows of its own scan, a setting made per transaction.
• The report page reads a scan back through one function that returns the scan's public output and nothing else.
• Each scan has a spending budget, checked in a ledger, and the check fails closed.

The scan and our agents read pages that strangers control. One HTTP client does all of it, and it refuses to reach our own network.

• It refuses any address that is not public, including private ranges and cloud metadata endpoints, on every hop and on every redirect.
• It resolves each name once, requires every answer to be public and connects only to the address it checked, so a DNS rebinding trick cannot change where the bytes go.
• It only reads: every request is a GET, it sends no cookies or credentials, and it caps time, size and decompression.
• Agents are held to stricter rules, such as short addresses with no query string, so nothing can be smuggled out in one.

It looks at your site the way a visitor does, and no further.

• It reads about ten public pages, the same ones any visitor can open.
• It never logs in and never reads anything behind a login.
• It never posts, submits a form or changes anything on your site.
• If your site blocks scanners, the report says so instead of guessing.

Everything the platform wants to do for you starts as a proposal, called an intent. One service writes intents, and the database rejects any move it does not allow.

• An intent can only move along the edges the state machine lists, and only for the actor allowed to make that move. Anything else is refused by a database trigger, not by a code review.
• Every side effect is keyed to its intent, so a retry never posts twice.

Agents propose, and policies execute. A model never publishes anything.

• Agents and engines only create proposals. A separate worker publishes, and only after a policy check approves.
• Replies on Reddit, Hacker News, Indie Hackers and Product Hunt are never posted by us: you post each one yourself.
• Hard checks run first and cannot be argued with: the link allowlist, length and banned patterns. Then judges run on a provider that did not write the text. Whatever they do not pass goes to your Inbox, never out the door.

Connected accounts, such as Stripe, your analytics, your CMS and your social accounts, are the most sensitive thing we would hold. The architecture keeps them out of every prompt and every agent sandbox.

• Tokens and API keys are encrypted at rest with envelope encryption, and decrypted only inside the job that uses them.
• An agent never sees a credential. Each run gets its own short-lived token, bound to one run, one workspace and a fixed list of tools, and the run and its vault are removed when it ends.
• Inside a run, your workspace's files are read-only, and its network access is limited to our tool servers.
• Tools that reach the web and tools that read your data never share an allowlist.

The scan collects only what it needs to write the report.

• A scanned address is reduced to its origin. Paths, query strings and tokens in a pasted URL are dropped before anything is stored.
• The scan asks for no email and no signup, and nobody is added to a list.
• A report sits at an unguessable link. It is marked noindex, kept out of the sitemap, disallowed in robots.txt, and it expires.
• Logs pass through a redactor before they reach any destination. As a last line of defence it removes the secrets and email addresses it can recognize, by field name and by the shape of the value.

What we remember about your company (your voice, your rules, what worked) stays inside your workspace, and you can see all of it.

• Memory is isolated company by company. It is never used to train models and never shared with other customers.
• What it learns from your edits and your results is used for your company only.
• You can correct or erase anything it remembers.
• It sits inside your workspace, the boundary the database enforces: nothing crosses that line.

The site you are reading sends the headers a browser needs to protect its visitors, and asks nothing of them beyond the page.

• Every page is sent with X-Content-Type-Options: nosniff, X-Frame-Options: DENY, a strict-origin-when-cross-origin referrer policy, a Permissions-Policy that turns off the camera, microphone and location, and Cross-Origin-Opener-Policy: same-origin.
• The pages you can read without signing in set no cookies and load nothing from another origin: the typeface is served by us. Asking for a sign-in link and signing in set cookies of our own, all HttpOnly and SameSite=Lax, and the privacy policy lists each one with its lifetime.