Security at NovaPentest

A security testing company should be held to a higher standard than the applications it tests. This page describes, concretely, how NovaPentest protects your account, the data you give us, the targets you scan and your payments.

Everything here describes how the platform is built today. Where a control is not in place, we do not claim it: you will not find certifications or promises on this page that we cannot back up.

Passwords are never stored in readable form. They are salted and hashed with ASP.NET Core's password hasher, which uses PBKDF2. You must verify your email address before your first sign-in, and you can add two-factor authentication with any TOTP authenticator app; once enabled, every sign-in requires a current code.

Sign-in and sign-up are rate-limited to slow down password-guessing. Password reset links use a random 256-bit token, work only once and expire after one hour, and the reset form gives the same answer whether or not an account exists, so it cannot be used to discover who has one.

Sessions use HttpOnly, SameSite cookies that scripts cannot read, and they expire after eight hours of inactivity. Failed sign-ins, password resets and team invitations are recorded in an audit log, and team members get roles (Owner, Admin, Analyst, Viewer) rather than shared accounts.

Credentials you enter for a one-off authenticated scan are held only in memory until the scan starts, and are never written to the database. When the AI agent uses them, the password is redacted from what is sent to the language model; it is applied by the scanner itself when signing in. If you attach credentials to a recurring schedule, they have to be kept so the schedule can run unattended; the password is stored encrypted with the application's data-protection keys, never in plain text. Even so, use a dedicated, low-privilege test account for scheduled scans.

API keys for the CI/CD API are shown once and stored only as SHA-256 hashes. They can be given an expiry date and revoked at any time.

Every request is tied to your workspace through your signed-in session, and targets, scans and findings are scoped to that workspace. The application also sends a Content-Security-Policy, refuses to be framed by other sites, and sets nosniff, Referrer-Policy and Permissions-Policy headers on every response.

A scanner that can be pointed anywhere could be turned against internal networks, so NovaPentest checks every target before a scan runs and refuses any name that resolves to a loopback, private, link-local, carrier-grade NAT, multicast or reserved address, including the cloud metadata service. The same check runs again at the moment of each connection, on the exact address being connected to, so a redirect to an internal host or a DNS answer that changes mid-scan is refused as well.

The free public scanner at /scan is passive by construction. It runs a fixed allowlist of ten observation-only checks, such as headers, TLS, cookies and DNS email security, and fails closed if that list cannot be resolved. It sends no injection payloads, attempts no logins and never runs the AI agent, and it is rate-limited per visitor.

The AI agent, available on paid plans, can only request paths on the target you registered and works within a capped number of requests per scan.

Payments are handled by Stripe. When you subscribe, you are sent to Stripe Checkout, and your card details are entered on Stripe's own pages. Card numbers never pass through or rest on NovaPentest's servers, and our database has no place to store them.

Changes to your subscription reach us through Stripe webhooks, and every webhook is checked against Stripe's signature before we act on it, so a forged request cannot change your plan. Managing your payment method and subscription happens in Stripe's own billing portal.

If you believe you have found a security vulnerability in NovaPentest itself, we want to hear about it. Please send the details through our contact form at /contact, and begin your message with "Security report" so it reaches the right people quickly. Include the affected URL, the steps to reproduce, and what an attacker could achieve.

While investigating, please act in good faith: only use accounts you own, do not access or modify other customers' data, do not degrade the service for others, and give us reasonable time to fix the issue before disclosing it publicly. We read every report, and we will work with you on a fix and on how and when the issue is disclosed.