Security Practices
Provelex stores logins for sites you test and reports listing their weaknesses, so it has to be careful with both. This page describes what we actually do, and also what we have not done yet.
Accounts and sign-in
Passwords
Stored only as Argon2id hashes. We cannot read your password.
Limits on guessing
Sign-in attempts are limited per address and per account, and repeated abuse is blocked at the server.
Sign-in tokens
Expire after 30 days and are removed from our server logs.
Confirmation links
Only a hash of each link is stored, and a new link retires the old one.
Logins for the sites you test
Encrypted when stored
Logins you add are sealed with AES-256-GCM under a key derived with Argon2id.
Kept from the AI
The model sees a placeholder and Provelex fills in the real password itself, only into a password field.
Even so, please use a dedicated test account with test data rather than a real administrator login.
Reports and shared results
Access
Applications, runs and reports are tied to your account, and every request is checked against it.
Shared links
A published score shows how many findings there are and how severe. It never includes their titles, addresses, evidence or fixes. Links are unguessable and you can withdraw them.
Free results
Basic results are deleted after 30 minutes and speed tests after 24 hours.
Limits on what Provelex can be used to do
Authorisation on record
Assessments in an account need a recorded authorisation. Reports state how it was given.
No reaching inward
The hosted service refuses private and internal addresses, including when a site redirects to one, so it cannot be used to reach internal networks.
Bounded active testing
Active probes stay in scope, are limited to 120 requests per run with pauses between them, and use detection markers rather than exploits.
Limits on abuse
Free tools have hourly limits per address, and the number of simultaneous runs is capped.
Infrastructure and payments
- All traffic to provelex.com is encrypted with HTTPS, and browsers are told to insist on it.
- A firewall allows only the services that need to be reachable, and repeated abusive requests are blocked automatically.
- The database and stored files are backed up nightly, and backups are kept for 14 days with restricted access.
- Dodo Payments handles card details, which never reach Provelex. Payment notifications are verified by signature before any credits are granted.
Reporting a concern
If you think you have found a vulnerability, please follow the Responsible Disclosure page. For any other security question, write to provelex@devsapience.com.
Related pages
Need help with your account or a report? Email provelex@devsapience.com