Trust Center
Security Architecture
How Script Sentinel limits scanner access, protects browser requests, and handles the evidence needed to generate and monitor Content Security Policies.
Bounded public scanning
Scheduled and free scans use an isolated, bounded Chrome process for public HTTP and HTTPS pages. A canonical public-egress policy is applied to initial DNS resolution, redirects, resolved answers, connected peers, and the Chrome proxy so private, loopback, link-local, special-use, and provider-metadata destinations are rejected.
Scheduled scans do not store site credentials and do not log in to authenticated areas. Browser-extension captures are user-triggered and remain a separate workflow.
Evidence, privacy, and limits
Scanner output is bounded evidence from pages and states the run actually reached. It can miss authenticated, conditional, consent-gated, lazy-loaded, feature-flagged, and user-triggered behavior.
Premium artifacts redact query strings, fragments, credentials, and token-like identifiers before persistence. Retained monitor history follows the account's plan window, and expired operational records are cleaned independently of new scans.
Account and request protection
Google and GitHub sign-in flows use state, nonce, and PKCE checks. Authenticated actions use CSRF tokens, browser POST origin checks, bounded request bodies, server-side sessions, and secure cookie settings on HTTPS origins.
Free scans generate reviewable recommendations and never deploy or enforce a policy automatically. WordPress Premium CSP Autopilot can manage an exact candidate only after an administrator explicitly enrolls the installation and the authorized account approves the Autopilot profile. It uses bounded report-only observation, enforcing validation, production probation, and rollback gates; trust-expanding or unprovable drift still requires exact-candidate approval.
Quiet scan or report evidence is never proof of safety, certification, or compliance. A public scan cannot prove authenticated, personalized, consent-gated, ecommerce, membership, geographic, or time-dependent states, so site owners remain responsible for representative staging tests and recovery access.