security
Security.
stole.si opens untrusted web pages all day, so it treats every page as possibly hostile. If you find a way around its protections, please report it.
Report a problem
Email security@stole.si, or use the contact form and pick “A security problem”. Include the steps to reproduce it, what you expected and what happened. Every report is read, and fixes are listed in the changelog once they ship.
In scope
www.stole.si: its pages, reports, downloads, API and MCP server.- Making the scanner reach private networks, internal addresses or the server itself.
- Running code or reading files on the server.
- Making a report run script on stole.si (cross-site scripting).
- Seeing or changing anything that isn’t meant to be public.
Please don’t
- Run automated vulnerability scanners or load tests against stole.si, or try to take it offline.
- Use stole.si to attack other websites.
- Look at, copy or keep data that isn’t yours. Stop and report as soon as you see something you shouldn’t.
- Share the details publicly before a fix ships.
Not in scope
- Reports from automated tools without a working example.
- Missing headers or settings with no real way to exploit them.
- Rate limits that are generous on purpose, and anything that needs social engineering.
How stole.si protects itself
- Each scan runs in its own sandboxed browser with its own memory limit, and every process it started is stopped when it ends.
- Scans can only reach the public internet. Each address is checked on every request and redirect, and the server’s firewall blocks private and internal networks a second time.
- Addresses that contain a password, token or key are refused, so they never end up in a public report.
- There are no accounts, so there are no passwords to steal. The site loads no third-party scripts and sends a strict Content Security Policy.
Machine-readable contact details are in security.txt.