Security
How we protect your data and the GEO KAMI platform
Our Commitment
Security is foundational to GEO Kami. As a tool that scans websites for security and AI readiness, we hold ourselves to the same standards we recommend to others. We employ multiple layers of protection to safeguard your data and our infrastructure.
Data Protection
Password Security
All passwords are hashed using bcrypt before storage. We never store or transmit passwords in plain text.
Encryption in Transit
All data transmitted between your browser and our servers is encrypted using HTTPS (TLS 1.3). We enforce secure connections for all API endpoints and web pages.
Input Sanitization
All user inputs are sanitized using DOMPurify to prevent cross-site scripting (XSS) attacks. URL inputs are validated, sanitized, and normalized before processing.
Session Management
Sessions expire after 7 days of inactivity. Session tokens are securely stored and transmitted. We use Better-Auth's built-in session management for cryptographic security.
Infrastructure Security
- Database: SQLite in development, Cloudflare D1 in production — both use encrypted storage
- Hosting: Deployed on Vercel's global edge network with built-in DDoS protection
- Payment Processing: Handled entirely by Stripe (PCI DSS Level 1 certified). We never handle raw payment card data.
- Authentication: Better-Auth with support for email/password and OAuth (Google, GitHub)
Scanner Security
Our web scanner is designed with security best practices:
- Identifies itself with a clear User-Agent string:
AgentReadyScanner/2.0 (+https://agentready.scanner.bot/crawler) - Only accesses publicly available information
- Respects robots.txt directives
- URL validation prevents injection attacks
- Scan results are sanitized before storage and display
API Security
- All API endpoints require authenticated sessions
- Scan IDs use UUID format to prevent enumeration attacks
- Request inputs are validated and sanitized server-side
- Rate limiting protects against abuse
- Public scan sharing uses cryptographic share hashes
Responsible Disclosure
If you discover a security vulnerability in GEO Kami, please report it responsibly:
- Email: contact@geokami.com
- Include a detailed description of the vulnerability
- Provide steps to reproduce the issue
- Allow us reasonable time to address the issue before public disclosure
We commit to acknowledging reports within 48 hours and providing a timeline for resolution. We do not take legal action against researchers who follow responsible disclosure practices.
Security Checklist for Users
To keep your account secure:
- Use a strong, unique password (minimum 6 characters required)
- Enable two-factor authentication on your email and social accounts
- Never share your account credentials with others
- Log out from shared or public devices
- Be cautious of phishing attempts claiming to be from GEO Kami
Ongoing Improvements
We continuously evaluate and improve our security posture. Planned security enhancements include:
- Two-factor authentication (2FA) for GEO Kami accounts
- Email verification for new accounts
- Advanced rate limiting and bot detection
- Regular security audits and penetration testing
- API key rotation and revocation