Security at Wobbly.
Wobbly is read-only and bounded by design. Here's exactly what we do and don't do.
Read-only by design
Dots fetch your public pages and reason about them. They never log in, submit forms, create accounts, or complete payments.
SSRF protection
We block private and internal addresses (localhost, 10.x, 192.168.x, 169.254.x, metadata endpoints, .local, .internal) before any fetch.
Bounded scans
Each fetch has a 12-second timeout and we cap page size and image sample count. Dots never crawl beyond the page you submit.
Your data is yours
Your apps, runs, and findings are visible only to you and admins of your account. You can export or delete everything at any time.
Secrets
Secrets are encrypted at rest and never exposed to the client. Backend functions run with least privilege.
Security headers scanning
Nosy Dot checks for CSP, HSTS, X-Frame-Options, and X-Content-Type-Options so you can harden your app.