Built to test your app, and nothing else.
Softsurance runs automation against URLs our customers supply. That creates real risk — server-side request forgery, credential exposure, runaway execution — so the defences are part of the product, not a page about it.
01 / Controls
What we enforce9 controlsAuthorised targets only
Users confirm ownership or permission and define the domains in scope. Execution refuses anything outside it.
SSRF defences
Loopback, private ranges, link-local and cloud metadata addresses are blocked — checked at DNS resolution, on redirects and at connection time.
Isolated execution
Tests never run in the web process. Workers have CPU, memory, disk, time and egress limits, and no host paths.
Encrypted credentials
Secrets are encrypted at rest, scoped to organisation, application and environment, and never returned by the API.
Redaction
Tokens, cookies, passwords and keys are removed from logs, evidence, error reports and AI prompts.
Organisation isolation
Every request and artifact read is authorised server-side. Cross-organisation access is covered by automated tests.
Prompt-injection aware
Inspected content is untrusted data. AI output is validated against scope, permitted actions and the approved plan.
Audit trail
Scope changes, credential changes, approvals, executions, schedules and permission changes are recorded.
Resource limits
Request rates, concurrency, timeouts and artifact sizes are capped per organisation and plan.
02 / Acceptable use
What we won’t buildBy designSome features we refuse to ship.
Softsurance is a testing tool for systems you own or are authorised to test. It is not a scanner or an attack tool.
No CAPTCHA or MFA bypass
Use test accounts and environments configured for automation.
No access-control evasion
Tests run with the access you grant, and no more.
No unrestricted scanning
Discovery is limited in depth, pages, time and requests, and stays in scope.
03 / Disclosure
Security questionsContactHave a security question or found a vulnerability? Contact us — we read every report.