Security

What we do to protect accounts and data, and what we have not done yet.

Accounts

Passwords are never stored. We store a salted scrypt hash, and the same time is taken whether or not an email is registered.
Sessions use random tokens that are stored hashed on our side, and are sent in an HttpOnly, SameSite cookie that is Secure over HTTPS. Changing your password signs out all other sessions.
Sign-in attempts and sign-ups are rate limited per network address.
Requests that change data need a custom header and a same-site origin, which blocks cross-site request forgery.

Your data

Every site belongs to one account, and every query is scoped to the owner. Cross-account access is covered by automated tests.
All traffic is served over HTTPS with HSTS.
Unsubscribe links are signed with a secret that never leaves the server. Chat replies are checked against the shop's own pages and offer before they reach a visitor, and marketing email is rate-limited and escaped.
The dashboard sets a strict Content-Security-Policy that forbids inline scripts, and everything rendered from collected data is escaped.
The collector rejects events from outside a site's registered domain where the browser reports an origin, drops properties that look personal, and accepts only anonymous page views from visitors who have not consented.
Raw events are deleted after 395 days, and you can erase a visitor, a site or your account at any time.

The crawler

UnagiBot only visits domains whose owner has proved control.
Domains must be real public DNS names. Connections to private, loopback and link-local addresses are refused at connection time, which also defeats DNS tricks. Redirects may not leave the owner's hostnames, and only ports 80 and 443 are used.

What we have not done

The service has not had an independent security audit or penetration test, and we hold no certifications such as ISO 27001 or SOC 2.
Sign-in throttling is per address and email, so a distributed attack on one account is not fully stopped.
There is no two-factor authentication or single sign-on yet, and no password reset by email yet.

Reporting a vulnerability

If you believe you have found a security issue, email uk@youok.uk with the details. Please give us reasonable time to fix it before disclosing it, and avoid accessing other people's data or disrupting the service while you test. We will acknowledge reports and keep you informed.