Privacy
HexBrain can be used without an account, and it does not track you. This page says exactly what is kept when you do sign in.
Without an account
The map, every report, the CVE library, the payloads and the downloads are open to everyone. No cookies are set, and there are no adverts, analytics scripts or third-party trackers on any page.
To stop abuse, the server counts requests per network address for a minute at a time. Those counts are held in memory only and are never written down.
When you sign in
Sign-in is through Google. From Google we receive, and store, four things:
- your name
- your email address
- the address of your profile picture
- the identifier Google uses for your account
We never see your Google password, and we ask Google for nothing else. One cookie keeps you signed in for up to 30 days; scripts on the page cannot read it, and it is removed when you sign out.
API keys
If you create an API key, we store a one-way hash of it, the name you gave it, when it was created, when it was last used and how many requests it has made. The key itself is shown to you once and cannot be recovered from what we hold. We do not record what you search for or which reports your assistant reads.
Who else handles the data
- Google, to sign you in.
- Cloudflare, which sits in front of the site and so sees the requests made to it.
- The company that hosts our server.
We do not sell, rent or share what we hold with anyone else.
Removing your data
The account page has a Delete account button. It removes your profile, your sessions and every key straight away. Nothing is kept afterwards.
Reports about you or your organisation
Reports shown here were disclosed publicly on HackerOne by the programs concerned. If a report has since been withdrawn there, or you believe something here should not be public, tell @hackerspider1 and it will be removed.
Questions about any of this go to the same place. See also the terms of use.