Security

01. REPORTING A VULNERABILITY

If you find a vulnerability in Crossfyre, email [email protected] with the steps to reproduce it. The same address is in our security.txt.

• Test against your own account and your own data.
• Do not exploit the vulnerability beyond what is necessary to demonstrate it.
• Do not access, change or keep other customers' data.
• Give us a reasonable time to fix it before you publish. We ask the same of the maintainers we report to; that work is on the disclosures page.

02. IN TRANSIT

crossfyre.io and its API are served only over HTTPS, through Cloudflare, with TLS 1.2 or later; older protocol versions are refused, and plain HTTP is redirected. Both send HSTS, so a browser that has visited once will not fall back to plain HTTP.

03. AT REST

The credentials you give the scanner, such as tokens, passwords and cookies for authenticated scans, are encrypted in the database with ChaCha20-Poly1305, under a key kept outside the database, and are decrypted only on the server when a node needs them. OAST secrets are stored the same way. Account passwords are kept as Argon2 hashes, and node and API keys as hashes, so none of them can be read back.

Other data, such as assets and findings, is not encrypted field by field. It is protected by the database and network boundary: the database accepts connections only from our own application servers and is not reachable from the internet.

04. ACCESS TO PRODUCTION

Production runs on AWS in Frankfurt (eu-central-1), behind Cloudflare. Administrative access to the servers goes through AWS Systems Manager, or SSH with a key from a single allow-listed address.

05. AI AND YOUR EVIDENCE

Valkyrie, the AI triage and chat in the dashboard, is switched off on crossfyre.io, and nothing is sent to an AI model today. It stays off while it moves to bring-your-own-key, so that every model call runs on an API key under API terms.

What it sends when it runs

Requests go from our server to an AI model provider over HTTPS. Triage sends up to 50 findings at a time, and for each one its internal id, kind and signature, the engine's severity and confidence, its title and description, each cut to 600 bytes, and its evidence, with every text value in it cut to 512 bytes.

Chat sends your messages and the conversation before them, and what Valkyrie looks up in your workspace to answer: counts of its domains, endpoints, operations, findings and online nodes, up to 40 recent findings with their severity, title and asset, up to 60 each of its hosts, endpoints and operations, the names of up to 20 online nodes, and up to 20 recent workflows with their name, type, status and number of findings.

What is taken out first

Every message in every request passes through one redaction step on our server before it leaves, and nothing in the code can send a message around it. Only our own instructions to the model and the definitions of its tools go as written, and they carry nothing of yours. A value is replaced with a placeholder that says what it was, such as [REDACTED_JWT], or with [REDACTED] beside the key that names it, when:

• its key, header or flag names a credential, such as password, api_key, _authToken, session or cookie, whether it is written in JSON, a header, a query string or form body, YAML, a .env file, a connection string, SQL or code;
• it is a token in a format the redactor knows, such as an AWS access key, a GitHub, GitLab, Slack or Stripe token, or a JWT, whose header is kept;
• it is a private key, a password hash or a password in a URL;
• it is any of these inside percent-encoded, HTML-escaped, backslash-escaped or base64 text.

What it misses

It works on names and formats, not on meaning, so a secret written in a shape it does not know gets through. These are the cases we know of:

• A credential with nothing around it that names it or gives its format, such as logged in as admin / Zx8#Lp2!Qm7v typed into a chat.
• A password made of ordinary words, written after a label the way a sentence would be.
• A key name disguised with an invisible character or a look-alike letter.
• A key split in two by the chunk framing left in a captured HTTP body.
• A secret wrapped more than 16 layers deep in JSON strings or encodings, or in more encoded text than one request is allowed to decode.

It looks for credentials, not personal data, so email addresses and names are sent as they are. An email address is often the finding itself.

What it can do

Valkyrie cannot send a request to a target itself. Chat has two tools: a read-only lookup in your own workspace, and a proposal for a scan. A proposal becomes a scan when you approve it, and the scan runs on your own nodes like any other. If you switch the chat to auto-run, a proposal starts as soon as it is made, and only Valkyrie's instructions keep it to targets already in your workspace or named in your own messages. Triage reads findings that already exist and records a verdict beside each one. It does not change or delete a finding.

How long chat is kept

Redaction applies to what is sent, not to what is stored. A conversation is kept in your workspace as it was written, so you can come back to it, and nothing deletes it on a schedule: it stays until you delete it, or until the workspace is deleted. Archiving a workspace keeps its conversations.

06. PAYMENTS

Payments are handled by Razorpay. Card details go to Razorpay directly and never reach our servers.

07. NOT BUILT YET

Two-factor authentication for your Crossfyre account is not available yet. It is on the list of what is missing, and until it exists a strong, unique password is the protection on your account.

08. WHAT THE PRODUCT REFUSES TO DO

Crossfyre sends real payloads at the targets you give it. Two rules in the vulnerability engine limit where those payloads go and what a scan may change, and both are in the engine's public source. The third is about what Valkyrie sends to an AI model.

It does not point payloads at hosts you did not name.

Before the vulnerability engine injects into an endpoint, it checks that the endpoint's host is the scan's target or is on your workspace scope list. An endpoint anywhere else, such as a form that posts to a different site, is skipped, and the scan log says so. Nothing a scan discovers is ever added to that list, and an entry the engine cannot parse is refused rather than read as a wildcard.

crossfyre-toolchain/scope/src/lib.rs

It is built not to change the application it tests.

The engine does not inject into a link whose query names an action, such as ?action=delete, and a form it recognizes as a password change loses its password fields before it is injected. PUT, PATCH and DELETE endpoints are skipped, and a GraphQL mutation is listed, not called. Ordinary form and API submissions do carry payloads, because that is where injection bugs are found, so a test can still leave records behind.

crossfyre-toolchain/plessor/src/inject.rs

It is built not to send credentials to an AI model.

Valkyrie, the AI triage and chat, is switched off on crossfyre.io, and nothing is sent to an AI model today. When it runs, every message passes one redaction step on our server before it leaves, and a value under a key that names a credential, a token in a known format, a private key or a password hash is replaced with a placeholder. It matches names and formats, not meaning, so a password typed into a chat with nothing around it to say what it is would still get through.

What is sent, and what is taken out

Neither engine rule checks whether you are authorized to test a target. That is yours to confirm, under our Acceptable Use Policy.