Transport
TLS everywhere
Every connection to Bluntpage runs over HTTPS. Plain HTTP requests are redirected. Session cookies are marked Secure and HttpOnly, so page scripts cannot read them.
Security
What we do. What we do not.
No badgesYou will not find a wall of compliance logos here, because we have not earned them yet. You will find a plain list of what protects your account today, and a plain list of what is still missing.
What we do
Six things, all true today.
Passwords
Hashed with scrypt
We never store your password. We store a salted scrypt hash, which is deliberately slow and memory hungry to attack. Password reset links are single use and expire after 60 minutes. If you use Google sign-in, we never see a password at all.
Fetcher
A page fetcher that cannot be aimed inward
A tool that fetches URLs for strangers is a classic attack path, so ours is fenced in. It fetches public HTML only, blocks private and internal network addresses, stops reading at 600 KB, and gives up after 9 seconds. It identifies itself honestly as BluntpageBot, so site owners can see it and block it if they want.
AI output
Model output is validated, not trusted
The model receives a structured outline of your page, not raw HTML. Whatever it returns is checked against a strict zod schema before it touches your report. Output that does not match is rejected and retried once. If it fails again, you get our rules-based checks instead of a broken report.
Abuse
Rate limiting
Signup, password reset, roasting, re-checks, and every public form are rate limited per client. It keeps the bots bored and stops anyone using our fetcher as a traffic cannon.
Least data
We keep very little
For each roast we store the page outline, the results, and any HTML you pasted, tied to your account only. We do not keep a crawl archive of your site. We never see card numbers. You can export everything and delete your account from Settings, and the delete is immediate.
What we do not claim
Not yet. Said out loud.
A security page that only lists the good parts is a brochure. Here is the rest.
Honest list
- No SOC 2 report. We are a Pre-Seed company of 8 people. SOC 2 Type I is planned once the team and revenue justify the audit. We will not imply otherwise in a sales call.
- No ISO 27001, no HIPAA, no FedRAMP. Do not paste regulated health or government data into a landing page roaster.
- No paid bug bounty yet. We do offer credit, thanks, and a fast response.
- No third-party penetration test yet. One is planned alongside the SOC 2 work.
- No single sign-on (SAML) yet. Google sign-in is available today.
Sub-processors
Who else touches your data
Three companies. That is the full list. If it changes, this page and the Privacy Policy change first.
| Company | What it does for us | What it sees |
|---|---|---|
| Vercel | Hosting, serverless compute, and the document store | Account records, roasts, pasted HTML, request logs |
| OpenAI (API) | Generates the roast and the rewrites | The text content of the page being roasted. API data is not used to train models. |
| Stripe | Payments, when billing is enabled | Your email, plan, and payment details. Card data goes to Stripe directly and never touches our servers. |
Responsible disclosure
Found a hole? Roast us.
Email security@bluntpage.com with what you found and how to reproduce it. A human acknowledges every report within 72 hours, and we keep you posted until it is fixed.
- Test against your own account only. Do not access, change, or delete other people's data.
- No denial of service, no spam, no social engineering of our team.
- Give us a reasonable window to fix the issue before you publish.
- Act in good faith under these rules and we will not pursue legal action against you. We will credit you publicly if you want the credit.
Useful in a report
- The URL or endpoint affected.
- Steps to reproduce, as short as possible.
- What an attacker could gain.
- Your name or handle, if you want credit.
Bluntpage Inc., Atlanta, GA