Overview
Beyond data encryption and password hashing, Verusight implements multiple layers of application and infrastructure security to protect against abuse and attacks.
HTTPS Everywhere
All communication with Verusight occurs over HTTPS with TLS encryption. There are no HTTP endpoints — unencrypted connections are rejected. This applies to:
- Web application (dashboard, reports, settings)
- API endpoints
- Webhook callbacks
- Domain verification requests
Rate Limiting
Verusight enforces rate limits on all sensitive operations to prevent brute-force attacks and abuse:
| Operation | Limit |
|---|---|
| Email code verification | 5 attempts per 15 minutes |
| DNS / File verification | 15 attempts per 5 minutes |
| Login attempts | Rate-limited per IP |
| Scan requests | Rate-limited per IP and user |
| API endpoints | Rate-limited per key |
Rate limits are enforced both per-user and per-IP depending on the endpoint. When a rate limit is reached, you'll see a clear error message with the wait time.
SSRF Protection
When verifying domains via file upload, Verusight fetches a file from your web server. To prevent Server-Side Request Forgery (SSRF) attacks:
- The domain's IP address is resolved before the fetch request
- Private and internal IP ranges are rejected:
127.x.x.x,10.x.x.x,192.168.x.x,172.16-31.x.x, IPv6 loopback, and link-local addresses - The request uses a 5-second timeout to prevent hanging connections
- A custom User-Agent header (
Verusight-DomainVerifier/1.0) identifies our requests
DNS Resolver Configuration
For DNS TXT verification, Verusight bypasses local DNS caches and queries authoritative sources directly:
- Google DNS:
8.8.8.8 - Cloudflare DNS:
1.1.1.1
This ensures consistent results regardless of local DNS configurations or caching delays.
Containerization
The application runs in isolated containers with:
- Minimal attack surface — only required dependencies installed
- No root access within containers
- Network isolation between services
- Automated deployments with consistent environments
Input Validation
All user inputs are validated server-side:
- Domain names: Format validation, TLD checking, normalization
- Email addresses: RFC-compliant validation before sending verification codes
- Verification tokens: Cryptographic comparison, not string matching
- Payment data: Handled entirely by Polar (PCI-compliant) — never touches our servers