Security
Reporting a vulnerability
Please report security issues privately and give us a chance to ship a fix before public disclosure. Framework badges on the marketing site mean “Aligned with” — never third-party certification.
- Contact
- security@pluginview.com
- What to include
- Reproduction steps, affected endpoint or page, and the impact you believe it has. Proof-of- concept requests are welcome.
- Please avoid
- Public disclosure of unpatched issues, denial-of-service testing, and any access to data that is not yours.
- DSAR / privacy
- Account deletion is available in Settings. Email privacy@pluginview.com for data subject requests.
Controls in place
- 01SSRF protections on every outbound request
- 02Private-by-default authenticated scans with optional share tokens
- 03Origin checks on mutating cookie-authenticated API calls
- 04Auth rate limits, lockout, session revoke on password change
- 05Security event logging for admin and account actions
- 06CSP, HSTS, and secure session cookies
Framework alignment
Source of truth: compliance/checklist.yml. Only frameworks marked aligned: true appear as marketing pills.
🏅 Aligned with OWASP Top 10
We map remediations to the OWASP Top 10 (2021) risk categories.
What we implement: Access control on scans and impersonation, crypto/password hashing, injection defenses via prepared SQL + Zod, security headers, dependency audit CI, auth hardening, integrity of webhooks, security event logging, and SSRF controls.
Evidence: docs/security/owasp-top-10-mapping.md
🏅 Aligned with ASVS L2
ASVS Level 2 ambition for authentication, session, access, and API controls.
What we implement: Password policy, TOTP MFA for privileged users, object-level scan authz, CSRF/Origin middleware, generic production errors, HTTPS/HSTS expectations, and rate limits.
Evidence: docs/security/asvs-l2-matrix.md
🏅 Aligned with NIST CSF 2.0
NIST CSF 2.0 Govern → Recover process evidence for a SaaS scan product.
What we implement: Policies and roles, data inventory, protect controls, detect via security_events, incident response runbook, and backup/restore guidance.
Evidence: docs/security/nist-csf-2.md
🏅 Aligned with NIST SSDF
Secure software development practices without claiming a formal SSDF assessment.
What we implement: PR expectations, threat-model cadence, dependency CI (npm audit), vulnerability intake on this page, and changelog notes for security fixes.
Evidence: docs/security/ssdf-practices.md
🏅 Aligned with CIS Controls
CIS Controls Implementation Group 1–style safeguards appropriate to our stack.
What we implement: Software inventory via lockfile, secure configuration, account management (verify/lockout/MFA), audit logs, data protection (private scans + retention purge), and TLS/HSTS boundary guidance.
Evidence: docs/security/cis-ig1-mapping.md