Security model

How the dashboard talks to your sites, how secrets are stored, and how the A–F grade is calculated.

Full guide coming soon — the essentials are below. If you get stuck in the meantime, contact support and a human will help.

HMAC request signing

Every request between the dashboard and a connected site is signed with a secret unique to that site and timestamped, so tampered or replayed requests are rejected.

Credential encryption

Admin credentials you store for auto-install are encrypted at rest with AES-256-GCM and decrypted only transiently to perform the action you requested.

Vulnerability scanning

Plugin, theme and core versions are checked against known CVEs on every scan, severity-ranked per site.

The A–F grade

One honest grade per site, driven by outstanding vulnerabilities, pending updates and configuration signals — with the reasons listed so you know exactly what to fix.

Reporting a vulnerability

Email us with "SECURITY" in the subject for priority handling. Please don't test against sites you don't own.