Security

Last updated November 10, 2026

01What this page covers

This page describes the security controls in the code that runs whywontai.com today. We do not hold SOC 2, ISO 27001 or any other security certification. We do not claim compliance with any standard. For how we use personal data, read the privacy notice.

02Hosting

Lovable hosts the website. Lovable Cloud supplies the backend for sign-in, profiles and enquiries. Site scans, member features and the MCP server run on a separate scan backend: a Supabase project and a Cloudflare Worker. Cloudflare is in front of whywontai.com.

03Encryption in transit

Every page and every backend call uses HTTPS. A plain HTTP request gets a permanent redirect to HTTPS. The site sends a Strict-Transport-Security header for one year that includes subdomains, so browsers connect only over HTTPS. The site also sends the nosniff content-type header and a strict-origin-when-cross-origin referrer policy.

05Who can read what

Row level security is on for the database tables in both backends. A signed-in user can read and change only their own profile. The enquiry table accepts new rows from the browser, but visitors cannot read any rows. In the scan backend, every table has row level security turned on, and each server function checks who the caller is before it reads or writes member data.

06Free scans

To apply the free scan limit, we keep a salted hash of your IP address, not the address itself. The scanner only requests public addresses. It checks the address again at each redirect and stops reading a response after 2 MB. We save the scan result and details from each page, such as status codes, titles and headings. We do not save the full page content.

07API keys and the MCP server

API keys start with wwai_. We show a new key one time only. We store a SHA-256 hash of the key and its first 10 characters, so that you can recognize it. We do not store the full key. You can revoke a key in your dashboard at any time. A revoked key stops working at once.

08Google and Bing connections

Connections are optional. For Google, we ask for your email address, read-only Search Console access (webmasters.readonly) and read-only Google Analytics access (analytics.readonly). Bing offers one permission (webmaster.manage), and we use it only to list your sites and read site totals. We keep refresh tokens in Supabase Vault, an encrypted secret store. When you disconnect, we delete the token. For Google, we also revoke the token with Google.

09GitHub fix pull requests

Fix pull requests use a GitHub App. You install the app only on the repositories that you choose. We never ask for a GitHub password or a personal access token. The app opens pull requests for you to review. It does not merge them. You can remove the app in your GitHub settings at any time.

10Payments

Stripe processes payments. You enter card details on a Stripe Checkout page, not on our site. We never see or store your card number. Stripe signs each billing event that it sends to us. Our backend checks the signature and rejects events that are more than 5 minutes old.

11Secrets

Keys for outside services, such as Stripe, GitHub, email and AI engines, stay in the scan backend. We keep them in Supabase Vault or in server environment settings. They are not in the website code that your browser loads.

12Data retention

We keep saved scans while your account is active, or until you ask us to delete them. We reuse a site's scan results for 24 hours to limit load on scanned sites. When you delete your account, we delete your sign-in account and profile. Copies can stay in our providers' backups and logs until those expire. The privacy notice has the full details.

13Report a security problem

Email Mitchell@whywontai.com with "Security" in the subject line. Tell us the page or address, the steps that show the problem, and what an attacker could do with it. Do not read, change or delete data that is not yours. Do not run tests that slow the service for other users.