Local by default
- The APPCHK CLI scans on your machine or CI runner
- Builds are never uploaded and there is no telemetry
- Network lookups are off unless you turn them on
Security
A security tool has to earn trust first.
You hand APPCHK your unreleased builds, so a security tool has to earn your trust before it scans anything. This page explains how they are handled, where our systems run, and how to tell us if you find a weakness in anything we make.
Your build
Handled as hostile, kept private.
Hostile-input safe
- Packages are read in memory; nothing is extracted to disk
- Size, file-count and compression limits stop archive bombs
- Static analysis never runs code from your app
Careful with secrets
- Secrets found in your app are masked in every report
- Logs never contain file contents
- Runtime testing only on a device you name and authorize
Where things run
Two systems, separated.
appchk.com
This website runs on Cloudflare Workers. It stores only what you send through its forms: contact messages are delivered by email, and access requests are kept to send your invite. It sets no tracking cookies.
APPCHK Cloud
APPCHK Cloud runs on Hetzner infrastructure in the European Union. Builds you upload are processed in isolated scan workers. Retention settings and the list of sub-processors will be published before APPCHK Cloud opens beyond early access.
Reporting a vulnerability
Found something? Tell us.
Anyone can report a security issue: customers, researchers and passers-by alike. Email security@appchk.com.
Please include
- What is affected: appchk.com, the APPCHK CLI, the msec library or APPCHK Cloud, with versions
- Steps to reproduce, and what an attacker could do
- How you would like to be credited, if at all
What we do
- Acknowledge your report within three business days
- Keep you informed until the issue is fixed
- Credit you when we publish the fix, if you wish
Ground rules
Research in good faith.
Please do not
- Access, change or delete data that is not yours
- Degrade our services, or test with automated volume against them
- Use social engineering, phishing or physical attacks
- Disclose an issue publicly before it is fixed
Our commitment
If you follow these rules and act in good faith, we will not pursue legal action over your research. Issues in Cloudflare or Hetzner themselves belong with those providers. Problems APPCHK finds in someone else's app belong with that app's developer.