Security & Threat Model
Last updated: July 2026
Threat model
| Threat | Status | How it's handled |
|---|---|---|
| API key / secret leaks via upload | ✅ Mitigated | No upload endpoint exists. All file and text processing runs client-side. Your data never leaves the browser tab. |
| Man-in-the-middle interception of inputs | ✅ Mitigated | No network request is made for tool inputs. HTTPS/TLS 1.3 covers the initial page load only. |
| Third-party analytics collecting inputs | ✅ Mitigated | Analytics (Cloudflare Web Analytics + PostHog EU) are cookieless, have autocapture and session recording disabled, and record only which tool was used — tool inputs are never captured. |
| Server-side logging of sensitive values | ✅ Mitigated | Static-site export deployed to Cloudflare Workers. Tool inputs never reach the network, so there is nothing to log. |
| localStorage data persistence | ✅ Mitigated | Tool inputs are not persisted to localStorage. Only anonymous usage counts (integers) are stored — never raw input values. |
| Supply-chain attack via npm dependency | ⚠️ Partial | Dependencies run in the browser sandbox. Lockfile is committed and CI fails on unexpected diffs, but cannot fully eliminate the risk. |
| Malicious browser extension reading inputs | ⚠️ Partial | Extensions can read page content. Use a profile without extensions for highly sensitive operations. |
| AI feature sending input data to OpenRouter | ✅ Mitigated | AI Regex Generator sends only your plain-English prompt — not file contents or other tool state. Proxied through a Cloudflare Worker; no raw API key exposed. |
Our security architecture
Aarunya Apps is designed so that your data never reaches our servers. All processing happens inside your browser tab using WebAssembly, JavaScript, and local storage APIs. This is not a policy promise — it is an architectural guarantee.
🛡️ Zero server storage
No input from .env Sanitizer, Schema Generator, Email Signature, or AI Regex Generator is persisted on any server.
🔒 TLS everywhere
All connections to aarunyaapps.com are enforced over HTTPS/TLS 1.2+. HSTS is enabled.
🍪 No tracking cookies
We use Cloudflare Web Analytics — cookieless, GDPR-compliant, no cross-site tracking.
🌐 Content Security Policy
CSP headers restrict script sources and block inline script injection attacks.
What travels over the wire
Most tools make zero network requests. The complete list of exceptions:
- AI Regex Generator — your plain-English description (never the strings you test) is sent to OpenRouter via our Worker proxy. Responses are not stored.
- DNS tools (MX Lookup, BIMI Validator, Email Diagnostics) — only the domain name you enter, resolved via Cloudflare DNS-over-HTTPS.
- OG Tester / Meta Tags Analyzer (URL mode) — only the URL you enter, fetched through our Worker proxy. Paste-HTML mode makes no requests.
- Deliverability Monitoring — if you subscribe, we store your email + domain and check its public DNS daily. Double-opt-in, one-click delete. See the Privacy Policy §4b.
Responsible disclosure
We take security seriously. If you discover a vulnerability, please disclose it responsibly:
Contact: security@aarunyaapps.com
- • Include a description of the vulnerability and reproduction steps.
- • Allow reasonable time (90 days) for us to investigate and patch before public disclosure.
- • We will acknowledge your report within 48 hours.
- • We do not have a formal bug bounty program at this time, but we will credit researchers who help us improve security.
Scope
In-scope for disclosure:
- aarunyaapps.com and www.aarunyaapps.com
- Our Cloudflare Workers: aarunya-ai-proxy, aarunya-og-fetcher, aarunya-license, aarunya-deliverability-monitor, aarunya-dmarc-ingest (*.aarunyatechnmedia.workers.dev)
- The @aarunyaapps/env-redact npm package (github.com/aarunyatech/env-redact)
Out of scope:
- Denial of service attacks
- Social engineering of Aarunya staff
- Third-party services (Cloudflare, OpenRouter infrastructure)
Pro data storage
Pro subscribers can save tool outputs. The storage model is entirely client-side:
- • Storage medium: Browser IndexedDB — survives page reload, cleared when you clear browser data.
- • Encryption: AES-GCM, 256-bit. The encryption key is derived from a device-local UUID stored in localStorage.
- • No server sync: Saved outputs are never transmitted to Aarunya servers. We technically cannot read them.
- • Key revocation: Clearing your browser storage permanently deletes all saved outputs. There is no recovery path.
API Access (coming — Team plan)
The Team plan will include REST API access to select tools. Architecture:
Auth model
API key per Team account, stored in Cloudflare KV. Keys are validated in the Worker on every request — never exposed client-side.
Rate limits
Pro: 100 req/day · Team: 1,000 req/day. Enforced at the Worker level with KV counters per API key.
Endpoints (planned)
POST /api/v1/sanitize (.env Sanitizer) · POST /api/v1/schema (Schema Generator). No AI endpoints in v1.
Data handling
API request payloads are processed in-memory and not logged. No payload persistence on any storage layer.
Third-party services
Aarunya Apps uses the following third-party services. Each has its own security and privacy policy:
- Cloudflare (CDN, Workers, KV, Email Routing, DNS-over-HTTPS, Web Analytics)
- OpenRouter (AI model routing — only used by AI Regex Generator)
- Paddle (payment processing — for Pro and Team plans)
- Resend (transactional email — license keys, waitlist, monitoring alerts)
- PostHog EU (anonymous, cookieless product analytics)