Security ownership
GetCitedByAI is operated by Daniil Sokolov from Belgium. Security and vulnerability reports should be sent to support@getcitedbyai.io. Please include enough detail to reproduce the issue and avoid accessing, changing, or retaining another user's data.
GetCitedByAI does not claim a security certification, independent security audit, service-level agreement, or paid bug-bounty programme.
Accounts and sessions
- Passwords are hashed with scrypt and a unique random salt. Plain-text passwords are not stored.
- Production browser sessions use a Secure, HttpOnly, SameSite=Lax cookie. Session tokens are stored server-side as hashes, can be revoked, expire after inactivity, and have an absolute lifetime.
- Login attempts are rate limited, email verification and reset tokens expire, and Google sign-in uses a short-lived state value to protect the OAuth return.
- Authenticated requests resolve an account and workspace, and private reads and writes are scoped to that workspace.
Audit inputs and network safety
Submitted URLs and pasted text are treated as untrusted input. URL acquisition accepts uncredentialed public HTTP or HTTPS destinations on standard ports and rejects local, private, reserved, and known infrastructure destinations. Redirect destinations are checked before content is accepted.
Request bodies have size and shape limits. Audit evidence, reports, and persisted billing records are read through authenticated, workspace-scoped routes.
Browser and provider controls
The public web app sends a Content Security Policy that limits scripts and other resources, blocks framing, and disables browser access to camera, microphone, and geolocation. Additional headers request strict referrer handling and content-type protection.
Cloudflare provides the application, storage, workflow, network, and operational-analytics infrastructure. OpenAI processes model requests for audits. Model requests use store: false, which disables storage of the Responses API response object; it is not a zero-data-retention guarantee. Locally retained raw source and full model request and response bodies follow a 30-day deletion schedule, subject to short deferral where an active run still requires them.
Payments and incidents
Stripe-hosted Checkout handles payment details. GetCitedByAI verifies Stripe webhook signatures before processing events and grants purchased credits from workspace-bound purchase records. Fulfilment is designed to be idempotent so a replayed event does not issue the same credits twice.
No service can guarantee absolute security. If a confirmed incident affects personal data, GetCitedByAI will investigate, contain it, and make notices required by applicable law.