← Back to Shield404
Shield404 Security
We don't ask you to take our word for it: here are the concrete measures, and how to verify each one yourself.
✓ Every claim on this page can be verified with free, public tools — no access to our code required.
🔒 End-to-end transport encryption
- Valid TLS certificate issued by Let's Encrypt, automatically renewed every 90 days.
- Active
Strict-Transport-Security header: your browser refuses to connect over insecure HTTP even if something tries to force it.
- Check it yourself: SSL Labs or securityheaders.com.
🕵️ Data minimisation by design
- We don't store IP addresses. We use an anonymous, irreversible fingerprint (a hash with a key that changes on every server restart).
- The passwords you check never leave your device (k-anonymity technique).
- Files you analyse are never uploaded to our servers: they're examined in your own browser.
- Full detail in our Privacy Policy.
🛡️ Active server protections
- Per-user request limits (rate limiting) on every endpoint, to prevent automated abuse.
- Restricted CORS: only shield404.com and shield404.es can use our API directly.
- Protection against "clickjacking" (
X-Frame-Options: DENY): Shield404 cannot be embedded in another website to trick you.
- Camera/microphone/location permissions disabled by default, except the camera for the QR scanner (which you explicitly enable).
📖 Non-public code, auditable behaviour
The source code of the analysis engine is not publicly accessible (it's our intellectual property). But its behaviour can be audited by anyone, at any time:
- Every response from our API can be observed using your own browser's developer tools (F12 → Network tab).
- You can check exactly what data leaves your device, and where it goes, for every check you run.
- If you spot any behaviour that doesn't match what's described here, contact us — it's a vulnerability, and we'll treat it as one.
🐛 Responsible vulnerability disclosure
If you're a security researcher and you find a problem, follow it up through our standard security.txt file, or write directly to contacto@shield404.com. We commit to:
- Acknowledging receipt within a reasonable timeframe.
- Not taking legal action against anyone reporting in good faith, following a responsible disclosure process.
- Fixing the problem and, where appropriate, publicly thanking you (with your permission).