A service that watches the world for you must never become a risk itself. These are the safeguards built into Reality Radar.
When you register a URL, our fetcher only connects to public addresses. Private networks, localhost and cloud metadata are blocked, every redirect is re-validated, DNS is checked at connection time, and size, time and content type are limited.
Text from external pages is treated as data, never as instructions. AI summaries must cite evidence from the source, run under a strict JSON schema, and fall back to rule-based summaries if anything fails.
Passwords are hashed with scrypt. Session tokens are random, stored only as hashes on our side, sent in HttpOnly, Secure, SameSite cookies, and state-changing requests require a matching origin.
Every request for your items, alerts or workspaces is checked for ownership on the server. Shared family items are visible only to members you invited.
We never ask for passwords of other services, bank or card access, or your inbox. Analytics use a daily-rotating hashed visitor ID; raw IP addresses are not stored.
Export everything as JSON or CSV, and delete your account and data instantly from settings.
Strict Content Security Policy, HSTS, no third-party trackers, rate limits on every endpoint, signed webhooks with replay protection and revocable API keys.
Please email projectteamforyou@gmail.com. See /.well-known/security.txt. We respond within a few working days and credit researchers who wish to be credited.
Add three things you own. We will take it from there.
