AgentBurn getagentburn.com
Sponsor Submit Agent
Home/Security
Security · responsible disclosure

Security at AgentBurn

The site is static content plus a small set of Cloudflare Pages Functions. This page describes the controls that protect submissions, leads and telemetry, and how to report a problem.

Last updated 2026-10-21 · security.txt

Reporting a vulnerability

Email [email protected] with a description, reproduction steps and the affected URL. We acknowledge within two business days and aim to fix confirmed issues within 30 days. Please do not run destructive tests, access other users' data, or post details publicly before a fix ships.

Machine-readable contact and expiry: /.well-known/security.txt.

What is in place

  • Transport: HTTPS only; Cloudflare terminates TLS and enforces HSTS at the edge.
  • Admin surface: /admin is noindex and every API route requires a bearer token (AB_ADMIN_TOKEN) that is never shipped to the browser.
  • Write endpoints: submission, lead and telemetry routes are rate limited per IP and capped in body size; telemetry batches are limited to 100 events and 32 KB.
  • Data isolation: submissions, leads and telemetry live in a dedicated KV namespace (AB_KV) with separate key prefixes.
  • Redaction: the SDK strips prompts, responses, messages, content and authorization fields before an event leaves the agent process; the server never asks for them.
  • Minimal surface: no third-party analytics scripts, no ad networks, no cookies beyond what Cloudflare sets for security.

Data protection

Submission data is reviewed by a human and only published with consent. Retention windows are listed in the privacy policy: 90 days for review-queue submissions, 365 days for report leads, 30 days of raw telemetry followed by 90 days of daily aggregates. Deletion requests are handled within 30 days.

Response headers

The site sends a restrictive Content-Security-Policy (default-src 'self'), X-Content-Type-Options: nosniff, a referrer policy and a frame policy. If you find a header missing on a route, report it via the address above.

Out of scope

Denial-of-service testing, social engineering, physical access, and reports produced only by automated scanners without a demonstrated impact are out of scope. We still read every report.