Security at White Light AC

How we protect the service

• Server-side scoring. Every uploaded report is re-scored on our servers from the raw evidence. The verdict a scanner reports about itself is ignored.
• Untrusted evidence stays inert. Reports come from machines we don’t control, so their content is only ever rendered as plain text — it can’t run script in the Portal.
• Accounts and sessions. Passwords are hashed with scrypt. Sessions are random tokens stored hashed, in HttpOnly, SameSite=Strict cookies. State-changing requests require an anti-CSRF header.
• Rate limits and single-use PINs. Login, PIN and upload endpoints are rate-limited; scan PINs work once and expire.
• Audit trail. Security-relevant actions in the Portal are written to an audit log.
• Strict browser policies. The Portal and this website send a restrictive Content-Security-Policy, and this website refuses to be framed by other sites.

The scanner

White Light AC Scanner is read-only: it doesn’t modify, delete or quarantine anything, doesn’t install a service or driver, and nothing keeps running after a scan. It never uploads file contents, passwords, browser data, messages or tokens. See Privacy for the full list of what a report contains.

The scanner asks for administrator rights only because Windows restricts the forensic sources it reads. Declining is allowed and produces a clearly labelled partial-coverage report.

Reporting a vulnerability

If you believe you’ve found a security vulnerability in White Light AC — this website, the Portal or the Scanner — please use the contact form and choose “Support”.

Helpful reports include:

• what the issue is and which part of the service it affects,
• steps to reproduce it, and
• what an attacker could achieve with it.

We’ll acknowledge your report, keep you updated while we investigate, and credit you once it’s fixed if you’d like.

Good-faith research

We won’t pursue or support legal action against research that follows these rules:

• Only test against accounts and data you own or have permission to use.
• Don’t access, change or keep other people’s data — stop and report as soon as you see any.
• Don’t degrade the service: no denial-of-service, spam or automated high-volume testing.
• No social engineering, phishing or physical attacks against staff or users.
• Give us reasonable time to fix an issue before disclosing it publicly.

Scope

In scope: whitelightac.com, the White Light AC Portal, its APIs, and White Light AC Scanner.

Out of scope: denial-of-service, reports from automated scanners without a demonstrated impact, missing best-practice headers without an exploit, issues in third-party services we don’t control, and anything requiring a compromised device.