Security & Privacy

CyberDoc handles sensitive security assessment data. This page documents the platform's approach to data collection, privacy compliance, security hardening, and data retention.

Australian Privacy Act Compliance

CyberDoc is designed to comply with the Australian Privacy Act 1988 and the Australian Privacy Principles (APPs). Key compliance measures:

Data Collection

CyberDoc collects the following data during a scan session:

Consent Mechanism

CyberDoc implements a two-layer consent model:

Layer 1: Lead Submission (Turnstile)

• Cloudflare Turnstile widget verifies the user is human (no CAPTCHA — invisible challenge)
• Turnstile token sent with lead form and verified server-side
• Implicit consent to security check by submitting the form

Layer 2: Pen Test Consent (Explicit)

• Before any browser pen test checks execute, a consent screen is displayed
• The consent text explains exactly what will be tested
• User must click "I Consent — Run Scan" to proceed
• Consent record is stored in KV with full audit trail:

{
  "consent_id": "con_x1y2z3",
  "scan_id": "scan_a1b2c3d4",
  "type": "pentest",
  "ip": "203.0.113.10",
  "user_agent": "Mozilla/5.0...",
  "turnstile_token": "0.xxx...",
  "timestamp": "2026-03-28T10:32:15.000Z",
  "text_shown": "CyberDoc will now perform browser-side security checks..."
}

The full consent text shown to the user is recorded alongside the consent record for legal auditability.

Data Retention

All data is automatically deleted by Cloudflare KV when the TTL expires. No manual purging is needed. Admins can also manually delete individual records before TTL expiry via the dashboard.

Third-Party Services

CyberDoc sends data to the following third-party services:

Security Headers

CyberDoc sets the following security headers on all responses:

Content-Security-Policy (CSP)

Content-Security-Policy:
  default-src 'self';
  script-src 'self' https://challenges.cloudflare.com;
  style-src 'self' 'unsafe-inline' https://fonts.googleapis.com;
  font-src 'self' https://fonts.gstatic.com;
  connect-src 'self' https://challenges.cloudflare.com wss://voice.x.ai;
  frame-src https://challenges.cloudflare.com;
  img-src 'self' data:;
  object-src 'none';
  base-uri 'self';
  form-action 'self';

The CSP allows unsafe-inline for styles only (required for React inline styles). Scripts are restricted to same-origin and the Turnstile challenge domain. WebSocket connections are allowed to the Grok Voice endpoint.

Other Security Headers

Permissions-Policy

Permissions-Policy:
  camera=(),
  geolocation=(),
  payment=(),
  usb=(),
  magnetometer=(),
  gyroscope=(),
  accelerometer=(),
  microphone=(self)

All browser features are disabled except microphone (required for the voice agent, restricted to same-origin only).

HTTPS Enforcement

• Cloudflare Pages enforces HTTPS by default — HTTP requests are redirected to HTTPS with a 301
• HSTS header ensures browsers never attempt HTTP after first visit
• TLS 1.3 is the minimum supported protocol version (configured in Cloudflare SSL/TLS settings)
• Automatic certificate provisioning and renewal via Cloudflare

Security Standards Coverage

CyberDoc's scanning tools cover multiple OWASP security standards, providing comprehensive vulnerability assessment across web applications, APIs, and AI-integrated systems:

Scan Security

Browser-Side Checks

• All 8 browser pen test checks run entirely in the user's browser — no data is sent to external servers during the scan itself
• Results are sent to the CyberDoc API only after all checks complete
• No network probes are performed against external systems
• Explicit consent is required before any checks execute

Server-Side Lab Scans

• Scanner runs in an isolated container environment
• Each scan request is authenticated with shared secrets
• Scanner has no access to CyberDoc's KV data or user information — it only receives the target domain/IP
• Scan output is returned to the Pages Function, which stores it in KV
• Scanner tools run with limited privileges inside the container
• No persistent storage on the scanner — each request is stateless

Incident Response

In the event of a security incident:

1. Rotate all API keys — All service API keys and secrets should be rotated immediately
2. Review admin access logs — Check Cloudflare Analytics for unusual admin API traffic patterns
3. Audit KV data — Review recent scan records for unauthorized access or data exfiltration
4. Notify affected users — If personal data was compromised, notify affected users per APP 11 obligations
5. Report to OAIC — If a notifiable data breach occurred, report to the Office of the Australian Information Commissioner within 30 days

Security Contact

To report a security vulnerability in CyberDoc, contact the development team directly. Do not file a public issue for security-sensitive reports.