Security

How EPIC is built

• Local processing. Analysis runs in your browser. There is no EPIC server that holds your scan data.
• Store distribution. EPIC is distributed through the Chrome Web Store and Microsoft Edge Add-ons, which review extensions and deliver signed updates.
• Minimal network use. Besides the sites you scan, EPIC only contacts Lemon Squeezy's license API for paid plans, and Google Public DNS when you run the optional DNS lookup.
• Secrets handling. Detected secrets are masked and never stored. Saved API snippets are encrypted (AES-GCM, 256-bit) with a key that can't be exported from your browser.
• Debugger use. The browser debugger is attached only during a scan, to the tab being scanned, and detached afterwards.

Reporting a vulnerability

If you believe you've found a security issue in EPIC or this website, email support@edgeproworkbench.com with the subject “Security report”. Please give us reasonable time to fix it before disclosing it publicly, and don't access other people's data while testing. We'll acknowledge your report and keep you updated.