Trust Center
Security & Trust
Security tools require trust. This page explains how CyberBlink's services handle data, where the security information they present comes from, and what protections and limitations apply. We describe our tools individually rather than making a single blanket statement, because different tools handle data differently.
Security
Authentication
Sign-in and account creation are handled by Supabase Auth, a managed authentication service. CyberBlink does not implement its own password storage.
Access control
Access to account-only tools and pages is enforced on our servers on every request — not just hidden from view in the browser.
Database protections
Data in our database is protected using PostgreSQL row-level security, which restricts which records a given request is permitted to read or write at the database layer.
Security headers
CyberBlink applies standard HTTP security headers, including a Content Security Policy, to reduce the risk of common web attacks such as clickjacking and content-type sniffing.
Redirect protection
Links that redirect you after signing in are validated on our servers to prevent redirection to unexpected external destinations.
Abuse protection
Sign-in, account, and analysis tools apply rate limits to reduce automated abuse.
Privacy & Data Handling
CyberBlink's tools were built independently of one another, and each handles the data you give it differently, based on what it needs to do its job. Rather than one blanket privacy statement, we describe each tool's data handling individually below.
Jump to Tool Data Handling ↓Tool Data Handling
CyberBlink's tools were built independently of one another, and each handles the data you give it differently, based on what it needs to do its job. Rather than one blanket privacy statement, we describe each tool's data handling individually below.
Password Toolkit
The Password Toolkit runs entirely in your browser. Passwords you check or generate are processed on your device and are never transmitted to CyberBlink's servers.
CVE Lookup
CVE Lookup runs on our servers. When you search for a CVE identifier, CyberBlink retrieves data from the National Vulnerability Database (NVD) and the CISA Known Exploited Vulnerabilities (KEV) catalog on your behalf. We do not store your searches in a database; responses may be held briefly in memory to reduce repeated requests to these sources. The CVE identifier you search for may appear in security logs used to monitor abuse of the service. Severity and prioritization summaries are generated using fixed, deterministic logic — no AI model is used to produce CVE analysis.
Domain + URL Lookup
Domain + URL Lookup runs on our servers. It resolves DNS records for the domain or URL you submit and applies structural and heuristic analysis, such as checks for unusual character encoding or domain structure. It does not currently query third-party threat-intelligence databases or reputation services. The domain or URL you submit is not recorded in readable form in our security logs — those logs record only the type of indicator and a one-way hash of the value. A result showing no known threat evidence is not a guarantee that a domain or URL is safe.
Phishing Analyzer
The Phishing Analyzer runs on our servers and evaluates submitted message content using deterministic, rules-based analysis. Message content is not stored in our security logs. In the current version of the tool, message content is not sent to a third-party AI provider. This describes current behavior; this page will be updated if that changes.
Website Support Chatbot
The support chatbot currently answers questions by matching them against a built-in knowledge base — it does not use a third-party AI model to generate its responses today. Your message content is not stored in our security logs. As with our other tools, this describes current behavior and may be updated as the chatbot evolves.
Authentication / Account
Account creation and sign-in are handled by Supabase Auth. CyberBlink does not store your password directly.
CVE Transparency
Sources
CVE Lookup retrieves vulnerability data from the National Vulnerability Database (NVD), operated by NIST, and enriches results with known-exploited status from CISA's Known Exploited Vulnerabilities (KEV) catalog.
CVSS scoring
CyberBlink prefers the newest CVSS version available for a given CVE (v4.0, then v3.1, then v3.0, then v2.0). Where a CVSS v3.1 vector is available, CyberBlink calculates the base score independently using the published FIRST.org methodology. Scores for other CVSS versions are taken directly from NVD and checked for internal consistency, but are not independently recalculated.
Interpretation
Severity and prioritization summaries are generated using fixed, deterministic logic based on the retrieved data. No AI model is used to write CVE analysis or summaries.
Freshness
CyberBlink retrieves vulnerability information from these sources and may briefly cache responses to reduce repeated requests upstream. This is not a real-time streaming feed — there may be a short delay between an upstream update and its reflection here.
Sources & references
Reference links shown for a CVE are provided directly by the upstream source and are not rewritten or summarized by CyberBlink.
Limitations
Availability depends on the uptime of NVD and CISA. If an upstream source is temporarily unavailable, we indicate that directly rather than presenting an assumption in its place.
Domain + URL Transparency
What it does
- DNS resolution (A, AAAA, CNAME, MX, and NS records)
- Structural and heuristic analysis of the domain or URL itself
What it does not do
- Query third-party threat-intelligence or reputation databases
- Query WHOIS or domain-registration records
- Fetch the content of the submitted URL, or follow redirects
- Provide a guaranteed malicious-or-safe determination
Security Verification
CyberBlink follows a security-conscious development process, including centralized security headers, database-level access controls, and internal review of new features before release.
We have not yet completed an independent third-party security audit or penetration test of CyberBlink. We will update this page if and when that changes.
CyberBlink does not currently hold SOC 2, ISO 27001, or other third-party security certifications.
Contact & Reporting
For general support, visit our Support page. To report a suspected security vulnerability, read our Vulnerability Disclosure Policy or email us directly.