Talon Scout · Security
Security
How Talon Scout protects the data that passes through it.
Architecture
- Static frontend, zero runtime dependencies. The page is plain HTML/CSS/JS; there is no third-party script on the page.
- Server-side secrets only. Any API keys live in server-side secrets. They never ship to the browser and are never exposed client-side.
- Same-origin keyless API. The frontend calls the API same-origin; cross-origin API consumers require a shared secret. Rate limiting (10 requests/minute/IP) protects the API.
Data handling
No submitted targets or generated cards are stored by the service. Only per-IP rate-limit counters (10 requests/minute) are kept in Cloudflare KV for 60 seconds. Scan results exist only in your browser session.
Transport and headers
All traffic is HTTPS with TLS 1.2+. Every response carries security headers: HSTS, Content-Security-Policy, X-Frame-Options: DENY, X-Content-Type-Options: nosniff, Referrer-Policy, Permissions-Policy, and Cross-Origin isolation headers.
Third parties
Third-party processors may handle the target's public content transiently: Firecrawl and Apify (page scraping) and DeepSeek (card summarization). All API keys are held server-side as Cloudflare Worker secrets and never shipped to the browser.
Disclosure
Security findings can be reported via /.well-known/security.txt on the service domain or by email to info@raptorlabs.dev.
Limitations (honest)
Talon Scout is a demonstration-grade tool, not a compliance product. It does not hold third-party compliance certifications, and its rate limiting relies on an eventually consistent platform store — treat it as a throttle, not a security boundary.