Nyrolo Security Architecture
Real technical controls protecting our platform, your client sites, and your audit data.
Enterprise SSRF Defense & IP Pinning
Our crawler resolves DNS addresses beforehand and validates every resolved IP against strict blacklists. All loopback subnets (127.0.0.0/8, ::1), private RFC 1918 subnets (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16), and cloud metadata endpoints (169.254.169.254) are rejected immediately.
Decimal & Hex IP Evasion Protection
Attackers often use non-standard representations like 2130706433 or 0x7f000001 to bypass naive URL filters. Nyrolo's parser parses numeric, hex, and octal integer formats and neutralizes them before socket allocation.
Per-Hop Redirect Re-Validation
Many SSRF attacks work by issuing a redirect from a public website to an internal address. Nyrolo disables automatic redirect following and manually inspects the Location header of every 3xx redirect against the exact same SSRF guard.
Strict Crawl Boundary Limits
To prevent overwhelming client staging servers, our crawler limits concurrency to 3 simultaneous requests, enforces an 8-second timeout per page, caps payload downloads at 2 MB, and adheres to all robots.txt rules.
Row Level Security (RLS) on Every Table
Our database enforces PostgreSQL Row Level Security on all 11 tables. Users can only select or mutate their own project records, audit logs, and monitors.
Zero Secrets in Code
All authentication keys, database service role tokens, Razorpay secrets, and Resend credentials are stored exclusively in server environment variables and are never committed to repositories or exposed to client bundles.