Passwords are never stored
Passwords are hashed with scrypt using a per-user random salt and deliberately expensive parameters (N=16384, r=8, p=1). Verification is a constant-time comparison, so the check cannot be used to guess a hash byte by byte.
Home Security
Private by design, described concretely
Security pages are usually adjectives. This one is mechanisms: what is hashed with what, which cookie flags are set, where keys live and what is checked on every request.
Sessions are HttpOnly cookies
A session is a 256-bit random token in an HttpOnly, SameSite=Lax cookie, marked Secure in production. JavaScript on the page cannot read it, which removes the most common route from a script injection to a stolen account.
Ownership checked on every request
Every protected endpoint resolves the session to a user and then verifies that the requested channel, scan or package belongs to that user. Isolation is enforced per request rather than assumed from the UI.
Provider keys stay server-side
AI provider keys are stored server-side and used only server-side. The browser is told which provider is selected, never the key. Environment-provided keys take precedence over stored ones so a deployment can avoid storing them at all.
Graceful failure, no silent gaps
If a feed or a provider call fails, the scan completes with what it has and reports exactly what failed. You are never shown a thinner result that looks complete.
Scoped data retention
Cached scans expire after 24 hours automatically. Saved packages persist until you delete them, and deleting a channel removes its associated data.
What we ask you to do
A few things are outside our control and worth getting right on your side:
- Use a unique password. Reuse is still the most common cause of account compromise anywhere.
- Scope your provider keys. Create a key for VidiScoop specifically, and set a spend limit where your provider supports one.
- Rotate a key you have pasted anywhere else. If it has ever been in a shared document or a chat window, replace it.
- Protect the cron secret if you enable scheduled scans on a self-hosted deployment. Without it, the endpoint is open to anyone who finds it.
Self-hosted deployments
If you run VidiScoop on your own infrastructure, the security properties described above are the application’s. Everything below the application — the host, TLS termination, backups, network access and OS patching — is yours. In particular, set a cron secret before exposing the instance, and keep the database file off any publicly served directory.
Security questions
The answers people ask for in writing
Can another user see my channels or packages?
No. Every account has its own workspace and every protected request verifies ownership of the resource before returning it. Channels, cached scans, saved packages and provider settings are all scoped to the account that created them.
Are my AI provider API keys ever sent to my browser?
No. Keys are written to the server-side store and read only by server-side code when making a provider call. API responses about your settings include which provider is selected and whether a key is present, never the key value itself.
What happens to my data if I delete a channel?
The channel and the data associated with it are removed. Cached scans expire on their own within 24 hours regardless, and saved packages can be deleted individually at any time.
Do you use my content to train models?
No. When you supply your own provider key, requests go to your provider account under that provider’s terms — which is one of the reasons the bring-your-own-key model is the default. Nothing is used for training by us.
How do I report a security issue?
Email the security details to our support address with steps to reproduce. Please report privately rather than publicly first, and we will confirm receipt and keep you updated on the fix.
Private workspace, from the first scan
Your channels stay yours.
Create an account and everything inside it — channels, research history, packages and keys — is isolated to you.
No credit card required · Your first ranked scan takes about a minute