User URLs, DNS answers, redirects, response headers, HTML, scripts, metadata, extracted text, third-party provider responses, and model output are untrusted. The API validates user intent; the crawler validates network targets; detectors convert observations to typed facts; the risk engine alone computes the score; the web UI renders only structured text.

SafeFetcher permits only HTTP/HTTPS, strips fragments, rejects credentials and non-standard ports, normalizes IDNs, resolves hostnames before the job is accepted, and denies loopback, private, link-local, multicast, reserved, unspecified, metadata, and internal hostnames. Every redirect is resolved and revalidated. Body size, redirect count, connection/total timeout, MIME types, and downloadable-file types are bounded.

Application checks are defense in depth, not a substitute for infrastructure isolation. Production workers must run in a disposable container or microVM with no route to internal, cluster, management, or metadata networks. Force all public egress through a policy proxy and deny new destinations if a hostname changes to a forbidden address.

• Scraped HTML is never rendered in the application.
• Deterministic extraction is the default.
• Optional model input labels website text as hostile data and explicitly forbids following embedded instructions.
• Instructions, user input, and retrieved evidence are separate.
• Model output uses a strict JSON schema, is validated with Pydantic, has no score/verdict field, and falls back safely.
• store: false is sent to the optional Responses API adapter.

ScamShield has no registration, account, password, subscription, or billing data. The web app and extension create a random local visitor identifier. The API stores only an HMAC-SHA256 digest of that value and uses it to scope scan history, saved websites and monitoring events. Clearing browser storage severs access to that private history.

Only explicit scan data is stored. The extension never reads or sends input values, cookies, authentication tokens, local/session storage content, authorization headers, unrelated history, passwords, or card data. Data export, history deletion and individual scan deletion are implemented.

Per-minute burst protection, anonymous-visitor active-scan concurrency controls, body/time/redirect bounds, Celery concurrency/time limits, provider feature flags, and provider cache TTLs bound resource use. These are security controls, not product plans or daily allowances. Add an edge rate limiter, proof-of-work or CAPTCHA challenge, WAF rules, per-ASN controls, and queue admission metrics before broad public access.

• Rotate SECRET_KEY; never use Compose defaults.
• Configure exact HTTPS origins.
• Make PostgreSQL/Redis/MinIO private and authenticated.
• Apply migrations as a one-shot release job.
• Enforce worker egress and drop all Linux capabilities.
• Pin and scan container images and dependencies.
• Set CSP/reporting, HSTS, TLS, log redaction, backups, retention, and incident alerts.
• Verify provider terms, privacy notices, deletion SLAs, and regional data requirements.
• Run DAST, SAST, dependency/container scans, load tests, and an external penetration test.