# Security, with clear boundaries.

> We separate the safeguards implemented for the website from the assessment capabilities still being developed for BloodHound.

Official source: https://warhoundai.com/security/
Updated: 2026-11-01

## Current website safeguards

The website uses HTTPS, server-side access checks, and secure HTTP-only session cookies for account access. Passwords are stored as salted password hashes, not plaintext. Email verification and password-reset links expire and are single-use. Privileged administration requires an additional email code.

Private application records use restricted database access and row-level security. Credentials saved through the account workflow are encrypted on the server and are not returned as plaintext through the interface. These controls reduce exposure; they are not a claim that any system is immune to security issues.

## Planned assessment safeguards

BloodHound is in development. Its intended assessment workflow requires permission, a defined scope, safety limits, and reviewable findings. Planned reports should mask detected secrets and minimize the customer data needed for a check.

Production assessment data processing, underlying analysis providers, and assessment-specific retention rules will be documented as those workflows launch. The current website does not run a scan when a visitor plays a preview or saves a project URL.

## Testing requires authorization

Only assess applications you own or have explicit permission to test. Include the relevant domains, APIs, accounts, environments, and limits in the scope. A public URL or a link from another application does not by itself grant testing permission.

AI-generated findings and suggested fixes need review. No tool can establish complete security from one scan, and illustrative website examples do not demonstrate real vulnerability coverage.

- [Security checklist for AI-built applications](https://warhoundai.com/blog/security-checklist-ai-built-apps/)

## Responsible reporting

If you believe you have found a vulnerability in WarHoundAI, contact founder@warhoundai.com with a concise description and redacted evidence. Stop if you encounter personal information or another user’s data. Do not perform denial-of-service tests or extract confidential information.

There is no public bug-bounty reward promise or independent security certification announced on this website.

- [founder@warhoundai.com](mailto:founder@warhoundai.com)
- [Privacy and data practices](https://warhoundai.com/privacy/)