Security / Current safeguards
A clear boundary.
At every step.
Mini Hound reviews public source on an authorized website. Verify your website before starting. Your reviews stay in your account, and findings link back to source evidence.
- 01
Your verified website
One exact HTTPS origin, including port.
https://example.comSubdomains need their own proof. - 02
Public code collection
Public pages and code only.
≤ 3 new resources / request - 03
AI processing
Relevant source and messages.
Mini Hound v1 (Gemini 3.8 Flash) and Mini Hound v1 Pro (Gemini 3.1 Pro Preview) · Google Cloud - 04
Your review
Evidence and suggested fixes.
Read → understand → verify
01 / Website ownership
Prove control.
Keep the scope exact.
Verify your email and website, then start reviewing your app.
Publish your account’s proof code.
Place the full 256-character hexadecimal code as visible text at
/verify/bloodhound. The public HTML or text page must return HTTP 200 without JavaScript or login.Submit that exact HTTPS page.
The check is limited to your origin and times out after 30 seconds. The code expires after 24 hours.
Review that website for 30 days.
Ownership verification expires after 30 days. Changing the website replaces its proof and requires verification again.
example.com, www.example.com and app.example.com are separate origins.
02 / Website safeguards
Controls behind
the account.
See the Website Policy for product scope and service terms.
- Account access
- HTTPS, server-side access checks and secure HTTP-only session cookies.
- Passwords and recovery
- Salted password hashes, with expiring single-use verification and reset links.
- Private records
- Restricted database access and row-level security. Saved credentials are encrypted on the server.
- Administration
- An additional email code protects privileged administration.
03 / Data handling
Know where your source goes.
Messages and relevant source
Mini Hound sends your message, attached text and collected source to Google Cloud Gemini, selected by your plan and mode.
Private cloud chat history
Conversations are saved under your account and sync across devices. Private AWS archives and checkpoints support interrupted-request recovery. Older browser chats are imported only when you choose to import them. Evidence uses private encrypted S3 storage; downloads require server authorization and expire after 60 seconds. Only an OTP-verified administrator can mark a finding Verified with retained evidence. See the privacy notice for retention and deletion details.
Responsible reporting
Found a concern?
Tell us privately.
Email the affected URL and a short description. Our reporting guidance is in the Website Policy.
Website policy ↗