Security
Last updated
Accounts and sessions
- Sign-in goes through Firebase Authentication (Google or an email link); the server checks the token against Google's keys.
- Your session is a random token in an HttpOnly cookie, sent only over HTTPS; the database keeps only a hash of it. Signing out everywhere ends every session.
- State-changing requests from other websites are refused.
Keys and third-party logins
- MCP keys are shown once; only a hash and a short prefix are stored, and you can revoke a key at any time.
- Your DataForSEO login passes through to DataForSEO for one request and is never stored or logged.
Your data
- Every query on account data is limited to your own account, and tests check that one account cannot read or change another's.
- You can export or delete everything from your account panel.
Admin access
- Admin rights are granted only from the server console, never through the website.
- Admin pages need an authenticator code on top of sign-in, and every admin action is written to an audit log.
Fetching pages
When RankWhy reads a URL it refuses private and internal addresses, limits redirects, size and time, and treats the page and any AI output as untrusted data.
Report a problem
Email security@rankwhy.com. Please do not test against other users' data or run load tests.