Privacy Policy & Data Practices
VulnRap is built on transparency. Here is exactly what we do with your data, how we protect it, and what other users can see. No fine print, no surprises.
Why VulnRap ExistsVulnerability programs are drowning in low-quality, duplicate, and AI-generated reports. Triage teams waste hours filtering noise instead of focusing on legitimate findings. VulnRap exists to give your team better tools:
- For triage teams: Screen incoming reports for AI-generated content, detect duplicates across submissions, and prioritize analyst time on reports that matter.
- For the ecosystem: Every report analyzed improves the fingerprint corpus. When a duplicate is caught automatically, that saves your team from re-triaging the same issue.
- For trust: Integrate VulnRap into your intake process as a pre-screening step, reducing duplicate submissions and AI slop before they reach your queue.
VulnRap stores and compares report data. That is the whole point of the platform.
- When you upload a report, we auto-redact sensitive information (PII, secrets, credentials, company names) and store only the redacted version.
- Your redacted report is compared against all other reports in our database. Other users' reports are compared against yours.
- Similarity scores, section-level hash matches, and validity/sloppiness results are visible to anyone with the report link. In Full Storage mode, the auto-redacted report text is also visible at that link. In Similarity Only mode no text is stored, so the link resolves only to scores and hashes.
- We do not share your report with vulnerability programs, vendors, or other users' organizations. Exceptions: public identifiers from your report, such as CVE IDs and repository or issue URLs, may be sent to NVD, GitHub, npm, and PyPI to verify that they exist. When AI-assisted analysis is enabled, only the auto-redacted version of your report is sent to a third-party model provider so the substance engine can score it. AI-assisted analysis is currently off. You can also tick the Skip AI analysis toggle on the submission form, in which case the report text does not leave our infrastructure.
If you do not want your report stored and compared, do not upload it. There is no "view only" mode -- comparison is the core function of this platform. If you want zero third-party AI involvement, use Similarity Only mode and tick Skip AI analysis.
Auto-Redaction Engine
Before your report is stored or analyzed, it passes through our deterministic auto-redaction engine. This is not optional -- it runs on every upload. The same input always produces the same output.
What gets redacted:
Redacted items are replaced with tagged placeholders like [REDACTED_EMAIL] or [REDACTED_API_KEY]. Your results page shows a breakdown of exactly what was redacted and how many of each type.
Auto-redaction is regex-based and deterministic. It may not catch every possible sensitive value. Do not rely on it as your only protection -- if your report contains highly sensitive information, pre-sanitize it yourself before uploading. Remove or replace any details you would not want stored, even in redacted form.
Data Collection & Storage
In this mode, we generate mathematical fingerprints from the redacted version of your report. The redacted text is not stored -- only the hashes. The original raw text is never stored in any mode.
What we store:
- -- SHA-256 content hash of redacted text (for exact-match deduplication)
- -- MinHash signature (128 hash values for fuzzy matching)
- -- Simhash fingerprint (64-bit structural hash)
- -- Section-level SHA-256 hashes (each section hashed independently)
- -- AI sloppiness score, tier, and feedback
- -- Redaction summary (counts of what was redacted, not the values)
- -- File name and size (metadata only)
Fingerprints are stored as one-way hashes, not the report text.
In this mode, we store everything from Similarity Only mode plus the auto-redacted text of your report. The original (pre-redaction) text is never stored. This helps build a richer comparison corpus for future users.
How stored content helps the ecosystem:
- -- Enables richer semantic matching beyond structural fingerprints
- -- Improves sloppiness scoring with real-world examples
- -- Builds a larger corpus so triage teams get better duplicate detection on incoming reports
- -- Helps identify common patterns in AI-generated reports
How Comparison Works
When you upload a report, it is compared against every other report in our database. Here is what that means:
Full-Document Similarity
MinHash signatures (128 permutations) and Simhash fingerprints measure overall similarity. LSH (Locality-Sensitive Hashing) with 16 bands narrows candidates before full comparison. Results above 15% similarity are shown.
Section-Level Hashing
Your report is split into logical sections (by markdown headers or paragraph breaks). Each section is hashed independently with SHA-256. If any section hash matches a section in another report exactly, that match is flagged -- even if the overall documents are different.
What Other Users See
When another user uploads a report that matches yours, they see: the similarity percentage, the match type, section-level matches, and your anonymized report ID. They do not see your report content, file name, or any identifying information.
Anonymity & Tracking
VulnRap does not require registration, login, or any form of identification. There are no user accounts, no email collection, and no OAuth flows.
Every submission is treated as an independent, anonymous event. We do not store any persistent identifier that would let us link multiple reports back to the same person. To prevent abuse we count requests per IP per minute. Those counters are stored in the database as HMAC-keyed values, never as raw IP addresses.
We do not use Google Analytics, Mixpanel, Hotjar, or any third-party analytics, tracking pixels, or advertising scripts. We set no tracking or advertising cookies and we do not perform browser fingerprinting.
Your browser does keep a small amount of local data for the app to function — the delete token for each report you submit (kept in localStorage for 90 days), the dismissed-banner flag, your bookmark history, and your filter/sort preferences. None of it is sent to third parties and clearing your browser storage erases all of it.
Server-side, we use a per-IP rate-limit counter to prevent abuse. Counters are kept per minute as HMAC-keyed values, not raw IP addresses. We also count unique daily visitors for the public counter on the transparency dashboard: when your browser navigates to a page, we send your current date and IP through an HMAC keyed with a server-side secret and store only the resulting hash in a (hash, date) row. The salt rotates every day at UTC midnight, so the same visitor produces a different hash on different days and the rows cannot be linked across days. Reports and visitor counts never store raw IP addresses. Our hosting provider, Cloudflare, processes IPs to deliver the service.
The visit ping fires once per client-side route change (debounced), not just on the home page, so the counter reflects sitewide unique daily visitors.
Security & Infrastructure
Transport Security
All connections are encrypted via TLS. File uploads are transmitted over HTTPS and processed in memory. Rate limiting prevents abuse.
Platform Independence
VulnRap is not affiliated with any vulnerability platform. We do not share report data with vendors, programs, or third parties, except the verification lookups and AI-assisted analysis described in the Upfront section above. Comparison happens only within this platform.
File Handling
Uploaded files are validated server-side (extension, size, content type). Files are processed in memory and never temporarily written to disk. Maximum file size is 5MB, and the first 250,000 characters are analyzed.
Data Lifecycle & Deletion
Raw (pre-redaction) content is never written to disk or database. It exists only in process memory during analysis. Hashes and redacted content are stored until deleted. When you submit a report, you receive a delete token. Your browser keeps it in localStorage for 90 days, and the server stores only a hash of it. You can use the token to permanently delete your report and all associated data (hashes, similarity records, redacted text) from the results page. Once the token expires or your browser storage is cleared, it cannot be recovered.
Auto-Redaction Is Not Perfect
Our redaction engine uses pattern matching and heuristics. It catches most common PII patterns (emails, IPs, API keys, passwords, company names, etc.), but it cannot guarantee 100% coverage. If your report contains highly sensitive or unusual identifiers, review the redacted output on your results page before sharing the link.
Report Results Are Linkable
Analysis results are accessible via a shareable link containing the report's numeric ID. Anyone with this link can view the analysis results (sloppiness score, similarity matches, section hashes, feedback, and redacted content in Full mode). Keep your result link private if you do not want others to see your analysis.
Open Source & Transparency
VulnRap's similarity engine uses deterministic, seeded algorithms (SHA-256 for hashing, MinHash with 128 permutations for fuzzy matching, Simhash for structural similarity, section-level SHA-256 for granular matching). Validity scoring uses a VirusTotal-style multi-engine consensus: three independent engines — an AI Authorship Detector (with a perplexity blend covering bigram entropy, function-word rate, and code-block syntax sanity), a Technical Substance Analyzer, and a CWE Coherence Checker against a curated 50-entry fingerprint library — each return their own score and verdict, which are combined into a single composite score with a six-tier label. The legacy slopScore field remains in API responses (mapped from the new composite) for backwards compatibility, and a feature flag (VULNRAP_USE_NEW_COMPOSITE) lets operators fall back to the legacy pipeline at any time. Every analysis writes a pipeline trace (correlation id, per-stage timings, applied overrides, input signals summary) that is exposed via GET /api/reports/:id/diagnostics and surfaced in the “Why this score?” panel on the report detail page. When AI-assisted analysis is enabled, the redacted version of your report is sent to a third-party model provider for analysis. It is currently off. If the LLM is unavailable the remaining engines continue to score the report. The full scoring logic, engine weights, override rules, and LLM prompt are open source and auditable on GitHub.
What We Publish
Aggregate, non-identifying statistics computed from the data above are published live on our transparency dashboard: total reports analyzed, average sloppiness score, detection rate, weekly volume, slop-tier distribution over time, feedback agreement rate, and the unique-daily-visitor counter described in the previous section. No per-report content, file names, or visitor identifiers are ever surfaced — only counts and averages.
API Documentation
VulnRap exposes a public REST API. The OpenAPI description is at /openapi.yaml, and the developer guide is at /developers.
This policy was written to be honest, not to hide anything. If something is unclear, that is a bug we want to fix.