Home / Help centre / Security & privacy
Security & privacy
Is traffic to and from Cyberlop encrypted?
Yes. The Security page lists HTTPS and TLS everywhere, with HSTS, a content security policy and hardened headers. Session cookies carry the Secure flag. Scan agents connect out over HTTPS, webhook URLs must be HTTPS, and code excerpts go to your AI provider over HTTPS too.
The short version
Every connection that the Security page describes uses encryption in transit, and that includes the ones you might forget, such as webhooks and agents. Browsers reach the app over HTTPS, and the app reaches other services the same way.
| Connection | Protection |
|---|---|
| Your browser to Cyberlop | HTTPS with TLS, HSTS, CSP and hardened headers |
| Session cookies | HttpOnly, SameSite and Secure flags |
| Scan agent to Cyberlop | Outbound HTTPS only, port 443 |
| Chat webhook | HTTPS incoming-webhook URL |
| Code excerpts to your AI provider | HTTPS |
How it works in Cyberlop
The controls start with HTTPS and TLS everywhere, along with HSTS, a content security policy and hardened headers. HSTS tells a browser to refuse plain HTTP for the site. The policy and headers cut the harm a rogue script could do.
Outgoing connections get a check as well. Cyberlop validates outbound destinations, and that limits where the platform can send data, even when someone supplies an odd address in a setting.
Other paths use HTTPS too. A scan agent asks for work over outbound 443 only. A chat webhook must be an HTTPS URL. Repository clones use HTTPS, and SSH addresses are not accepted. Encryption in transit sits beside encryption at rest, which protects stored data.
What to do next
- Read how sign-in sessions stay secure next.
- Check the security page for the full list.
- Look at webhook URL format when you connect chat.
Need more detail for a review? Contact us at /contact.
Related questions
- How are sign-in sessions secured?
- My webhook URL isn't accepted. What format does it need?
- What network access does a scan agent need?
- Why isn't my git@ SSH repository URL accepted?
- Is my code sent to an AI provider?
Cyberlop chat notifications: set up a webhook for finished scans
Step-by-step, with annotated screenshots.
Updated · Back to the help centre
Security question we did not answer?
Our team will answer it directly, or walk through it on a call with your security lead.