Security

1. Where the work happens

The benchmark runs entirely in your browser: Web Workers for the CPU and memory stages, WebGL or WebGPU for the graphics stages. No measurement is sent anywhere to be computed. The server sees a report only when you ask for the free report (a signed summary of the figures) or for an emailed link.

2. What every request is checked against

• -Size and shape. Every API body is capped in size and validated field by field, with array lengths bounded. A body that does not match is refused with a 400, not guessed at.
• -Rate limits. Each route has its own limit per caller, keyed on the platform's own address header rather than one a client can set. Sending mail is limited per caller and per destination address.
• -Signed tokens. A report token is a domain-separated HMAC over the measured figures with the minting time signed alongside. The email route refuses tokens older than seven days. Verification is constant-time and a missing secret fails loudly at start-up rather than silently.
• -Report links. A saved run is addressed by an id and a 32-byte random token; only the token's digest is stored, and both must match one row. An unknown id or token returns the same 404.
• -Headers. Strict-Transport-Security with preload, a content security policy with frame-ancestors none, cross-origin opener and resource policies, nosniff, a Permissions-Policy and a restrictive referrer policy on every response.
• -Third parties. Analytics and error reports are proxied through this origin, so the browser opens no connection to an analytics or monitoring domain and the content policy needs no third-party host.

3. What is stored

A completed run’s measured figures, chosen processor and reported graphics string are stored, with no address and no identifier. Your address is attached only when you ask for an emailed link, buy an unlock or write to us; a payment is taken by Razorpay and no card detail reaches this site. The privacy policy lists this in full.

4. The forms

• -Bot protection. A Cloudflare Turnstile check gates the email route, checkout and both contact forms: the token the widget produces is verified with Cloudflare before anything is stored or sent. A hidden field, the time taken, and a set of content signals feed a risk score stored with every message; a message over the threshold is held for a person rather than forwarded.
• -Attachments. Up to three files, images and plain-text logs only, decided by content and not by name. Every image is decoded and re-encoded on the server, which drops metadata and anything hidden in the file; text is checked for valid UTF-8 with no control bytes; executables, archives, PDFs, SVGs and HTML are refused. Each file's hash is checked against a denylist and a virus-intelligence service by hash only, and files sit in a private store behind expiring links.
• -Injection. Every database write is parametrised, every value in an email is escaped, control bytes and direction overrides are stripped from text, and single-line fields are made single-line so nothing reaches a mail header.
• -Audit trail. Every action through the API and every refusal is written to an immutable log with the moment, network address, browser and country, pruned after 90 days.

5. What is not yet in place

• -Script policy. The content security policy still allows inline scripts, because per-request nonces would make every prerendered page dynamic. The exposure is small: no user-generated content is rendered anywhere. This is the one Mozilla Observatory test the site fails.
• -Distributed limits. Rate limits are counted per server instance. A flood spread across many instances sees a higher ceiling than one instance would allow.

6. Independently checkable

Each is a third party’s own verdict on this domain, or a standard the site meets, with the day it was last confirmed and the link where you check it yourself.

7. Reporting a vulnerability

Write to support@systemcheck.live with what you found and how to reproduce it. We will acknowledge within a few days, fix what is real, and credit you if you want credit. Please do not test against other people’s saved reports or send traffic that would degrade the service; a description is enough. The machine-readable version of this notice is at /.well-known/security.txt.