At Accessibility Shield, security, system integrity, and data protection are fundamental to our engineering culture. Whether you are an individual developer, an ecommerce store owner, or an enterprise security auditor, this document details our security architecture, data governance, and defensive controls.
1. On-Site Assistive Widget Security
Our on-site assistive toolbar (public/widget.js) is engineered with strict isolation to ensure it never poses a risk to your website, visitors, or customer data:
- Strict Bundle Budget: The widget is compiled in pure vanilla TypeScript using
esbuild and strictly enforced under 6.0 KB (currently ~5 KB minified, ~2 KB gzipped). It includes zero external npm dependencies.
- No Dynamic Code Execution: The script contains no
eval(), Function(), or dynamic runtime script injection. All logic is strictly compiled and static.
- Zero Access to Sensitive Customer Data: The widget does not inspect or intercept customer form inputs, passwords, credit card fields, authentication tokens, or session cookies.
- Privacy-First Local Storage: When visitors toggle contrast modes, text scaling, or dyslexia fonts, those settings are saved exclusively within their own browser’s
localStorage. They are never transmitted to our servers.
- Non-Blocking & Asynchronous: The widget loads asynchronously (
async) and executes without blocking DOM parsing, ensuring zero impact on your site's availability or Core Web Vitals.
2. Server-Side Request Forgery (SSRF) Protection
Because our automated auditing engine fetches and analyzes public web pages, we enforce multi-layer SSRF defenses (src/lib/network.ts) on all outgoing network requests:
- Private Network Blocking: Our network resolver resolves DNS before establishing connections and immediately rejects requests targeting:
- Loopback addresses (
127.0.0.0/8, ::1)
- RFC 1918 private subnets (
10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16)
- Link-local and carrier-grade NAT ranges (
169.254.0.0/16, 100.64.0.0/10)
- Cloud provider metadata IP endpoints (such as
169.254.169.254)
- IPv6-mapped IPv4 addresses (
::ffff:x.x.x.x)
- Strict Protocol Validation: Only public
http:// and https:// schemes are permitted. Internal protocols (file://, ftp://, gopher://) are strictly rejected.
3. Database & Authentication Security
- Serverless Database Isolation: All customer records, monitored domains, and audit reports are stored in Neon Serverless PostgreSQL with end-to-end TLS encryption in transit and AES-256 encryption at rest.
- Better-Auth Credential Protection: Account authentication is managed via Better-Auth with strict security configurations:
- Minimum 12-character password entropy enforcement.
- Cryptographically salted password hashing.
- Password reset tokens are single-use, backed by database verifications, and expire after 30 minutes.
- Automatic session revocation upon password reset.
- Role-Based Access Control: Multi-tenant architecture ensures customer domains and teams remain strictly isolated.
4. Payment Security & PCI Compliance
All paid subscriptions are billed through Polar (Polar Software Inc.), acting as our authorized Merchant of Record.
- Polar is fully PCI-DSS Level 1 compliant.
- Accessibility Shield never receives, stores, or processes raw credit card numbers, CVVs, or banking credentials.
- Communication between Accessibility Shield and Polar occurs over TLS with cryptographically signed HMAC-SHA256 webhooks.
5. Third-Party Subprocessors
We select infrastructure partners with industry-standard compliance certifications (SOC 2, ISO 27001, GDPR):
| Provider |
Purpose |
Security Standards |
| Vercel |
Edge Network & Hosting |
SOC 2 Type II, ISO 27001, DDoS Mitigation |
| Neon |
Serverless PostgreSQL Database |
SOC 2 Type II, ISO 27001, Encryption at Rest |
| Polar |
Merchant of Record & Payments |
PCI-DSS Level 1, GDPR Compliant |
| Resend |
Transactional Alert Emails |
SOC 2 Type II, TLS In Transit |
6. Responsible Disclosure
We welcome reports from security researchers and developers. If you believe you have found a security vulnerability in Accessibility Shield:
- Email full reproduction details to accessibilityshieldorg@gmail.com with the subject line "Security Vulnerability Report".
- Please provide sufficient detail to reproduce the issue and allow our engineering team 48 hours to investigate before public disclosure.
- We do not pursue legal action against researchers acting in good faith.