Security

Security is foundational to TurboPentest. This page details how we protect your data, isolate tool execution, and maintain compliance.

Container Isolation

Every security tool runs in its own Azure Container Instance:

• No shared state - Each container is a fresh instance with no access to other containers
• Dedicated resources - CPU and memory are allocated per tool, not shared
• Network isolation - Containers can only communicate outbound to the target and inbound via callback webhook
• Ephemeral - Containers are destroyed immediately after the tool completes

Code Handling

For white box pentests that connect to GitHub:

• Source code is cloned into an ephemeral container at runtime
• Code is never stored on persistent storage
• The container (and all code within it) is destroyed after the tool completes
• GitHub access tokens are scoped to the minimum required permissions

Data at Rest

• Pentest results are stored in Azure Blob Storage with encryption at rest
• Database records are stored in Neon (serverless PostgreSQL) with encryption at rest
• PDF reports and attestation letters are stored in encrypted Blob Storage
• Users can delete their pentest data at any time

Data in Transit

• All traffic is encrypted with TLS 1.2+ in transit; Anthropic API calls use TLS 1.3
• Azure App Service enforces HTTPS
• Tool callback webhooks use HTTPS
• API authentication uses Bearer tp_... keys transmitted via the Authorization header

Secrets Management

• Application secrets are stored as Azure App Service environment variables
• No secrets are hardcoded in source code
• GitHub tokens are encrypted in the database
• API keys are stored as SHA-256 hashes and shown only once at creation

CI/CD Security

Every push and pull request runs automated checks, and merges to the main branch run a full build before deploying:

1. ESLint - Static analysis for code quality and security patterns, on every push and pull request
2. Content review - Automated documentation/content checks, on every push and pull request
3. Vitest - The test suite runs on every push and pull request
4. Production build - On merges to main, a full Next.js build runs (which also enforces TypeScript type checking and catches runtime errors) before deployment
5. Automated deployment - Only builds that pass reach production on Azure App Service

Compliance

TurboPentest maps findings and testing coverage to four compliance frameworks, each with a default evidence max-age of 365 days:

The compliance dashboard tracks per-framework scope, staleness (fresh / stale / never_tested), last scan, next scheduled scan, and control mappings. For complete compliance documentation, visit our Trust Center.

Responsible Disclosure

If you discover a security vulnerability in TurboPentest, please report it to [email protected]. We take all reports seriously and review them promptly.