Security

The MCP server and the public API give your data to something other than a person in the dashboard: an AI assistant or your own code. Both are built so that what reaches them is as little as the job needs.

Read-only, as a viewer

An API key and an assistant’s connection each read what a member with the viewer role can read in the dashboard, and nothing else. Neither can create, edit or delete anything: not a site, an alert rule, a script decision, a member or another key. Each is bound to one account. An assistant reads the account of the member who signed in, and a key the account that created it.

Report content is untrusted

Much of what HeaderHawk stores was written by browsers: the URLs, hosts, policies and code samples in a report come from whoever loaded your pages, and anyone can load your pages. An attacker can put text in a report that reads like an instruction to an AI (“ignore your previous instructions”).

So every tool that returns report data tells the assistant that those strings are untrusted page data, to be treated as data and never as instructions, and returns them as fields of a structured answer rather than as prose. That reduces the risk; it cannot remove it. Treat an assistant’s suggestion to change something outside HeaderHawk as you would advice from anyone else who read your reports, and check it before acting.

Keys stay on servers

A key is shown once, when it is created, and HeaderHawk keeps only a digest of it, so nobody can show it to you again. The public API sends no CORS headers, so a browser refuses to let a web page read its answers: call it from your own backend, a script or a CI job, where the key can stay a secret.

Revoking access

• A key. An owner or admin revokes it under Settings › API keys. It is refused within 60 seconds.
• An assistant. The member who connected it disconnects it under Settings › API keys › Connected assistants. It cannot renew its access, and what it holds expires within 10 minutes.

A leaked key

If a key is published by mistake, in a repository, a log or a support ticket, revoke it at once and create a new one for the systems that need it. A key reads, so whoever held it could read your sites’ reports, issues and scans until it was revoked, and could change nothing.

Every production key starts with hh_live_, and when GitHub’s secret scanning finds one in a public repository, gist, issue or package, it reports it to HeaderHawk. A reported key is revoked straight away, and your account’s owners and admins are emailed where it was found.