Pathquill
Request a pilot
PATHQUILL / SECURITY ARCHITECTURE

Security at Pathquill

Pathquill enforces fail-closed network defenses, zero-payload retention, and strict boundary controls to protect client websites and agency data.

1. Network defenses and SSRF prevention

Pathquill probes customer forms through an active defense perimeter:

  • HTTPS-only: All customer form targets, actions, and redirects must use HTTPS; credentials in URLs are rejected.
  • Pre-flight DNS-over-HTTPS (DoH): Before fetching any target, Pathquill resolves DNS via Cloudflare’s DoH JSON endpoint and validates every answered IP against private, loopback, link-local, CGNAT, and cloud metadata ranges (169.254.169.254). Any private address match fails closed immediately.
  • Origin allowlists: Only explicitly configured bare HTTPS origins in MONITORED_ORIGINS can be probed.
  • Bounded redirects: Redirects are followed manually with a strict hop cap (max 3), with every hop re-validated against DoH SSRF checks.

2. Ingress and webhook authentication

All inbound routes enforce cryptographic authentication:

  • Bearer token authentication: POST /api/inbox-events requires an Authorization: Bearer <token> header with a high-entropy secret.
  • Idempotency protection: Webhook and check starts accept Idempotency-Key headers to prevent duplicate executions or replay attacks.
  • Signed alert dispatch: Scheduled check alerts sent to agency webhooks are signed using HMAC-SHA256 (X-Pathquill-Signature) over a timestamped body.

3. Payload minimization

Pathquill never stores form submission responses, customer email bodies, or personal visitor data. Diagnostic records retain only unguessable run tokens, timestamps, HTTP status codes, and stage outcomes. Even in Cloudflare Email Routing, raw email content is discarded in memory after token extraction.

4. Tenant isolation and access

Storage in Cloudflare D1 is strictly tenant-scoped using parameterized queries. Single-operator administration is protected with constant-time password verification and signed session cookies. Public evidence links (/e/:id) use 128-bit unguessable identifiers with noindex, nofollow, noarchive robot directives.

5. Vulnerability disclosure

We welcome responsible security research. If you discover a potential vulnerability, please report it to pilots@pathquill.app. We acknowledge reports within 24 hours.