Untrusted URLs need careful handling
Public tools and scheduled monitors share a fetcher that restricts requests to public HTTP(S) destinations, validates DNS and actual connection addresses, and rechecks redirects. Time, response size and concurrency are bounded. Anonymous tools have server-side usage limits and respect robots rules for page checks.
Ownership and workspace access
Persistent monitoring requires sign-in, workspace membership and verified domain ownership. Role checks and database constraints protect workspace access. Public tools provide one-time observations without creating a monitor or granting access to private workspace data.
Payments and sensitive data
The Stripe integration uses signed, idempotent webhooks and server-side entitlements. Checkout and payment methods are hosted by Stripe; IndexHaven does not store card numbers.
Using the tools safely
Use public URLs without private tokens or personal data in the anonymous tools. Results are observations, not security certifications or search-indexing guarantees.