Phishing Sonar
- Client-side PII redaction runs before any data leaves your browser.
- Hash-only retention by default. The raw content is not stored.
- Shared links are redacted.
Security & data handling
What happens to the data you paste in.
You are a security person deciding whether to put scan output, email content, or a document into someone else’s app. Fair question. Here is how each tool is built to handle it.
Bump In The Log
- Ephemeral, no-retention processing. Logs are analyzed in the moment, not kept.
- Line-number traceability keeps findings tied to the raw input you provided.
Mark My Words
- Stateless processing with rate-limiting for a smaller attack surface.
- SSRF protection on URL fetches.
The shared principles
Redact before transit
Where a tool can strip PII in your browser first, it does: sensitive fields never need to leave the client to get a result.
Keep as little as possible
Retention defaults to hashes or nothing at all. The tools are designed to answer your question and forget the input.
Smaller attack surface
Stateless processing, rate-limiting, and SSRF protection keep the apps themselves from becoming the weak link.
Questions about data handling?
If you need specifics before you put anything into a tool, ask. I built them, so I can answer.