- Isolation: every upload is unpacked and scanned in a container without any network access, with a read-only file system, no privileges and strict limits for time, memory and size. Archive bombs, path traversal and links are stopped before anything is written.
- Downloads and websites: repository and URL imports and website scans run in separate containers that can only reach public internet addresses, and for website scans only the one target.
- Retention: uploaded files are deleted right after the scan. Reports are kept for 30 days, and you can delete them at any time.
- Sharing: your submissions and reports are not shared with third parties. Statistics on the public pages are anonymous totals.
- Your account: sign-in uses an email code and your password, optionally two-factor authentication. Your sign-in history and periodic sign-in reviews are in your profile.
Found a security problem in HEIMDALL? Please tell us privately through the contact form.