Security

PeekInside records complete requests and responses, including credentials and personal data in headers and bodies. Here is how that data is protected.

The local hub#

• It listens on 127.0.0.1 only.
• Its API answers only pages on its own origin: no CORS headers, and requests from other sites, other localhost ports or foreign Host headers (DNS rebinding) are refused.
• Apps report to it from Node only; browsers can't send it requests.
• The dashboard page runs under a strict Content Security Policy, and files in ~/.peekinside are readable only by your user.

PeekInside Cloud#

• Requests, exceptions and timelines are encrypted on your server, as described in encryption; only counters, such as the number of queries, stay readable.
• With advanced protection, the encryption is end to end.
• The API key can send requests, but can't read them.

Values#

• Query values are masked in your process before they are recorded. See masking.
• Captured values are always rendered as text. Copy as cURL and Copy JSON include the real, unmasked values.

More#

How we handle your account and your data is in the Privacy Policy and the Data Processing Addendum. To report a vulnerability, write to support@peekinside.dev with "Security" in the subject.