Responsible Telemetry & Security Architecture
WebDiagnostic is strictly a defensive observability and configuration hardening platform. Every edge probe and LLM pipeline stage is engineered to prevent abuse, protect customer privacy, and operate non-intrusively.
1. Non-Intrusive Passive Header & DOM Inspection
Our collector performs a single standard HTTP GET request over ports 80 or 443 with a transparent user-agent, bounded to a 5-second timeout and 150 KB stream cap. WebDiagnostic never performs fuzzing, credential brute-forcing, port scanning, or exploit payload injection.
2. Multi-Layer SSRF & Private Subnet Firewall
All requested URLs are validated prior to socket connection. Loopback addresses (127.0.0.0/8, ::1), RFC-1918 private networks (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16), Carrier-Grade NAT, and cloud metadata endpoints (169.254.169.254, metadata.google.internal) are unconditionally blocked at both edge and application layers.
3. LLM Data Minimization & Zero-PII Prompting
Before passing telemetry snapshots to the Anthropic Claude API, our normalizer strips cookies, Set-Cookie values, URL query tokens, and document text content—transmitting only structural response header keys and external asset origin hostnames.
4. Coordinated Vulnerability Disclosure
To report a security issue or abuse concern regarding WebDiagnostic infrastructure, contact our engineering security desk directly at security@webdiagnostic-agency.com. All reports receive human triage within 24 hours.