What vulntel keeps about your work, and what it doesn't

Short version: we record which tool you called and when, never what you asked it. Two tools are the exceptions, and they are named below. If you hunt on private programs, read the section on observe before you use it.

Written from the code on 2026-11-03. When the code changes, this page changes with it.

Every tool call: one usage row, no arguments

Each call writes one row: who called (the email behind your key, or for keyless calls a salted one-way hash of your IP address, never the address itself), the tool's name, the time, how long it took, whether it succeeded, and the name your client sends (its user agent, such as claude-code/2.1 or Cursor), so we can tell agents from directory bots. The arguments you pass (a product, a CVE, a hunt position, a draft finding) are not written to our database. If you put your key in the URL, it is scrubbed from our web server's request log.

Like any website, our host (Railway) and our CDN (Cloudflare) log requests: the path, the status and your IP address. Those logs do not contain request bodies, so they do not contain your arguments either.

The exceptions

• observe(host) fingerprints a live host, so it necessarily records it: the hostname, the technologies it detected, the endpoints it found and when, kept as a shared 24-hour cache (a second caller asking about the same host gets the cached scan) and a history of stack changes. The hostname also appears in our server log. If a target must not leave your machine, do not pass it to observe: fingerprint it yourself and give the stack to hunt_plan or check_technology, which keep nothing.
• assist_submission(finding) sends the draft finding you paste to OpenAI's API to write the brief, and does not store it on our side. OpenAI's own API data policy applies to that text; do not paste details a program's rules forbid sharing.

Tools that query an outside service

• search_public_code sends the code string to Sourcegraph's public code search.
• enrich_cve (with include_poc, the default) searches GitHub for public exploit repositories by CVE id.

Only the code string or the CVE id leaves our server, nothing else from your session.

Signing up for a key

We keep your email, the key, and the optional "what are you hunting" note. Your IP address is used to rate-limit sign-ups and is not stored (it appears in the server log only if a sign-up is blocked as spam). The key is emailed through Resend.

How long we keep it

• Usage rows: 12 months. A scheduled job deletes anything older, twice a day.
• Your key and signup note: until you ask us to delete them.
• observe scans of a host: kept, with no expiry yet; ask and we remove a host.
• Railway and Cloudflare request logs: kept under their own retention, which we do not set.

Deleting it

Email [email protected] from the address you signed up with. We delete your keys, your signup note and every usage row tied to your email.

Who runs it

vulntel is built and run by one independent developer, rozetyp. See about.