Is this really us?

How to tell it’s the real site

• The address is exactly sicheck.com. We have no other domain, no app that asks you to sign in, and no “.net” or “-secure” versions.
• We never message, call or email you first.
• We never ask for a password, a one-time code, a card number or a payment.
• If something says it’s from SI Check, paste it into the real site and check it like anything else.

How we protect the service

• Personal details are masked before anything else reads your text.
• Links are visited safely. We refuse private and internal addresses, validate every redirect, connect only to the address we validated, cap time and size, and never execute scripts.
• Your message is treated as hostile. SI has no tools, its output is validated, and every quote is checked against the original.
• Reports are private. Only the browser that ran the check (or the Plus account it belongs to) can open one. A report becomes public only if its owner approves sharing, and then only through a separate, random 16-character link they can switch off at any time. Reports are never indexed by search engines and delete themselves after 30 days.
• No third-party scripts, fonts or trackers load on any page. A strict content-security policy blocks anything else.
• Abuse is limited by per-address rate limits and a daily spending cap.

Report a vulnerability

Email security@sicheck.com with what you found and how to reproduce it. Please don’t access other people’s data, and give us reasonable time to fix it before you publish. We’ll acknowledge reports, keep you informed, and credit you if you wish. Machine-readable details are in security.txt.