# HoundScraper security

Content is untrusted data. Execution and credentials stay behind a controlled API.

Official source: https://ops.warhoundai.com/docs/houndscraper/security

## Protect destinations and credentials

HTTP collection rejects private/reserved addresses, pins validated DNS results, validates redirects and bounds decoded bodies. Header credentials are encrypted, origin-bound and excluded from shared caching. Robots policy is separate from prompt-injection handling.

## Isolate browser and parser work

The optional browser uses signed, expiring, replay-protected grants and a public-only proxy. It blocks write requests and cross-origin navigation. Run parser and browser containers with dedicated keys, CPU/memory limits and restricted networks. This reference deployment is one trust domain, not hostile multi-tenant isolation.

## Report privately

Use the GitHub security reporting feature. Do not post customer content, keys or exploitation details in public issues. Review SECURITY.md and the current capability matrix before production use.