PhishCase.PHISHCASE / Security
PhishCase security
This page describes technical controls in the release candidate. It is neither a certification nor a guarantee that vulnerabilities are absent.
Local analysis by default
EML/MSG ingestion uses the local parser and local SpamAssassin. Messages, attachments and HTML resources are not opened on the Internet automatically. Offline blocks optional external enrichment; a firewall provides an independent network boundary.
Lookup and submission are separate actions
A lookup sends a hash or indicator to the provider. A submission sends the selected file or requests a URL scan; it requires separate permission and an explicit action. An empty lookup never triggers automatic submission. URL parameters can themselves contain confidential data.
Keys and providers
Community receives BYOK keys through server secrets. Cloud encrypts organization-specific keys using an application key separate from the database. Configuration responses never return keys. VirusTotal uses its standard API, without a Private Scanning promise. urlscan requests private visibility by default and never silently switches to public. Administrators must check provider licensing and data handling.
Evidence and storage
Originals retain provenance and SHA-256 under opaque names. Downloads require authentication and are served as attachments with no-store and nosniff. Backups are encrypted and authenticated; keep their key separate. The application does not individually encrypt evidence files at rest: disk encryption and host protection are operational responsibilities.
Accounts and isolation
TOTP MFA, single-use recovery codes, revocable sessions and roles are available. Community shares data among active members of one team. Cloud selects schema and evidence paths from the authenticated identity; isolation is application enforced with a shared PostgreSQL role. System/Docker administrators remain trusted operators.
Known limitations
The parser has size, CPU, memory and time limits but is not a detonation sandbox. Attachments are never executed. A neutral or missing automatic result does not prove an email safe. SSO, premium connectors and MSSP remain planned. Provider and Stripe transport tests are simulated until a validation account is configured.
Report a vulnerability
Use GitHub private reporting when available. Otherwise request a private channel through the maintainer profile without posting samples, secrets or exploitable details. A dedicated security contact and supported-release policy still require confirmation before a stable release.