Security

The Mode A tag is a single file. You can read it in full:

/s/v1/hv.js · SHA-384 sha384-436fxKwiqvzvdHKdmzMreAFIO0xX2XvsI6E64WRmsv6Ui9cXeMArjeKvWfT8venA

It does exactly two things:

• —Appends one <link rel="alternate"> pointing at your semantic document.
• —Appends one <script type="application/ld+json"> built with JSON.parse and a text node.

It never:

• —Calls eval, Function, innerHTML, document.write, or injects another <script src>.
• —Reads cookies, localStorage, form fields, or page text. Sets no cookies. No fingerprinting, no analytics, no user tracking.
• —Blocks rendering — it is async, dependency-free, and fails silently.

Versions are immutable: /s/v1/hv.js is never overwritten. A change ships at a new path with a new hash, so pinning integrity is safe and we cannot silently alter what runs on your site. CORS on the data endpoint is scoped, and the response carries nosniff and a restrictive CSP.

Our bot identifies itself as HoneyVectorsBot/1.0 with a link back to this page. It only fetches domains where ownership has been proven by DNS TXT record or a file at your own root, it honours robots.txt, and it caps redirects, response size, request rate and wall-clock time.

Every redirect hop is re-checked: loopback, private ranges, link-local and cloud metadata addresses are refused, and bare IP hosts are never fetched at all.

To block us entirely, add User-agent: HoneyVectorsBot / Disallow: / to your robots.txt, or delete the site from your console — deletion removes the pages, extracted text and embeddings and takes the endpoint to a 404 immediately.

Under Mode B and C, your semantic document renders on your own origin. We treat every byte we crawled as untrusted: all output is escaped, scripts, event handlers and javascript: URLs are stripped, and the document is served with an explicit content type, nosniff, and no cookies or auth.

The document is derived only from pages we successfully retrieved. If we could not read a page, it is reported as unreachable rather than filled in — we do not model, estimate or infer content we did not fetch.

We store your site's public page content, the text extracted from it, embeddings of that text, and the change log of your own actions. We do not collect visitor data from your site, and the snippet transmits nothing about your visitors to us.

Account data is isolated per owner at the database level. Deleting a site purges its pages, extracted text and embeddings.

Email security@honeyvectors.com — also published at /.well-known/security.txt. We acknowledge within one business day. Please give us a reasonable window before publishing, and don't run tests that degrade service for our customers. We will not pursue action against good-faith research.