Loading…
Trust
How BenchPath is secured, and how to report a vulnerability. Last updated 2026-09-02.
BenchPath's browser bundle contains no server secret. Public pages read through a publishable key, server routes use a scoped server-only secret that is never exposed under a public name, and access to private data (your profile, matters, follows, and alerts) is enforced at the database by row-level security, so records are readable only by their owner. Authorization attributes — reviewer and administrator roles — are server-controlled and cannot be changed by an ordinary authenticated account. Privileged automation runs with least privilege and is not reachable by ordinary users.
The site is served over HTTPS with HSTS. Responses carry a baseline of browser-security headers — frame protection, MIME-sniffing protection, a strict referrer policy, a restrictive permissions policy, and cross-origin isolation — and an enforced content-security policy (a stricter nonce-based variant runs in report-only mode while the remaining inline scripts are migrated).
If you believe you have found a security issue in benchpath.ai, please report it through the contact form and mark it as a security report. Give us enough detail to reproduce the issue, and please give us a reasonable window to remediate before any public disclosure.
We will not pursue action against good-faith security research that respects user privacy, avoids degrading the service, does not access or modify data that is not yours, and gives us a reasonable time to fix the issue. Do not run automated scanners against production, do not attempt denial-of-service, and never access another user's private records.
Reports that a public record (a court order, a judge's published procedures) is visible are not vulnerabilities — that content is public by design. Corrections to the accuracy of a published entry go through the corrections process, not this one.