CLI scope
Insidia scans only hosts listed in insidia.yaml. Localhost is the default. Any other host needs authorized: true, which you set. Rate limits are on by default.
Security
This website does not run scans and does not store findings. A waitlist email is a marketing lead, kept out of the product database.
What leaves the machine
A local scan talks to your target and, if you configured one, your model endpoint. No telemetry. Secrets in evidence are masked, for example [AWS_ACCESS_KEY len=20 fp=3f9a1c07].
Insidia Cloud
When the hosted service is open, findings are stored with per-organization envelope encryption. They are not used as training data. You can self-host that code on your own GPUs.
Testing only what you may test
Point Insidia at systems you own or have written permission to test. Design-partner Cloud tests run against staging, and only after that authorization. Report a vulnerability in Insidia itself to insidialabs@gmail.com.