I actually wanted to answer this topic: https://vulndetect.org/topic/344/data-processing-policy, but wasn't able to. Probably because this thread is somehow in Announcements!?

Anyway, my answer: I really don't like this architecture. From a security point of view, it is extremely valuable data to have a list of security vulnerabilities of a (or better said: of MANY) concrete targets. It would be way more secure to have all the data stay on the clients.

Anyway, since I don't know a good alternative, I'll stay with VulnDetect for now. In order to protect my account as good as possible, I would like to see two factor authentication being implemented to the website. Shouldn't be a big issue since libraries for HOTP/TOTP are publicly available.

Thanks!

Hey,

I hold some backups on my system. These files are outdated and will stay outdated. Since I cannot explicitly select which folders to scan, those files will pollute my results list.
Please add a function to restrict folders to be scanned.

Thanks!

I actually wanted to answer this topic: https://vulndetect.org/topic/344/data-processing-policy, but wasn't able to. Probably because this thread is somehow in Announcements!?

Anyway, my answer: I really don't like this architecture. From a security point of view, it is extremely valuable data to have a list of security vulnerabilities of a (or better said: of MANY) concrete targets. It would be way more secure to have all the data stay on the clients.

Anyway, since I don't know a good alternative, I'll stay with VulnDetect for now. In order to protect my account as good as possible, I would like to see two factor authentication being implemented to the website. Shouldn't be a big issue since libraries for HOTP/TOTP are publicly available.

Thanks!

Hey,

I hold some backups on my system. These files are outdated and will stay outdated. Since I cannot explicitly select which folders to scan, those files will pollute my results list.
Please add a function to restrict folders to be scanned.

Thanks!

Re: Tech Preview

First of all, thanks for your initiative!

What I am missing from the Data Processing Policy, is the information on what kind of data will be gathered and transmitted by the VulnDetect client.

Will it send a list of my software, versions, install paths etc. to your server? In terms of IT security that could be very valuable information.
Or is it the other way around, information about the client remains at the client, and the information about vulnerabilities is downloaded to my machine to match with my software?

I would be happy to read from you about this.