infostealerlogs.comInfostealer intelligence
ConsoleAccount
Security and trust

Security, privacy, and responsible use.

Infostealer Logs is built for authorized security work. This page describes how the application handles accounts, exposure results, payments, and API access.

Account security

  • Passwords are hashed with scrypt and a per-user salt.
  • Session cookies are random, HTTP-only, SameSite=Lax, and stored as SHA-256 hashes.
  • Signup and sign-in endpoints have per-IP throttles.
  • Production deployments use HTTPS and secure cookies through the reverse proxy.

Data handling

  • The account record stores email, password hash, session hash, plan, API key, daily usage, credits, and payment references.
  • Search results are cached in memory for up to 10 minutes and are not written to the account database by the server.
  • Exports are generated in your browser from the records you requested.
  • The SQLite database and its WAL files use restrictive file permissions.

API access

  • Paid plans receive a bearer key prefixed with lk_live_.
  • The data-provider key stays on the server and is never sent to clients.
  • Each API key is bound to the account plan and daily quota.
  • Keys can be regenerated from Account; the old key stops working immediately.

Payments

  • BTC is the only payment currency at launch.
  • BTC checkout is hosted by BTCPay Server. The app does not create invoices through an API; plans are activated manually after payment confirmation.
  • Wallet keys should remain on a hardware wallet or watch-only setup, not on the application server.
  • Plans are prepaid for 30 days. Crypto payments do not auto-renew.

Responsible use

  • Use Infostealer Logs only for authorized assessments, exposure monitoring, and incident response.
  • Do not use the service to access accounts without permission.
  • Handle exposed credentials according to your engagement scope and data-protection obligations.
  • Report suspected abuse or a security issue through the support channel.