Trust & Security

How Bushido is protected

• TLS everywhere. Every byte is served over HTTPS with a managed certificate and strict transport security. There is no plaintext path to the application.
• Edge defense in front of the app. Traffic passes through Cloudflare's WAF and a behavioral intrusion-detection layer before it ever reaches Bushido, filtering hostile and automated traffic at the edge.
• Monitored 24/7. An independent uptime monitor probes the service every minute and publishes live status on our public status portal. We see an outage before you do.
• Hardened sign-in. Accounts use passwordless magic-link sign-in plus multi-factor authentication (authenticator app or passkey). There is no reusable password to phish or leak.
• Abuse-resistant signup. Registration is protected by a challenge, an invisible honeypot, and per-IP rate limiting — so the lookup service stays available to real operators.
• Built to survive a reboot. Health-checked containers, durable in-flight job storage, and an automated boot-recovery check mean the service comes back clean and on its own after any host restart.
• Independently graded. Our own external scanner, Argos Lens, grades Bushido's public security posture from the outside — currently grade A. We hold ourselves to the same scorecard we give the public.
• Honest data, by design. Every record carries a confidence score, every estimate is labeled, and every disclaimer is plain-spoken. Security is about integrity of information too.

What this does not mean

No internet-facing service is "unhackable," and we will never claim Bushido is. What we promise is operational honesty: it is actively managed, continuously monitored, externally graded, and run by people whose day job is defending systems. If something breaks, we are watching — and we will say so.

Found a security issue? Email [email protected]. We read it.