Effective 2 November 2026. Last updated 2 November 2026.
What this site uses
A cookie is a small file stored by your browser. ScnFix Pentest sets the cookies below when you use an account or Google Sign-In. Marketing pages can be read without those cookies. We do not use Google Analytics, advertising pixels, or a marketing cookie.
CSRF protection uses an x-pentest-csrf request header bound to your session. That token is not a cookie.
Cookies we set
| Name | Purpose | Duration | Type |
|---|---|---|---|
scnfix_pentest_session | Keeps you signed in. The server stores a hashed session token, a CSRF token, and whether this session has passed the authenticator step. | 12 hours | Essential |
scnfix_google_state | Protects a Google Sign-In attempt. It holds a short-lived OAuth state, nonce, and PKCE verifier so the callback can be checked. | 10 minutes | Essential |
scnfix_google_link | Holds a pending Google identity for ten minutes while an existing ScnFix account is linked with the current ScnFix password. | 10 minutes | Essential |
In production these cookies are HttpOnly, Secure, and SameSite=Lax. The session cookie lasts 12 hours. The Google Sign-In cookies last 10 minutes and are cleared when that step finishes or fails.
Cookies set by Google
If you choose Continue with Google, Google may set its own cookies on accounts.google.com to complete that sign-in. Those cookies are Google’s, not ScnFix’s. Google’s privacy materials describe them. You can use email and a ScnFix password instead of Google Sign-In.
How to control cookies
You can block or delete cookies in your browser. If you block scnfix_pentest_session, you will not stay signed in. If you block the Google Sign-In cookies, Continue with Google will not complete. Signing out deletes the ScnFix session cookie.
Related pages: Privacy policy and Terms of service.