Security: how Crawl Cove is signed

Code signing

Both installers are code-signed, so Windows and macOS can name the publisher before a single line of the app runs. The Windows installer has been signed since v1.0.0 on 6 September 2026, the macOS build since v0.1.5 on 30 August 2026. The certificate details below were read off the files this site serves for v1.0.1, on 14 September 2026.

Windows installer (.exe)

Signature: Authenticode, via Microsoft Azure Trusted Signing
Issued to: Crawl Cove (GB)
Issued by: Microsoft ID Verified CS AOC CA 04
Chains to: Microsoft Identity Verification Root Certificate Authority 2020
Timestamped by: Microsoft Public RSA Timestamping CA 2020 (RFC 3161)

To check it yourself: right-click the installer, open Properties and read the Digital Signatures tab. Or paste this into PowerShell, from wherever the prompt happens to be. It finds the installer in your Downloads folder, whichever version you took:

Get-AuthenticodeSignature (Get-ChildItem "$HOME\Downloads\Crawl-Cove-*-Setup.exe").FullName | Format-List

If you saved it somewhere other than Downloads, swap that folder into the path. Read Status, which should say Valid, then the subject and issuer on the certificate it prints, against the table above.

One thing to expect: Trusted Signing issues a fresh, short-lived certificate for every signing run, so the certificate on one release is not the certificate on the next, and a published fingerprint would be wrong within days. The countersigned timestamp is what keeps a signature valid after its certificate expires. Compare the organisation and the issuer, not a fingerprint.

macOS build (.dmg)

Signing identity: Developer ID Application: Crawl Cove LTD (33G7U99LZB)
Apple Team ID: 33G7U99LZB
Issued by: Apple Developer ID Certification Authority
Notarisation: Notarised by Apple, ticket stapled into the app
Runtime: Hardened runtime enabled

The stapled ticket is why the app opens on a Mac that is offline: Gatekeeper reads the notarisation from the bundle instead of asking Apple. To check it yourself, after dragging the app into Applications:

codesign -dv --verbose=4 "/Applications/Crawl Cove.app"
spctl -a -vvv -t install "/Applications/Crawl Cove.app"
xcrun stapler validate "/Applications/Crawl Cove.app"

The first command prints the signing identity above, including the Team ID. The second should say accepted, the third that the ticket validates.

Checksums for every build

Every file we ship is listed with its SHA-512 in the update manifest the app itself reads, so you can compare a download against the same record the updater trusts: latest.yml for Windows, latest-mac.yml for macOS. The manifests record the hash base64-encoded rather than as hex, which is the trap worth knowing about: a hex digest from certutil or Get-FileHash will not look anything like the published one even when the file is perfect. Produce it in the same form and the two strings match character for character.

In PowerShell, on Windows:

Get-ChildItem "$HOME\Downloads\Crawl-Cove-*-Setup.exe" | ForEach-Object {
    [Convert]::ToBase64String([Security.Cryptography.SHA512]::Create().ComputeHash([IO.File]::ReadAllBytes($_.FullName)))
}

On a Mac, in Terminal:

openssl dgst -sha512 -binary ~/Downloads/Crawl-Cove-1.0.1-arm64.dmg | openssl base64 -A

What the app sends, and what stays put

The crawl runs on your machine. Crawl results, client names and audit history are stored in a database file on that machine and are not uploaded to us. API keys and OAuth tokens are encrypted before they are written, using the operating system’s own key store: DPAPI on Windows, the Keychain on macOS.

These are the only things the app sends anywhere:

Licence checks, to crawlcove.com. They carry your licence key, a random identifier generated once on first launch, your computer’s name, the platform and the app version. The computer name is there so you can tell your own devices apart in the seat list and free a seat when you retire a machine.
Update checks, which fetch the manifest linked above and nothing else.
Integrations you connect. Switching on Google Search Console, Bing Webmaster Tools, Chrome UX Report or Open PageRank sends the URLs being asked about to that provider, for your own property. Connect none of them and none of them are contacted.

There is no analytics, no usage tracking and no crash reporting in the app. Nothing else phones home. The longer version, integration by integration, is in Privacy and where your data lives, and the policy itself is the privacy policy.

The other direction is worth stating too: what the crawl sends outwards, to whichever site is being audited. Its user agent, how it follows robots.txt, its default request rate and how to block it are all on the crawler bot page, which is written for the site owner on the receiving end.

Payments

Subscriptions are handled by Stripe. Card details are entered on Stripe’s own checkout page and never reach our servers: what we hold is a customer reference, a plan and a renewal date, not a card number. A subscription is only activated when Stripe sends us a webhook whose signature verifies, so a payment page cannot be faked into granting a licence. Changing or cancelling a plan goes through Stripe’s billing portal from your dashboard.

This website and the licensing API

Everything is served over HTTPS, and the same hardening headers go out on every response, including the licensing endpoints the desktop app calls:

Strict-Transport-Security, one year, including subdomains.
X-Content-Type-Options: nosniff.
X-Frame-Options: SAMEORIGIN.
Referrer-Policy: strict-origin-when-cross-origin.
Permissions-Policy denying camera, microphone, geolocation and browsing topics.

Those five are asserted by a test that runs before any change to this site ships, against both a web page and the licence API, so they cannot quietly disappear in a refactor. You can read them yourself with curl -I https://crawlcove.com/.

Reporting a security problem

Email support@crawlcove.com with what you found, the steps to reproduce it and what you think it lets someone do. A person reads every message. We will confirm we have it, tell you what we are doing about it, and credit you when it is fixed if you would like us to. There is no bug bounty programme and no payment.

Please do not run automated scanners or load tests against crawlcove.com: it is a small site and that is indistinguishable from an attack at this end. Testing the desktop app on your own machine, including against your own sites, is fair game. The same contact is published in machine-readable form at /.well-known/security.txt.

Who you are dealing with

The company behind the certificates above is a registered UK company, and the register entry is public, so the name on the signature can be checked against a third party rather than taken on our word.

Registered name: Crawl Cove Ltd
Registered in: England and Wales
Company number: 17402642

More about who makes Crawl Cove · Download the app

Security at Crawl Cove.