Security
Security boundaries should be explicit
TutuSoo separates public search from personal data: anonymous search needs no account, while sign-in only powers collections and history. Crawling respects robots.txt and applies outbound-address and response-size limits.
Search and external links
Results may come from the local index or a labelled web fallback. The client only opens HTTP or HTTPS addresses, so malformed results cannot become executable links.
- Search-result pages are not indexed.
- Queries, pagination and responses have resource limits.
- Network errors preserve context and offer a real retry.
Crawler boundaries
Targets are checked before requests. Loopback, private, link-local and cloud-metadata addresses are rejected, and redirects are validated again.
- robots.txt and Crawl-delay are respected by default.
- HTML is streamed with a response-size limit.
- Crawl, index and recovery states remain traceable.
Accounts and personal data
Anonymous users are not forced to create accounts. Tutu ID provides sign-in; collections and search history can be removed individually or cleared.
- Admin and ordinary-user endpoints use separate authorization checks.
- Expired sessions are cleared locally with an explicit message.
- API keys should never be placed in URL query parameters.