Every cloud-saved report is encrypted with AES-256-GCM before it touches our database — a unique salt and key derivation per record, authenticated encryption throughout. If our database were ever exposed, your findings wouldn't be.
Optional sign-in lets you save reports across devices. Here's what happens to your data when you choose cloud storage.
You save a report — it's encrypted server-side with AES-256-GCM before it's written to disk.
Each report gets its own random salt and IV, so no two records share exposure.
Data is only decrypted when you request it, over an authenticated session (HttpOnly, Secure, SameSite cookies).
Vulnerability reports contain sensitive client data, exploit details, and proof-of-concept steps. Encryption at rest means that even if someone obtained a copy of our database or backups, they would see ciphertext — not your findings.
You don't need an account to use PoCcraft. The core generator runs in your browser and drafts stay on your device unless you explicitly choose to save to the cloud.
Build and export reports entirely in your browser — no account, no server-side storage. Cloud encryption is there when you want it, not required to get work done.