Published 2026-04-10 | Updated 2026-09-10 | LoadStrike Editorial Team
Review LoadStrike self-hosted execution, data handling, and published SDK dependency scanning for customer and procurement teams.
A clear product summary for security and procurement review.
What data does LoadStrike handle in the current product?
LoadStrike runs self-hosted in customer-controlled environments.
Licensed execution uses runner, environment, version, and entitlement metadata. It does not use application request or response payload bodies for access checks.
LoadStrike runs automated dependency scans every Monday at 06:00 UTC, and the same scan can be started manually. Each run resolves the latest stable published NuGet, npm, PyPI, Maven, and Go SDK packages and audits the runtime and transitive dependency graphs selected by temporary consumers. For Go, the scan also checksum-verifies and audits every supported execution artifact published for the exact selected module version. Any known vulnerability at any severity fails the relevant scan; a resolution, audit, or scanner error also fails.
Who this is for
Security, procurement, platform, and architecture teams reviewing LoadStrike.
Why enterprise reviews slow down here
Reviews slow down when product and data-handling details are scattered. This page gives the summary.
What this page confirms today
Use this page to separate self-hosted runtime execution from account, access, and support data.
Verified LoadStrike fit points
Self-hosted execution happens in customer-controlled infrastructure.
Runtime access checks use runner, environment, version, and entitlement metadata.
Licensing records support account management and plan access.
Signup and contact forms can require Cloudflare Turnstile verification.
Website privacy details are documented separately.
Security contact details are published at /.well-known/security.txt.
Published SDK dependency scans cover the latest stable NuGet, npm, PyPI, Maven, and Go packages.
The scan runs once a week on Monday at 06:00 UTC and can also be started manually.
Temporary consumers expose each package's runtime and transitive dependency graph for audit.
Every supported Go execution artifact for the exact selected module version is checksum-verified and audited.
Any known vulnerability at any severity makes the relevant scan fail.
A package resolution failure, incomplete dependency graph, audit error, scanner error, or timeout also makes the relevant scan fail.
A passing result is point-in-time only: automated scanning does not guarantee that software is vulnerability-free and does not provide a security certification.
Use the security and compliance contact path for follow-up review.
Common questions
Common questions
Does LoadStrike store application payload bodies as part of runtime access checks?
No. Runtime access checks use runner, environment, version, and entitlement metadata.
Can public forms require human verification?
Yes. Signup and contact forms can require Cloudflare Turnstile verification.
Which published SDK packages are scanned?
The scan runs once a week on Monday at 06:00 UTC and can also be started manually. Each run independently resolves the latest stable published NuGet, npm, PyPI, Maven, and Go packages.
What does the published SDK dependency scan check?
Each temporary consumer selects the package's runtime and transitive dependency graph. The Go scan also checksum-verifies and audits every supported execution artifact for the exact selected module version. Any known vulnerability at any severity fails the relevant scan, and a resolution, audit, or scanner error fails too.
Does a passing automated scan guarantee that an SDK is vulnerability-free or certified?
No. A passing result is point-in-time only. Automated scanning does not guarantee that software is vulnerability-free and does not provide a security certification. Organizations should apply their own risk assessment and security controls.
How should security reports be sent?
Send security review requests and vulnerability disclosure questions to [email protected] or use the contact page security path. The site also publishes /.well-known/security.txt for automated discovery.
What data should security and procurement teams review first?
Start with this page, pricing, and website privacy, then contact LoadStrike if needed.
Where does website privacy fit into this picture?
Website analytics and contact-form handling are covered on the website privacy page.
Related
Related documentation
Start with the implementation details that match this page.
