Cookies
Cookie Policy
This policy describes cookies and similar storage used by CRAB based on a code audit of the current application.
Summary
The public CRAB marketing site and inspection request form use strictly necessary storage only. We do not use analytics, marketing or third-party tracking cookies on the public site at this time. No consent banner is required for the current public implementation.
Public website
| Name | Category | Purpose | Duration | Scope |
|---|---|---|---|---|
acs_intake |
STRICTLY NECESSARY | Signed CSRF token for the public inspection request form at /inspect. Prevents cross-site form submission. HttpOnly; not used for tracking. | Session-scoped (Max-Age aligned with operator session TTL; typically up to 8 hours) | /inspect and related public intake flows |
Operator console
The operator console sets a separate session cookie after sign-in. It is not used on ordinary public pages.
| Name | Category | Purpose | Duration | Scope |
|---|---|---|---|---|
acs_operator |
STRICTLY NECESSARY | Signed operator session for authenticated CRAB console access (/overview, /scans, etc.). HttpOnly. | Session-scoped (typically up to 8 hours) | Operator routes after sign-in |
Managing storage
You can control cookies through your browser settings. Blocking strictly necessary cookies may prevent the inspection request form or operator sign-in from working.
Changes
If analytics or marketing technologies are introduced, this policy and the consent mechanism will be updated before non-essential storage is used on the public site.