What we check, what we never touch

Free teaser

No domain check. The teaser sends the same GET requests a visitor's browser can already make, then shows a grade and a count by category and severity. It does not name tables, keys, files, or lines, and it has no fix steps.

• Security headers on the public homepage.
• Files a visitor can download, such as an environment file or a source map.
• Keys that show up in the site's own downloaded code.
• Tables or databases that answer an anonymous read.
• Admin-looking routes that return data without a login.

Paid scan

A paid scan requires proof you control the domain. The easier proof is a file on your site. The other is a TXT record where you bought the domain. The report names the exact locations, shows the redacted evidence, and includes a fix prompt. Rescans of that verified project are included. If you connect a repository, the same scan grades the code.

We read your code once during the scan and don't keep a copy. GitHub access is used for that scan and then dropped.

What we never touch

• We do not sign in, submit forms, or send POST, PUT, PATCH, or DELETE.
• We do not try injection, authentication bypass, or other exploits.
• We do not store customer rows, source-map source, or full secret values.
• We do not use a secret we find. Finding it is the whole point.
• We do not keep a copy of your repository or the zip you uploaded.
• We do not run a paid scan until the domain check succeeds.
• We do not call the result antivirus, a penetration test, or a guarantee.