Terms of use

Only scan what you own or are authorised to test. By submitting a URL you confirm you control it or have written permission. The free surface scan makes at most 20 unauthenticated GET requests, equivalent to a normal browser visit. Live database proof runs only with a paid key or a verified ownership token, is read-only (GET ... limit=1), rate-limited to one request per second, capped at 50 requests per scan, and stops on errors.

What we store. Verdicts, check ids, and evidence summaries (row counts and column names, never row values, never key material). Keys discovered in your public bundle are used in memory for the scan and fingerprinted, not stored. API keys are stored as hashes.

No guarantee. A GREEN verdict means we found nothing in what we checked. Every report lists what was not checked. This is not a penetration test and not legal or compliance advice.

Fix proposals. Pull requests are opened on a bot branch and require a human merge. We never push to your default branch and never auto-deploy.

Payments. Pro is billed by Stripe. Cancel anytime; your account's paid features stop at period end. Abuse of the service (scanning targets you do not own) terminates access without refund.