Privacy & data handling
Know where your input goes.
Website scans
The scanner visits the public URL and reads page content and scripts. Supported detectors send additional requests to the target and services discovered in the input. No account is required for a one-off scan.
Code and repositories
Pasted Code is sent to our server, not processed only in your browser. The browser retains your input while the page is open so you can scan it again. Repository scans clone a temporary copy for the enabled analysis engines; the pipeline attempts to remove that copy when execution finishes. Dependency names and versions are sent to OSV.
Detected keys and external services
Secret findings are designed to contain masked values. Keys are sent to their issuing provider only when you explicitly enable verification and the server supports it. Provider account names are omitted from new verification results. Additional Supabase/Firebase probes require a separate choice and may read exposed data. Read-only requests still read data.
Saved reports and links
URL and Code results are not saved unless you choose saving and sign in. Repository scans require sign-in and save a private report. Saved reports contain the target, time, findings, masked evidence and notes and are accessible only to their signed-in owner. Public sharing is disabled. Old reports without an owner are no longer publicly accessible. Unsaved results remain in the current page’s memory until you clear or leave it.
Individual tools
Browser tools calculate results locally. Network tools send the entered target through our server to the target or a service such as a DNS resolver or Have I Been Pwned. SRI can calculate a hash from pasted content locally; URL fetching makes a browser network request where permitted. Each tool explains its processing location.
Accounts and limitations
Supabase handles configured sign-in providers and email-link authentication. Account deletion blocks new report writes and removes owned reports and jobs before removing the sign-in identity. If deletion fails, the interface reports failure and you can retry; it does not restore already removed data. Running analysis may continue until it finishes or times out, but cannot save a report for the deleted account. Operational service logs and provider backups may exist; automatic retention and verified backup-expiry periods are not yet implemented. A scan is a limited check, not a comprehensive security audit or a guarantee that no sensitive information remains.