What this scan stores

Vibe App Watchdog is a passive scanner. The operator of the deployment you are using runs it. This note describes this version of the product.

When you scan a URL, we store the URL, the final URL after redirects, the hostname, the letter grade, the findings, a short coverage note, and the time. Findings include a masked form of any matched secret (a few characters from each end). We do not store the full secret.

We store a hash of the requester IP, with a salt, so we can rate-limit scans. We do not store the raw IP address. Report links use a random id. Anyone who has the link can open that report, so don't post it somewhere public if the hostname itself is sensitive.

To see a problem list, you give us an email. We store it on that report, send a note that the report is ready, and may send two follow-ups if you have not paid. Those stop when you pay or when you use the unsubscribe link. After a purchase we send a receipt-style note with the report link. Marketing mail includes a postal address.

A purchase records the email, the report, the amount, and the Stripe Checkout session id. A 10-report pack stores a credit balance on that email. We do not store your card number. Stripe does.

If you join the list for deeper checks, we store that email separately. We do not sell either list.

The scanner requests the page, up to 10 same-origin scripts, five fixed paths, robots.txt, sitemap.xml, and up to 25 same-origin links from the homepage. Those requests are ordinary HEAD or GET calls. We do not send your cookies to the target, and we do not log into it.

Scans and emails stay in the database until the operator deletes them. There is no self-serve delete button in this version.

Questions go to the operator of this deployment. Set NEXT_PUBLIC_CONTACT_EMAIL to publish an address here.