Scan only what you are allowed to test

You may submit a URL only if you own that app or you have permission to test it. Do not point the scanner at someone else's site to go looking for secrets. The checkbox on the form is that confirmation.

The free scan is a passive read of public responses: the page, a limited number of same-origin scripts, security headers, and a short fixed list of paths. It does not try passwords, bypass logins, write data, brute-force paths, or query databases. It is not a penetration test and it will miss things.

Fix prompts are suggestions you can paste into your own coding tool. You are responsible for rotating keys and deploying the fix. If a report shows a secret, treat it as already copied and roll it.

Do not use a report to attack an app, including one you were not allowed to scan. We may rate-limit or stop scans that look like abuse.

The problem list is free and asks for an email. A fix report is a one-time $9 payment for one app. Ten fix reports are $29 in credits that do not expire. Checkout charges a card when Stripe is configured. Deeper ownership checks are not on sale yet. Joining that list only saves your email.

The service is provided as-is, without a warranty that an app is secure because the grade was an A, or that a finding is complete. The operator of this deployment can take the service offline.

Contact the operator of this deployment. They can set NEXT_PUBLIC_CONTACT_EMAIL to show an address here.