Security & privacy

What we scan

Live URLs (HTTP responses, page content, headers) and public GitHub repositories you provide. We do not access private repos without your explicit action, and we do not perform active exploitation or penetration testing.

What we store

Scan metadata, findings, scores, and grades in your account. Source code is processed in memory during the scan and not permanently retained. You can delete your account and all scan history from dashboard settings.

What we never do

• Use your code to train AI models
• Sell scan data to third parties
• Display fabricated customer testimonials or usage statistics

Share links

Completed scans may have optional share links (unguessable tokens). Org editors can rotate or revoke links from the scan detail API. Revoked links stop working immediately. Share tokens are never exposed on unauthenticated public scan status endpoints.

Sessions & access control

Dashboard and admin routes use signed HttpOnly session cookies. API access requires Firebase ID tokens or org-scoped API keys. Platform admin actions are restricted to an allowlisted operator UID set. Role-based access (viewer, editor, admin, owner) is enforced on every privileged API operation.

Infrastructure

TLS in transit, Firebase Auth for identity, PostgreSQL for account data. See our Privacy Policy for full details.