Privacy

What we store

We do not save reports in a server-side report database. Each audit streams results to your browser, which saves up to 25 reports in local storage. Older reports may be removed when that limit or your browser's storage limit is reached. Your recommended-change checkboxes are stored in the same browser.

To limit abuse and API costs, we keep temporary request counters and daily AI budget reservations. A shared Redis store, when configured, receives a keyed hash of your IP address rather than the raw address; it does not receive the domain you scan or your report. Visitor counters expire after an hour or 24 hours, and AI budget reservations expire within 48 hours. Our hosting provider may keep standard operational request logs, including IP addresses and requested paths.

There are no accounts, tracking cookies or analytics on this site. Reports on a shared browser profile may be visible to other people using that profile.

What we send elsewhere

• Anthropic. When AI review is available, a summary of the crawl (page addresses, titles, selected headers, cookie names, form fields, script addresses), detected technologies, matched advisory data and automated findings are sent to Anthropic's API for token counting and review. Findings may include sensitive details that were exposed in public responses.
• Vulnerability databases. Detected package names, ecosystems and exact versions are looked up in OSV.dev. Advisory identifiers are used to retrieve source details and fixes. Your domain isn't included in those lookups.
• Your website and linked resources. The scanner requests public pages and resources from your website and the hosts it references. Those hosts receive the scanner's network address and may log the requested paths.

Deleting a report

Open the report and choose Delete, or clear your browser's data for this site. Either removes it for good.

Who can see a report

Reports are available in the browser profile that ran the audit. Report links don't work in another browser or on another device. Use Download report or Export to share a file, and review it for sensitive details before sending it.