Readiness · Public reference
Data and public report policy
Scan public URLs only. Do not submit a URL that contains a password, access token, or private data.
Scan records
We store submitted URLs, capture times, HTTP evidence, artifacts, and derived checks. Public projections remove URL queries and private header values. Evidence is retained until an operator removes the scan. There is no automatic expiry policy for scan evidence yet.
Report publication
An approved report can appear on the home page and in the sitemap. A pending report is accessible by its direct URL and has noindex metadata. It is not private. A hidden report returns 404 on public pages and APIs.
Email and accounts
If you save an email, we store it with the report. This does not start an email delivery or monitoring service. Account and session records support sign-in. Do not save an email unless you want this association.
Abuse controls
We use caller quotas and queue limits. Rate-limit records use caller hashes and expire. If Turnstile is active, Cloudflare processes the challenge. Public report reads do not require a challenge.
Removal and contact
Use the Contact page to request report removal or report a data problem. The operator can read these requests in the private admin area. Requests remain stored until the operator removes them. Do not include private evidence or credentials.