The free scan is passive and read-only. It fetches the public page you submit, up to 25 same-origin JavaScript files, the files /.env and /.git/config, and any referenced source maps (HEAD request), and reads response headers, exactly like a browser would. It does not log in, submit forms, guess passwords, fuzz, exploit or load-test anything. Requests identify themselves with the User-Agent DeploySharkScanner/0.1.
The Supabase table test only runs after you prove ownership with a meta tag, a /.well-known/deployshark-verify.txt file, a DNS TXT token, or (when enabled) by connecting the Supabase account that owns the project. Supabase access tokens are used once and never stored. It sends read-only GET requests with the public key found in your app and checks whether at most one row per table is returned. It never writes, updates or deletes data. Row contents are discarded immediately; we store only table names and whether they were readable.
Only scan apps you own or are authorised to test. Scans are rate-limited, and private, internal and loopback addresses are refused. We may block abusive use.
For scans: the hostname, time and score. For the waitlist: your email, app URL and chosen plan, used only to contact you about DeployShark. Ask us to delete it any time.
DeployShark finds common, visible mistakes. A clean report is not proof that your app is secure, and reports are not a professional audit. The service is provided "as is".
If our scanner hit your site and you didn't ask for it, or you found a security issue in DeployShark itself, please contact the operator via the waitlist form (put "security" in the app URL field) and we will respond promptly. Please don't publicly disclose issues before we've had a reasonable chance to fix them.