Method
Exactly what it does
The whole proposition is that this is safe to point at a production app, and that is a claim worth being able to check. So here is the entire behaviour, with nothing rounded off.
- Only GET requests
- The page you gave it, and the scripts and stylesheets that page links to. Nothing is submitted, nothing is written, and there is no code path in the app that can send a POST.
- No guessing at paths
- It does not look for admin panels, backup files, config files or anything else you did not link to. The one exception is the source map sitting next to a bundle it already found — the same request your browser's devtools makes when you open the console.
- No login attempts
- It never sends credentials, never submits a form, and never touches an authentication endpoint. It sees your app exactly as a signed-out stranger does.
- One request at a time
- Requests are sequential and spaced, never parallel, with a ten second ceiling on each. Ten simultaneous connections would finish sooner and would also look, from your server, like a small burst of traffic from a stranger.
- robots.txt is obeyed
- If your robots.txt asks automated readers to stay away, the scan stops there — even though you ticked the ownership box. That box is a claim nobody here can verify; robots.txt is a wish you actually published.
- Private addresses are refused
- Every host, and every redirect it follows, is resolved first and dropped if it points anywhere internal. An app on your own machine cannot be scanned from here, and neither can anybody else's.
- Your report is not kept
- There is no database in this app. The report is built, sent to your browser and forgotten — reloading the page loses it. Keys found in your bundle are shown truncated, never in full, and are never written down anywhere. The address you scanned is not recorded either: not in a table, not in the analytics below, nowhere, unless you ask for a walkthrough under the report and tick the box to include it.
- Your visit is logged
- The one thing that is recorded, and it is about you rather than about your app: each page you open and each button you press is logged with your IP address, your rough location from it, and your browser. That is how I know whether anyone is using this. It is kept for ninety days, it is never sold, shared or joined to anything, and it never includes the address you scanned or a word of your report.
- The repository read is the exception, and says so
- Asking for one hands over three things on purpose: the repository's address, an email to send the report to, and whatever you wrote in the note. The request is kept in the studio's queue until the read is done and the report has gone, and your name and email are kept as a contact so I can follow up. The repository itself is fetched for each step of the scan, read in memory, and dropped; the report keeps a path, a line number and a sentence per finding, never a key in full. Remove the collaborator when you are done and the account can no longer see it.
Projekt Studio
Passive scan · no report kept