Responsible use

A free scan behaves like a browser visit plus a few extra public URLs: the page, a handful of scripts, /.env, /.git/HEAD, one source map, response headers, and DNS TXT lookups for mail policy. It does not log in and it does not guess passwords.

Deep checks run only after a DNS TXT record or a homepage meta tag proves you control the hostname. Those checks ask Supabase or Firebase whether the anon identity can see a table. They use HEAD and a count preference. They do not download rows, and a failed or blocked response is not retried as a GET of the table body.

Scan sites you own, sites you are paid to test, or public pages where a normal visit is allowed. Do not use Vibe Scan as a step in an attack. If you find someone else's exposed key, tell the owner. Do not use the key.

We cap how much of a site one request will read, and we block private addresses, link-local metadata addresses, and non-http schemes. If you believe a scan of your site should be removed, use the takedown page.

The scanner identifies itself as JDesignatioVibeScan/1.0 (+https://scan.jdesignatio.com/responsible-use).