Scan Consent & Responsible Use

Before you run a scan you confirm that you own the website or have the owner's permission to scan it.

What a free (passive) scan does

• Requests your homepage, the same-origin JavaScript files it loads, and their source maps, exactly as a browser would.
• Requests a small number of well-known public paths: /robots.txt, /sitemap.xml, /.env, /.env.local, /.env.production, /.git/HEAD, and plain http:// to check the HTTPS redirect.
• Reads the TLS certificate, and looks up public DNS (via DNS-over-HTTPS) and domain registration data (via RDAP).
• Does not log in, submit forms, guess passwords, or send requests to your database.
• Identifies itself with the user agent ShipCheckBot/1.0 (+https://runshipcheck.com/bot).

What an owner-verified (active) scan adds

• Only after you prove ownership (meta tag, /.well-known/shipcheck.txt file, or DNS TXT record).
• If your site exposes a Supabase project URL and public anon/publishable key, ShipCheck uses that same public key to ask Supabase's REST API which tables are exposed, then sends one HEAD request per table asking only for a row count.
• Row data is never requested, downloaded or stored. Only table names and counts are kept.

Limits

Scans are rate-limited per IP and per site, use short timeouts and size limits, and refuse private/internal network addresses.

Found something on a site you don't own?

Don't exploit it. Contact the site owner through their published security contact or /.well-known/security.txt. ShipCheck never contacts site owners about findings on your behalf.

Opt-out

Site owners who don't want ShipCheck to scan their site can email [abuse email] and we'll block the domain.