Free Scanner: Terms & Acceptable Use
Updated October 17, 2026: added a description of the read-only Supabase check (sections 2–4).
This is a plain-English summary and not legal advice.
1. You must own the app or be authorized
Only scan websites and apps that you own or have explicit permission to test. By ticking the consent box you confirm this. We record the time, a one-way hash of your IP address and the URL scanned as a record of that consent.
2. What we fetch
Our scanner (user-agent WarditorScanner/1.0 (+https://warditor.com/scanner)) makes roughly 10–40 ordinary read-only HTTP requests, the same ones any visitor's browser could make: the page you enter, up to 15 same-origin JavaScript files, a short fixed list of commonly exposed files (such as /.env, /.git/HEAD, /.DS_Store, /config.json, /backup.zip), possible source-map files, one request with a test Origin header, and an HTTP-to-HTTPS redirect check. We do not log in, submit forms, guess passwords, exploit vulnerabilities, or crawl your site.
Supabase read check. If your app's public code includes a Supabase project URL and a public (anon or publishable) key, the scanner uses that same public key to make a small number of read-only GET requests (at most 10 per scan) to that app's own Supabase project. It checks whether tables can be read without logging in. It asks for at most one row per table, only to confirm whether the table is readable; that row is discarded and never stored or shown. It never writes, changes, or deletes data, and it does not contact any other Supabase project. If we find a service_role key in your public code we report it, redacted, but never use it.
3. What we store
We do not store your page contents, scripts, any secrets we find, or any rows from your database. For the Supabase check, reports show only table names and row counts. Secrets are masked in reports (first 4 and last 4 characters only), and we never show the contents of exposed files. We keep the scanned domain, finding types and timestamps for up to 30 days for abuse prevention, plus a masked copy of the report for 10 minutes so repeat requests don't hit your site again.
4. No guarantee
The scan is provided "as is", free of charge. A clean result does not mean your app is secure: the Supabase check only tries anonymous reads on a limited set of tables, and we do not test write access, Firebase rules, authentication, or server-side logic. Findings may include false positives or miss issues.
5. Limitation of liability
To the maximum extent permitted by law, Warditor is not liable for any damages arising from use of the scanner or reliance on its results. Our total liability for the free scanner is zero dollars ($0).
6. Acceptable use; we may refuse scans
You may not use the scanner to target sites you are not authorized to test, to harass anyone, or to evade our limits (currently 3 scans per hour per visitor, 5 scans per site per day, and a global daily cap). We may refuse, rate-limit, or block any scan or domain at our discretion. Large platforms and sensitive domains are blocked.
7. Opt out
Site owners who do not want to be scanned can email [email protected] and we will add their domain to our blocklist.
8. Fix Pack
The optional $49 Fix Pack is a separate paid service. We fix the reported issues within 48 hours of receiving access, or you get a full refund. We will ask for your written authorization before touching any code or accounts.