How LatchDog scans

• Public check (no sign-up): GET of your homepage over HTTPS and HTTP. We read response headers and TLS behavior only.
• Deep scan (verified owners only): GET requests for your homepage, its same-origin JavaScript files and their source maps, /.env-style paths and /.git/HEAD / /.git/config, and for Supabase one SELECT ... LIMIT 1 per table with the public anon key found in your own bundle.
• At most 45 requests per scan, 10-second timeouts, size caps, no form submissions, no logins, no writes.
• We never store secret values (only a masked preview), .env values (only variable names), or database rows (only "a row was returned").
• We refuse private, local and IP-address targets, and re-validate every redirect.
• Ownership is re-verified before every deep scan.

Report a security issue: security@latchdog.com.