FAQ
Straight answers.
Is this a penetration test?+
No. LeakSweep runs an automated check of your public site. It is not a penetration test, a certification, or a guarantee that an app is secure, and a clear report does not mean there is nothing else wrong. If you handle payments, health data or anything sensitive, have a qualified person test it too.
Can I scan a site I don't own?+
No. The scan needs a DNS TXT record or a file at /.well-known/leaksweep-verify.txt, plus the authorisation tick. Both checks are enforced on the server. Nothing is requested until they pass.
Will a scan break my live app?+
The checks are passive. They read public pages, response headers, and row counts. They do not guess passwords, send exploit payloads, or store customer rows.
What happens to a key you find?+
Only a redacted fragment is kept: a short prefix and suffix. The full value is not stored in the report, the PDF, or the email.
Do I need to know how to code?+
No. Each finding includes a fix prompt you can paste into Lovable, Cursor, Bolt, or v0. You still decide what to ship.
What does the £29 Deep Scan add?+
Supabase and Firebase access-rule probes that store counts only, never row data. OSV dependency checks when a package manifest or lockfile is public. And a fix prompt on every finding.
What is the £9 monitoring plan?+
Once a week, LeakSweep re-checks that you still control the domain and runs the Deep Scan checks again. You get an email only when a new finding appears. Monitoring is £9 a month, billed monthly through Stripe. Cancel any time from the customer portal. A partial month is not refunded. This sentence is a draft for legal review.
Do you store my users' data?+
No. Row contents, document fields, and secret values are not stored. Reports keep a redacted snippet, a status code, or a count. See the privacy policy.