How Lockpick checks a site, and what we never do

Lockpick checks your site from the outside, the way a stranger or an attacker would find it, reading what your site already shows the public plus public records about your domain, and nothing else. This page is the short version of how that works and where it stops.

What does a scan read?

A Pulse sends at most 10 requests to your site and a Deep scan at most 200. Requests are spaced out, and a scan stops early if your site slows down, fails or refuses. Reading DNS records, certificate logs and domain registration never touches your site.

What does a report claim?

Only what the scan saw. A finding is only reported with the evidence that shows it, and anything a scan couldn't check is marked as not checked, never as passed. The rating page explains how sure each finding is and what checking again proves.

What needs your permission?

Every scan starts with your confirmation that you own the site or are allowed to test it, and a Deep scan also needs proof of ownership and your approval each time. Atlas, our example app at atlas.example, is the address our docs use, so nobody tests a real site by copying an example.

What do we never do?

• We never sign in to your site, and never look at anything behind a login.
• We never send attack payloads, fill in your forms or try passwords.
• We never change anything on your site, your DNS or your accounts.
• We never read your code or your repositories.
• We never store your visitors' data, or the value of a secret we find exposed.

A Lockpick report is not a certificate and not a full penetration test, and it covers what that scan could see on that day. It does not prove your site is secure, only what was open to a stranger when it looked.