# How Lockpick checks a site, and what we never do

By Mark Kashef, founder of Lockpick. Published 2026-10-08, updated 2026-10-08.

What a Lockpick scan reads, the limits it never goes past, what needs your permission, and the lines we never cross, in one page.

Lockpick checks your site from the outside, the way a stranger or an attacker would find it, reading what your site already shows the public plus public records about your domain, and nothing else. This page is the short version of how that works and where it stops.

## What does a scan read?

| | Pulse | Deep |
| --- | --- | --- |
| Reads | Your homepage, email sending settings, browser security settings and public domain records | More pages and scripts, files that should not be public, admin areas and your API |
| Needs | Your confirmation that you may test the site | Proof you own the site, and your approval each time |

A Pulse sends at most 10 requests to your site and a Deep scan at most 200. Requests are spaced out, and a scan stops early if your site slows down, fails or refuses. Reading DNS records, certificate logs and domain registration never touches your site.

## What does a report claim?

Only what the scan saw. A finding is only reported with the evidence that shows it, and anything a scan couldn't check is marked as not checked, never as passed. The [rating page](/docs/security/how-we-rate-findings) explains how sure each finding is and what checking again proves.

## What needs your permission?

Every scan starts with your confirmation that you own the site or are allowed to test it, and a Deep scan also needs proof of ownership and your approval each time. Atlas, our example app at atlas.example, is the address our docs use, so nobody tests a real site by copying an example.

## What do we never do?

- We never sign in to your site, and never look at anything behind a login.
- We never send attack payloads, fill in your forms or try passwords.
- We never change anything on your site, your DNS or your accounts.
- We never read your code or your repositories.
- We never store your visitors' data, or the value of a secret we find exposed.

A Lockpick report is not a certificate and not a full penetration test, and it covers what that scan could see on that day. It does not prove your site is secure, only what was open to a stranger when it looked.

## Questions people ask

### Will a Lockpick scan slow my site down?

It should not. Requests are spaced out, each scan has a fixed budget, and a scan stops early if your site slows down or refuses.

### Is a clean report a security certificate?

No. It covers what that scan could see on that day, from the outside. It is not a penetration test.

## Sources

- [How we check](https://www.lockpick.app/docs/security/how-we-check), Lockpick docs, read on 2026-10-06
- [What we never do](https://www.lockpick.app/docs/security/what-we-never-do), Lockpick docs, read on 2026-10-06