What we never do
The lines Lockpick never crosses when it checks your site.
These promises describe Pulse and hosted Deep website scans. ZIP uploads, repository checks and Deep Local handle code differently. How your data is used.
- We never sign in to your site, and never look at anything behind a login.
- We never send attack payloads, fill in your forms or try passwords.
- We never change anything on your site, your DNS or your accounts.
- We never need your code to check your site. We only look at what anyone on the internet can see. A repository or skill check reads only the public GitHub code you point it at, and never runs it.
- We never store your visitors' data, or the value of a secret we find exposed.
- We never scan a site without your say-so. Every scan needs your confirmation, and Deep scans need proof of ownership.
- We never show assistants how our checks work inside. Assistants see the same findings, redacted evidence and fixes you do.
Was this helpful?