Authorized-Use Policy & Scanner Disclosure

Last updated: November 2, 2026.

Only scan what you own

You may only add a domain you own or have explicit written authorization to test. Every domain must be verified with a DNS TXT record, a meta tag, or a file under /.well-known/ before LaunchMedic will send a single scan request. Attempts to bypass verification or to scan third-party sites result in immediate termination.

What the scanner does

  • Requests your public homepage and the first-party JavaScript files it loads, looking for credentials that should not be public.
  • Requests a short, fixed list of well-known sensitive paths (e.g. /.env, /.git/config).
  • Loads the key pages you configure (e.g. /signup) to confirm they render without errors.
  • Reads TLS certificate details and HTTP response headers.
  • If your site's public code contains a Supabase URL and its public anon key, it asks Supabase which tables are exposed and sends aHEAD request with Prefer: count=exact to learn how many rows each table exposes. No row data is requested or stored.

What it never does

  • No login attempts, form submissions, fuzzing, brute force, injection payloads or writes of any kind.
  • No use of any secret it discovers, other than the public anon key described above.
  • No scanning of hosts other than the verified domain (and its own Supabase project, as above).

Politeness

At most 40 requests per scan, at most 2 at a time, with time and size limits. Requests identify themselves as:

LaunchMedic-Scanner/1.0 (+https://launchmedic.dev/acceptable-use; owner-verified scan)

Report abuse

If you believe our scanner contacted your site without authorization, email support@launchmedic.dev and we will investigate and block the account.