Your data, in this build.
Browser access
A random, HTTP-only browser cookie keeps access to this browser's targets and scan records private. It is a browser capability, not a verified email account. Keep access to your browser private.
Targets and reports
The local runtime saves targets, scan events and reports in its private data directory when file persistence is configured. Without it, records stay in server memory and can be lost on restart. Cross-device accounts and recovery are not available.
Authorization and scope
Selecting Scan records your attestation that you own or are authorized to assess the exact hostname. This is not independent ownership proof. The baseline stays on that hostname and blocks private or local network addresses, custom ports, credentials, query strings, and cross-host redirects. It sends no login sessions or exploit payloads.
Scan execution
When the local runtime is configured, the URL baseline runs 13 bounded HTTP/TLS hardening checks on the shared InstaBox VM queue. An unavailable runner returns an error and creates no simulated result. Cloudflare durable storage and dispatch are not connected, so the current local worker is not ready for public deployment.
Assessment limits
The URL baseline does not inspect source code, dependencies, authenticated routes, database policies, payments, or AI features. Those need additional artifacts, accounts, or provider test environments.
Sample assessment
The example report is a static historical exhibit, separate from your targets. It is not a live scan or evidence about a site you submit.
Integrations
GitHub authentication, repository connections, and team accounts are not configured. The interface does not request their credentials.