Scan policy

What we do

• Verify ownership first, through a DNS TXT record or a meta tag you place on the homepage. The only request made before verification is a single capped fetch of the homepage to look for that meta tag.
• Read what any visitor's browser receives: the homepage, the JavaScript it loads, and response headers.
• Check a short list of well-known paths that should never be served, for example environment files.
• Where a project's public database key is present in the bundle, count whether tables answer that key. We never request, read or store row contents.
• Log every outbound request we make for 30 days, identify ourselves in the User-Agent (StableshipScanner, linking to this page), cap request counts, sizes and time, and run at most one scan per domain per day.

What we never do

• Attack, modify, or write to a production system.
• Scan a site whose ownership has not been verified, or a shared platform's own domain.
• Store secret values. Where a secret is found we keep only its first and last characters.
• Sell, share or publish scan results. The report is sent to the address that requested it and is reachable only by its unguessable link.

Active testing

Paid plans and the free audit run active tests, including attempts to read data across user roles. These run only against a private test copy of your own application, provisioned for the run, with isolation from production confirmed first. Production is never attacked. The terms of service authorize this testing for the projects you connect.

Opting out

Email scan@stableship.ai to add a domain to our do-not-scan list. We confirm within two business days and the block applies to every future request for that domain and its subdomains.

Reporting a problem

If you believe a Stableship scan behaved outside this policy, email scan@stableship.ai with the hostname and approximate time. Every outbound request is logged, so we can tell you exactly what was fetched.