Scanner terms

Only scan applications you own or have permission to test. You are responsible for the URL you submit.

The scan is passive. It fetches public pages and same-origin scripts, requests a few common paths such as /.env, reads response headers, and may send a read-only GET to a Supabase table using an anon key it found in that public page. It does not brute force, submit forms, create accounts, or write data.

Results are a point-in-time reading of the public surface, not a guarantee that the app is safe. Rate limits apply. FlowCheck stores the URL, the score, and the findings so you can reopen them.

If you opt in with an email, that address is stored and, when ActiveCampaign is configured, added to the FlowCheck list. Signup for monitoring uses the same list. If the API key is missing, signup still completes and the sync is skipped.