Terms of service

What LeakScan is

LeakScan runs read-only security checks against a web application you own or are authorised to test, and gives you a report with suggested fixes. It is a scanning service, not a security guarantee, and not a substitute for a professional audit.

Your side

• You may only scan applications you own or have written permission to test. Proving control of the domain is required before any check runs.
• Access you grant (a repository token or installation, a read-only database role) must be read-only. LeakScan never asks for write access.
• You are responsible for acting on the report. Fix prompts are suggestions written for your builder; review what they change before you deploy.

The Full Scan

The Full Scan is a one-off purchase that includes one scan, the report, and one rescan within 14 days of the first report. Prices are shown at checkout and charged by Paddle, our merchant of record, which also handles sales tax and VAT. If a scan cannot run for a reason on our side, we rerun it or refund it.

What we do not promise

No scanner finds everything. A clean report means the checks we run found nothing; it does not mean the application is secure. To the extent the law allows, LeakScan is not liable for losses arising from issues a scan did not find or from changes you make after reading a report.

Changes and contact

We may update these terms; the date at the top changes when we do. Questions go to the address on the landing page.