Terms of Service

Draft, last updated Oct 14, 2026. Not legal advice; have counsel review before launch.

1. What LeakyVibes does

LeakyVibes performs an automated, passive review of a web address you submit. It makes the same kind of read-only requests a normal browser makes: the page, its JavaScript and CSS, a few well-known file paths (like /.env), and up to a few same-site links. It does not log in, guess passwords, attempt to bypass authentication, send data to forms or APIs, or exploit anything.

2. Your authorization

You may only scan apps you own or have written permission to test. By submitting a URL you confirm this. Deeper database checks require technical proof of domain control (DNS TXT record or a file on the site).

3. Acceptable use

No scanning of third parties, no automation against our service beyond the published rate limits, no attempts to use LeakyVibes to attack anyone. We may block URLs, IPs or accounts at our discretion and honor opt-out requests from site owners.

4. Data handling

Any secret we find is shown masked (first/last 4 characters) and never stored in full. Fetched page content is discarded after the scan. Deep checks record only whether data was returned, never the data itself. Reports are kept for 30 days.

5. Paid services

The $29 Full Report is delivered instantly. Fix-it-for-you ($99/$199) involves us opening a pull request on a repository you grant access to; you review and merge it. If we can't deliver, you get a full refund within 14 days of purchase.

6. No guarantee

A good score does not mean your app is secure. The scan covers common, externally visible issues only. Service is provided "as is", and our liability is limited to the amount you paid.

7. Contact

security@leakyvibes (placeholder; set up before launch)