You saw our scanner in your logs.

Here's exactly what it did, and didn't do.

Who we are: Left Unlocked is a free security check for web apps. Someone who told us they own or are authorized to test your site ran a one-time scan of its public pages.

User-Agent: LeftUnlockedScanner/0.1 (+https://leftunlocked.com/bot; security self-scan)

What it does: a handful of read-only GET requests — your homepage, your own first-party scripts, and a few well-known paths like /.env and /.git/HEAD to confirm they are not exposed. It reads response headers and the TLS certificate. If your app uses Supabase, it asks for a row count only (no rows are read or stored) to confirm Row Level Security is on.

What it never does: no writes, no logins, no password guessing, no form submissions, no reading of user records, no crawling beyond the homepage and its scripts. Requests are capped in number, size (2 MB), and time (8 s), and every scan is rate-limited.

To block it: deny the user agent LeftUnlockedScanner at your firewall, CDN, or WAF. It does not retry.

To see what it found on your own app: run a free scan — the report is written in plain English, with a fix for each finding.