Skip to content

Menu

sign inguides pricing

You saw our scanner in your logs.

Here's exactly what it did, and didn't do.

Who we are: Left Unlocked is a free security check for web apps, built and run by Nadav Shinhorn. Someone who told us they own or are authorized to test your site ran a one-time scan of its public pages.

User-Agent: LeftUnlockedScanner/0.1 (+https://leftunlocked.com/bot; security self-scan)

What it does: a handful of read-only GET requests: the page you give it and up to ten more of your own pages linked from it, your own first-party scripts (the chunks they load included), and a few well-known paths like /.env and /.git/HEAD to confirm they are not exposed. It reads response headers and the TLS certificate. If your app uses Supabase, it asks for a row count only (no rows are read or stored) to confirm Row Level Security is on.

What it never does: no writes, no logins, no password guessing, no form submissions, no reading of user records, no crawling beyond a few of your own pages and their scripts. Requests are capped in number, size (2 MB each), and time (a deadline on each request, 75 s for the whole scan), and every scan is rate-limited.

To block it: deny the user agent LeftUnlockedScanner at your firewall, CDN, or WAF. It does not retry.

To see what it found on your own app: run a free scan. The report is written in plain English; Pro shows the fix for each finding.

Privacy · Terms · Accessibility