What the service is, what you promise, and what nobody guarantees.
These are the terms for using Left Unlocked, the scanner at leftunlocked.com and the monitoring behind it. Last updated 6 September 2026. Using the site means you agree to them.
What the service is
A free, read-only security scan of a web app's public pages, and, for signed-in users, monitoring: repeated scans, uptime checks, code checks on a connected repository, alerts, and fix pull requests.
Monitoring is in early access. Features can change or be withdrawn, and nothing is charged until we tell you a price and you agree to it.
What you promise
You only scan apps you own or have permission to test, and you connect only repositories you are allowed to share. Every scan is your responsibility.
You do not use the service to probe anyone else's systems, to get around its limits, or to harm the service itself.
We may refuse or block scans, addresses, and accounts that break these rules, without notice when it is urgent.
What the scanner does and does not do
It sends read-only requests: your public pages, your own scripts, a few well-known paths, a row count from Supabase, section names from Firebase. It never writes, never signs in, never guesses passwords, never reads your users' records. The details are on the scanner bot page.
A fix pull request is a proposal. You review it, and you decide whether to merge it. What runs on your app after a merge is your call and your responsibility.
No guarantees
A report is a snapshot of what the scanner could see at that moment. It can miss things and it can be wrong. A good grade is not a promise that an app is secure, and the service is not a substitute for a professional security review.
The service is provided as it is, without warranties of any kind, to the extent the law allows.
To the extent the law allows, Left Unlocked is not liable for losses that come from using the service, from acting on a report, or from merging a pull request. Where liability cannot be excluded, it is limited to what you paid us in the twelve months before the claim, which for a free service is nothing.
Accounts
You can stop at any time: remove your apps, unlink your repositories, uninstall the GitHub App, sign out. Email us to delete the account itself.
We can suspend or close an account that breaks these terms.
Changes and contact
When these terms change, the date at the top changes with it. Keeping on using the service after a change means you accept it.