No account access
No OAuth, no API keys, no app install. We never hold a credential for your store or your Google account.
Security & data
The safest diagnostic is one that cannot break anything.
Read-only is not a promise in a document. It is the absence of a write path in the code.
What the product does not have
No write path
There is no code in the product that can modify a store. Not disabled — absent.
No credentials in URLs
A URL containing a username or password is rejected before any request is made.
How the page fetcher is constrained
Public addresses only
Localhost, private, link-local, multicast and documentation address ranges are refused. DNS answers are checked and the request is pinned to the verified address.
Redirects re-checked
Every redirect is validated again against the same rules, so a redirect cannot walk the request into a private network.
Bounded work
Timeouts, a maximum response size and a redirect limit. A page cannot hold the scanner open indefinitely.
Certificates verified
Certificate verification is never disabled. Where a system trust store is needed, the system tool is used — with verification intact.
Being a polite visitor
The scan fetches pages from real stores, so it can become a burden if it is careless. A store never receives two of our requests at once, and there is at least a one-second pause between them — redirects count as requests. No store is ever slowed down by the pause we apply to a different store; within a single scan we run at most three requests at a time, and whichever is next starts immediately. There is, however, a ceiling on how many scans run at once across the whole system; when it is full a scan is refused outright rather than queued — and that refusal is never written into your report as a finding, because our being busy says nothing about your products. We did not pick that second ourselves: it is the fastest pause stores grant in writing to the crawlers named in their own robots.txt.
We learned this from the receiving end: during our own research a store started refusing us with a rate limit, and for a moment our tool reported that as the page is unreachable. It was not. We were the problem. The tool now says so instead of blaming the store.
Limits on the way in, too. The free scan is rate limited per visitor, so the tool cannot be pointed at someone else's store as a way to load it. When a limit is hit we say when to try again — and we never write your address to a log in the clear.