TEMPLATE — Erez: have this reviewed before launch. This is not legal advice.

Terms & scan policy

What the free scan does

• Loads your public homepage, its JavaScript files, robots.txt, sitemap.xml and the links on the homepage — the same files any visitor's browser loads.
• Reads HTTP response headers and looks for known secret-key patterns in public JavaScript. Found keys are shown masked and never stored.
• If a Supabase project URL and public (anon) key are present in your public code, it asks Supabase for the list of exposed tables and a row count per table using HTTP HEAD. It never downloads row data, never writes, and never tries to log in.

What it never does

• No password guessing, fuzzing, form submission, port scanning or load testing.
• No scanning of private or internal network addresses.
• Rate limited per visitor. Only scan apps you own or are authorized to test.

Services

• Prices are fixed and shown before payment. Extra scope is quoted in writing first.
• Scans, audits and fixes reduce risk; they are not a guarantee of security or legal/regulatory compliance.
• You keep ownership of your code. Access is by invitation and you may revoke it anytime.
• Care plans renew monthly and can be cancelled anytime via the Lemon Squeezy customer portal.
• Refunds: if a fixed-price job can't be delivered and no work was accepted, you are refunded.

Contact: hello@aiappmedic.com