How Unspill works

A passive scan: we look only at what your site already serves to every visitor, the same way an attacker would start.

What a scan requests

• Your page (following up to 4 redirects, including http → https).
• Up to about 14 JavaScript files referenced by the page or its main bundle (3 MB cap each).
• Up to 3 source map (.map) URLs, if referenced or guessable next to a bundle.
• /.env and /.git/config at your site root (64 KB cap).
• One OPTIONS (CORS preflight) request to one API path found in your bundle, or /api.

Hard limits per scan: about 22 requests, 14 MB, 24 seconds. Each request has its own timeout. The scanner identifies itself with the User-Agent UnspillScanner/0.1.

What we never do

• Query your Supabase/Firebase database, storage or RPC functions, even with your public key.
• Use, test or validate any key we find.
• Log in, submit forms, or send anything except GET and one OPTIONS request.
• Store scan reports or secrets. Secrets are masked inside the scanner (first characters + last 4), before the report is sent to your browser.
• Scan private networks: targets that resolve to private, loopback, link-local or reserved IP addresses are refused, checked again at connection time; only ports 80/443 are allowed.

Scoring

Start at 100. Critical findings cost 45 points and cap the score at 25 (F); high findings cost 20 and cap it at 59; medium 8; "verify" items 4; low 3; info 0. Grades: A ≥ 90, B ≥ 75, C ≥ 60, D ≥ 40, F below.

What a passive scan can't see

• Whether Row Level Security / Security Rules are correct (we tell you how to check).
• Server-side code, auth logic, and whether user A can read user B's data.
• Secrets in code that isn't shipped to the browser, or JavaScript loaded only after login.
• Dependency vulnerabilities and business-logic bugs.

A clean report is not a guarantee. These gaps are what the deep audit will cover.

Responsible use

Only scan apps you own or are authorized to test; you must confirm this before every scan. Scans are rate-limited per network and per target site. To report abuse, or to ask us not to scan your site, contact the site operator via the waitlist form with the note "abuse".