Scan only apps you own
You may submit an app for scanning only if you own it or have explicit, documented authorization from the owner to test it. Scanning someone else’s app without permission can violate computer misuse laws (like the US CFAA and equivalents worldwide) — even a read-only scan. Don’t do it.
How Assay scans — detection only
Assay is deliberately restrained. It:
- fetches only what your app already serves to any browser;
- makes read-only, bounded requests — no exploitation, no writes, no attempts to extract your users’ data;
- redacts secret values and never stores a row of user data;
- blocks internal, private, and cloud-metadata addresses (SSRF protection) and re-checks every redirect;
- rate-limits and meters scans to prevent abuse.
See the Privacy Policy for what we keep.
What’s prohibited
- Scanning apps you don’t own or aren’t authorized to test.
- Using Assay to attack, exploit, overload, or gain unauthorized access to any system.
- Circumventing rate limits, quotas, or ownership expectations, or scripting the service for bulk/abusive use.
- Using results to harm a third party, or reselling scans of others’ apps.
- Interfering with Assay’s own security or infrastructure.
Reporting a vulnerability in Assay
Found a security issue in Assay itself? Tell us first at security@assay.dev, with enough detail to reproduce it. We welcome good-faith research and won’t pursue legal action against researchers who:
- test only against their own Assay account and data;
- avoid privacy violations, data destruction, and service disruption;
- give us reasonable time to fix the issue before disclosing it publicly.
Please don’t access other users’ data or run automated scanners against our infrastructure as part of your testing.
Enforcement
We may rate-limit, suspend, or terminate accounts that break this policy, and report unlawful activity to the appropriate authorities.