RowLocked scanner bot

When you run a free Tier A scan, our checker fetches your public site the way a browser would. It identifies itself with this User-Agent:

RowLocked-Scanner/1.0 (+https://rowlocked.com/bot; contact: via https://rowlocked.com/contact)

What it does

• HTTPS and response timing
• Common security headers
• Public paths like /.env, /.git/HEAD, /admin (status + classification only)
• Secret-shaped strings in JS bundles (masked in reports)
• Supabase anon-key RLS readability via count-only requests
• Firebase public-read shallow checks when config is present

What it does not do

• No password guessing or login attempts
• No exploit payloads or port scans
• No storage of full secrets or database rows
• No scanning of localhost, private IPs, or cloud metadata endpoints

Limits

About 30 HTTP requests and 2MB of JS per scan. Rate limit: 10 scans per IP per hour.

Permission

Only scan sites you own or have permission to test. See our Terms.