Free live-site check · how it works
What the check does, and what it never does.
The free check looks at a public website from the outside, the way a browser does, and tells the person who ran it what anyone could already see. It is not a code scan, an audit, a penetration test or legal advice.
The requests it makes
- Your home page
- One plain GET of https://<your site>/, with no cookies, the way a first-time visitor arrives. We read the response headers and any cookies it sets.
- The scripts it loads
- Up to 12 JavaScript files the page references, 4 MB in total, read as text. Nothing is executed.
- A fixed list of well-known paths
- /.env, /.env.local, /.env.production, /.git/config, /.git/HEAD, /.aws/credentials, /backup.zip, /config.json, /.DS_Store, /.vscode/settings.json, /server-status and /.well-known/security.txt. One GET each. A path only counts as exposed when the response actually looks like that file.
- Public data your scripts already use
- If your scripts contain a Supabase address and anon key, we ask the public API which tables exist and request at most one row from up to 10 of them, the same request any visitor can make from the browser console. If they contain a Firebase config, we make one read request each to the Realtime Database, Firestore and Storage. We record only whether data came back, never the data.
- API paths your scripts call
- Up to 8 same-site GET paths that your JavaScript calls and that look like user data (users, customers, orders and so on), with no cookie and no login. If your site uses /graphql, one read-only introspection query.
At most 48 requests per check, one at a time with a pause between them, 6 seconds per request and 25 seconds in total, 2 MB per response. A domain is checked fresh at most once a day, whoever asks; repeat requests get the stored result.
What it never does
- Log in, submit forms, or send anything that writes data.
- Use, test or store any key or password we find. A matched value is never stored or shown: only which kind of key it is and where.
- Crawl beyond the home page, its scripts, the fixed path list and the API paths above.
- Scan ports, guess passwords, fuzz inputs, or retry aggressively.
- Keep page contents or response bodies. We store the host, the score, finding ids and counts, the three shown findings and timestamps, then delete them after 30 days.
How to recognise it
Every request carries the User-Agent SentinelLiveCheck/1.0 (+https://sentinel-rho-nine.vercel.app/check/about). We follow your robots.txt for the scripts and API paths we read. The fixed path list above is one request each and is checked whatever robots.txt says, because those files should never be public in the first place.
We refuse addresses that resolve to private or internal networks, government and military domains, large platforms and banks.
Opt out
If you run a site and do not want it checked, publish a file at /.well-known/sentinel-no-check (any content, served as plain text). The check looks for it right after loading your home page and stops there. Or email team@gigahertzcompany.com with the domain and we will add it to the refused list.