Security
Found something?Tell us here
ScanlyFix is a scanner, so a flaw in it is a flaw in a tool that touches other people's websites. This page says what we want reported, how to report it, what we promise in return, and what we ask you not to do.
- In force 28 August 2026
- 8 clauses
- Urgent reports answered same-day
- security.txt reviewed 2027-04-14
- No bounty, no legal action for good faith
What we want to hear about
Anything that lets one user read another user’s data, reach the scanner’s own credentials, or run a scan they have not paid for. In particular:
| scanlyfix.com | The web app, its API routes, and the authenticated console. |
|---|---|
| /api/v1 | The public REST API and its bearer-token authentication, including any way to use a key that is not your own. |
| the scanner engine | The thing that fetches a URL someone typed. It is meant to refuse private and link-local addresses, follow no redirect into one, issue only GET requests, and stay inside a fixed probe budget — a way past any of those is a real finding, not a theoretical one. |
| the deep checks | Injection, JWT-forgery and upload probing run only against a domain the account has proved it owns. Bypassing that proof means pointing the engine at a stranger, which is the worst outcome this product can have. |
| this site | The marketing pages, the auth flow, and the payment integration. |
What is out of scope
We will read anything you send, but these do not earn a fix and we ask you not to spend time on them:
| Denial of service | Load tests, flooding, and anything whose point is availability by volume. |
|---|---|
| Social engineering | Phishing a person who works here. There is one of us; do not test them. |
| Third-party processors | Razorpay, Supabase, Resend, Inngest and Google. Report to them; tell us if you think we have misconfigured one. |
| Missing headers with no effect | A header this site does not send, where you cannot show what it would have prevented. |
| Reports with no reproduction | A scanner output or a CVSS score, with no steps and no evidence. |
How to send a report
Email scanlyfix@scanlyfix.com. It is the same address the privacy and terms pages use, and it is what /.well-known/security.txt advertises, so there is no second inbox to fall out of step with this one.
Write in English or Hindi. Please include what you did, what happened, the URL or request that reproduces it, and whether you have told anyone else. Encrypted mail is welcome; we do not publish a key yet, so if you want one, ask and we will set one up before you send details.
Do not open an issue on the public repository, and do not post it. A finding that is public before it is fixed is a finding other people can use.
What happens next
One person reads this inbox, which is why the clocks below are the ones the contact page already promises rather than a shorter list we could miss.
| Same day | First reply to anything urgent — a live exposure of other users’ data, or the scanner reachable in a way it should not be. |
|---|---|
| 3 business days | First reply to everything else. |
| On request | Whether the report was valid, and roughly when a fix ships. We will not keep you guessing for months. |
| After the fix | Public disclosure is yours to time, once the patched version has been live for a fortnight or you have our go-ahead, whichever is sooner. |
Our promise to you
A report made in good faith under this policy will not be met with legal action, a complaint to your employer or your ISP, or an account ban. That covers research that touched data you were not meant to see, as long as you stopped when you realised and did not keep a copy.
This is a commitment, not a contract, and it is not a licence: it does not extend to anything that damaged someone else, that used another person’s data after you found it, or that you sold or published before a fix existed.
ScanlyFix is operated by the individual operating ScanlyFix, and disputes are governed by the law named on the terms page.
What we ask of you
Four rules, and a report that follows them gets fixed rather than argued with:
| Test only your own account | Never another user’s data, and never a site you do not own. |
|---|---|
| Stop at the proof | Enough to demonstrate it. Do not exfiltrate, do not delete, do not persist. |
| No scanning strangers | Do not use this product, or a flaw in it, against a domain you have not verified. That is the line this whole service is built around. |
| Tell us first | Give us the chance to fix it before anyone else hears about it. |
Bounty, and credit
There is no bug bounty. This is a one-person service and there is no budget to promise one, so we would rather say that now than have you find out after the work is done. If you want your name or handle on a public acknowledgments list when we start one, say so in the report; we will ask before publishing anything that identifies you.
The machine-readable copy
This page is what the Policy: field of /.well-known/security.txt points at, so a tool that finds that file lands here.
That file carries an Expires: of 2027-04-14, which is this policy’s review date. RFC 9116 tells a reader to treat an expired file as unusable, so the date moves forward only when the address behind it has been checked and is still watched. This product’s own scanner reports a site whose file has lapsed — including this one.
A report
for us?
Write to scanlyfix@scanlyfix.com with what you did, what happened, and how to reproduce it. Please do not open a public issue.
ScanlyFix
Security, SEO and AI-answer-engine scanning for anything you put on the internet. Paste a URL, read the evidence, run the fix.
Home