What this scanner does

VibeFortify does not crawl the web. A person submits one URL, and the server fetches that page the way a browser would.

Identity

Every request uses this User-Agent:

VibeFortifyScanner/0.1 (+https://vibefortify.com/bot)

What is fetched

One GET of the URL you submit, following at most 5 redirects, then up to 5 same-origin JavaScript files linked from the page. Each response is capped (about 1 MB for the page, 500 KB for a script) and each request times out around 10 seconds. The whole scan gives up after about 22 seconds.

It does not log in, submit forms, send cookies, or run the page in a browser. It does not query Supabase tables, even when it sees a project URL and an anon key. It only reports that you should confirm Row Level Security yourself.

Addresses it will not touch

Only http and https, on ports 80 and 443. After DNS resolution it refuses loopback, private, link-local, and cloud-metadata ranges on IPv4 and IPv6, and it checks again after every redirect. It connects to the address it just checked so a DNS change mid-scan cannot steer it at an internal host.

What is stored

A report is kept in memory for about an hour and then discarded. Secret values are masked before they are shown or stored (first 4 and last 4 characters). Raw secrets are not written to logs.

Limits

5 scans per hour for each client address, and only a few scans run at once. If you did not submit your URL, this scanner is not visiting you on its own.