Responsible use
Deploy Safely is a public-surface check for people who built an app, or who have permission to test one. It is not a hacking tool.
What a check does
- Opens the page and the JavaScript files that page already loads.
- Looks for secret keys with a fixed set of patterns, and masks whatever it finds.
- Requests a short list of well-known paths, such as /.env and /.git/config. It does not guess other paths.
- If a Supabase public key is already in the page, asks the public API for one row per listed table and then discards the row. A service role key is reported and never used.
- If a Firebase config is present, tries one signed-out read and does not save the data.
- Reads the security headers on the main response.
What a check does not do
No password guessing. No fuzzing. No exploit payloads. No use of a discovered secret. Requests time out, stay small, and stop after a short budget. Private network addresses and cloud metadata addresses are blocked on the public checker.
Ownership
The free check is one look at the public surface. Daily checks, deploy hooks, and saved apps require you to place a meta tag or a verification file on the site first.