Legal
ScanMyApp-Bot
Last updated: 3 October 2026
If you saw ScanMyApp-Bot in your logs, someone submitted your URL for a free security scan. Here is exactly what it does.
What it does
- Loads your public pages and the JavaScript files they reference.
- Reads your HTTP security headers and HTTPS certificate.
- Checks whether a few well-known sensitive paths are publicly reachable (such as
/.envor/.git/).
What it never does
- No login attempts, no form submissions, no injections, no brute force.
- No writing, uploading or deleting anything.
- No reading of your database or private data.
- A handful of requests per scan, with a strict time limit.
Contact
If you think the bot is misbehaving, or you want your domain excluded, email security@scanmyapp.dev with your domain name.