Security & responsible disclosure

How the free scan behaves

The public URL scan is read-only. It requests the same HTML, JavaScript, headers, and well-known paths that any visitor's browser would, plus public DNS lookups (SPF/DMARC). It does not log in, submit forms, upload files, modify data, or send exploit payloads.

Connected (deep) scans

Not built yet. Deeper checks, live database schema and RLS, repository analysis, will only ever run against apps you explicitly connect, and we’d rather say that plainly than describe safeguards for a feature that isn’t running. When it ships, connections will be least-privilege, read-only and revocable, with an audit log of every scan. Today the only thing you can run is the external scan described above, and the repository scanner, which runs on your own machine or in your CI and sends us nothing.

Scanning apps you don't own

If Flare.ai surfaces a real exposure on an app that isn’t yours, we disclose it to the developer before anything is published. The only thing published anywhere is the category of a finding, on the homepage feed never a name, a URL, or any evidence.

Acceptable use

Scan apps you own or are authorised to test. The checks are read-only and only touch endpoints that are already public, but permission is about intent, not just impact.

The scan is deliberately low-impact: one page fetch, its JavaScript, and a bounded set of small requests, all with timeouts. It is not a load test and must not be used as one. Specifically, don’t:

• Scan the same target repeatedly to generate traffic against it, or spread scans across addresses to work around the rate limit.
• Use Flare.ai for reconnaissance against infrastructure you have no relationship with, including financial, government, healthcare and critical-infrastructure systems.
• Automate the public endpoint to enumerate hosts you don’t own.

Requests are rate limited per network and globally. To do that we keep a short-lived counter keyed to a one-way hash of your network address, not the address itself, and not the sites you scanned. Anonymous scans are not otherwise recorded. Where a scan appears aimed at systems the caller plainly has no relationship with, we will refuse it and, if warranted, notify the operator of the targeted system.

What we keep, and for how long

• Anonymous scans aren’t stored. The report is generated, returned, and gone, reloading re-runs the scan.
• Signed-in scans are kept against your account so you have history and can confirm fixes. Deleting a scan removes the record and its findings.
• Shared reports are only reachable by others if you explicitly publish them, and can be unpublished at any time.
• We never store your source code, your database rows, or the full value of any credential we detect, only a redacted fragment sufficient to identify it.

If a scan of your app exists and you want it removed, email security@flare.ai from a domain-verifiable address and we’ll delete it. You don’t need an account to ask.

Reporting a vulnerability in Flare.ai

Found a security issue in Flare.ai itself? Email security@flare.ai with steps to reproduce. We aim to acknowledge within 48 hours, keep you updated, and credit you once it's resolved. Please don't access other users' data or degrade the service while testing.