Securealy
Security

Scanner policy, opt-out, and how to report a vulnerability

The grader does what a visitor's browser does and nothing more until the site owner proves control. This page is the exact list.

What the passive grade requests

On a domain nobody has verified, one grade makes at most 25 HTTP requests and follows at most 3 redirects. Every request carries the User-Agent SecurealyGrader/1.0 (+https://securealy.com/grader). The requests are:

  1. The home page over https, and the http version once to read the redirect.
  2. The first-party stylesheets, scripts and images the home page references, so we can read the bundle for credential-shaped strings and measure weight. Third-party assets are not fetched.
  3. /robots.txt, /sitemap.xml (or the sitemap robots.txt names), /llms.txt, /.well-known/security.txt, and the favicon.
  4. A sample of up to five URLs from the sitemap, HEAD only, to confirm they return 200.
  5. One random path seeded from the host name, to see whether a missing page returns 404.
  6. A HEAD request on the Open Graph image.
  7. One request to the Supabase REST root with the anon key the page itself ships, reading metadata only, when the page references one. This is a request the page makes on its own.
  8. DNS lookups: A, AAAA, NS, MX, CAA, TXT at the apex, _dmarc, and DKIM at the selectors resend, google, default, k1, selector1 and s1; DS and RRSIG for DNSSEC. An RDAP query for the registration expiry.
  9. A TLS handshake to read the certificate, its chain and the protocol version.

What the passive grade never does

  • No port scans.
  • No requests for /.env, /.git, backups or any path meant to be private. Those checks exist, and they run only after verification.
  • No credential guessing, no login attempts, no rate-limit probes, no fuzzing.
  • No row reads with a found key. The one database request reads metadata only.
  • No more than 25 requests, no more than 3 redirects, no request bodies.
  • No JavaScript execution. We read the bundle as text.

What the verified grade adds

After the owner proves control with a DNS TXT record at _securealy, a securealy-verify meta tag or /.well-known/securealy.txt, the grade also requests the env file family and /.git/HEAD and /.git/config expecting 404, probes each admin and API route found in the sitemap and bundle anonymously once, performs one anonymous limit 1 count on each exposed database table and stores nothing from it, lists storage buckets, and sends ten requests to one endpoint to look for a 429. Local checks run through the CLI on the owner's machine with the owner's own keys and never send a secret anywhere.

Opting out

A site owner can stop passive grading of a host in either of two ways. We check both before any other request, and a cached grade of an opted-out host is removed.

  • A DNS TXT record at _securealy.your-domain.com with the value optout. Covers every subdomain beneath it.
  • A response header on the home page: X-Securealy: optout.

What we store

Verdicts, not bodies. A grade record holds the URL, the host, the time, the stack we detected, and for each check a status and one short line of evidence. Credential-shaped strings in evidence are redacted at the source to a prefix and an ellipsis; the full value is never written anywhere. We do not store page bodies, bundles, headers beyond the ones a check names, or responses. Anonymous grades are kept for thirty days. Grades on a verified project are kept as history for the life of the project.

Reporting a vulnerability

If you find a security problem in Securealy itself, email security@securealy.com. Include the URL or component, the steps to reproduce, and what you observed. You will get a human reply within two business days, a fix timeline once we have reproduced it, and credit here if you want it. Please do not run automated scanners against the grader's own API or test against other people's grades.

The machine-readable version is at /.well-known/security.txt.

Our own grade

Securealy is graded by Securealy on every deploy. The headers you receive from this page are the ones the checks require: HSTS with preload, a Content-Security-Policy with frame-ancestors 'none' and form-action limited to this site and the checkout provider, nosniff, a Referrer-Policy and a Permissions-Policy. Fonts are self-hosted. There are no third-party scripts on this page.