Policy
What we check
Whether your app's database can be read by anyone who has the key your app already ships to every visitor. Whether a key that should never leave a server ended up in your public code anyway. Whether your repo — current files or old history — has a secret sitting in it, when you give us a public git URL. Private repos are skipped; we don't collect git credentials. Whether basic files (.env, .git) are reachable from outside. Blank git or test-login fields mean those passes are skipped on purpose.
What we never do
We establish that a door is open. We never walk through it. If a database is readable, we count rows — we never read one. We never download, keep, or look at your actual data or your users' data. A test-login password is encrypted at rest, used only for the check, and deleted afterwards. It is never logged and never put on a customer-facing report.
If we find something serious
We contact you privately first. Always. You get 30 days to fix it, longer if you're actively working on it and tell us so. We never publish the exploit path, the exact request, or anything a stranger could use to reproduce it. Private findings stay in admin review — they are not a public document.
What gets published
A public page is a human write-up, not the findings packet. A clean pass can carry a Bananafest Destiny approved badge. If the serious-fix window runs out and the issue is still open, we may publish that the owner was notified on a given date and that the issue remains open — never the class of bug, never how to find it. We do not quietly pretend every check was a success.
Who's doing this
One person, by hand, right now. Automated checks feed a private packet; a person writes what the public sees. If you submit your app, a person looks at it — that's slower than unattended scanning, and it's the whole point.