Terms of use

Authorized sites only

You may scan only websites you own or are explicitly authorized to test. Scheduled checks, deploy alerts and flow tests require proof of ownership by DNS TXT record or homepage meta tag.

Passive scans

Scans are passive: we fetch public pages, public JavaScript files and a few well-known paths (such as /.env and /.git/HEAD), as any browser could. We don't log in or exploit anything. Detected secrets are masked and never stored in full. Scans are rate-limited.

Flow tests

We replay steps you write (for example, a signup or test-mode checkout) in a headless browser against your verified app only. You are responsible for using test accounts and test-mode payment details.

Credits and billing

AppNightGuard is prepaid. Check packs (10 checks for $9, 50 checks for $29) are one-time payments through Stripe; nothing renews automatically. Each check uses 1 credit: a manual scan, a scheduled scan, or one flow test run. The anonymous scan on the homepage is free, and new accounts get 1 free check. If a scan fails because of an error on our side, its credit is returned. Scheduled scans stop when your balance reaches 0 and resume after you buy more. Credits don't expire while the service is offered and aren't redeemable for cash.

No guarantee

Results are informational and don't guarantee security.