Security checks and limits

Public checks

The first check reads public pages and scripts for exposed credential patterns and configuration observations. A matching pattern does not prove that a credential is valid or that an account was compromised.

Ownership before active tests

Active checks require sign-in and ownership proof for the exact app host. They use the dedicated test accounts and synthetic records you provide. Verification and access permissions are checked again during execution.

Use test accounts and records created for this purpose. Do not supply customer accounts or production data.

Private evidence

Finding locations, evidence and fix prompts require an authorized signed-in account and verified ownership. Public previews show summary information. Detected secrets are masked; full secret values are not included in findings.

Saved test tokens are encrypted. Removing a saved token from a23y does not revoke it in your app; revoke it with the service that issued it when needed.

Checks have limits

Checks cover the pages, sources and test boundaries recorded in the result. They do not cover every route, role or possible attack. A failed or incomplete recheck does not prove that a finding was fixed. Fixes are confirmed only when the relevant sources are inspected successfully.

a23y does not edit your app or test records, create charges or certify legal compliance. Broader audits and features marked planned are not included.

Report a problem

For a suspected issue in a23y, email info@hidedata.app with a short description and reproduction steps. Do not include credentials, customer records or private finding exports in the first message.