Privacy

When you check a website or repo, the address, the grade, the issues found and the technical details are stored and shown publicly at the report’s link, and recent checks appear on the home page. Don’t check anything you need to keep private. Checks of private repos are not possible: only public GitHub repos can be read.

We store a salted hash of your IP address with each check, never the address itself, to limit how many checks one visitor can run in an hour. Checks run from the website are deleted after 90 days.

When you tag the agent on X, it reads your public post (and the post you replied to, if it holds the link), stores the post’s id, your public handle and the link it found, and replies in public with the result. A hash of your X account id limits how often one account can ask.

If a repo check finds a key or token committed to a public repo, the report shows only its first few characters, its length and where it is. The full value is never stored or shown.

Connecting a wallet shares its public address with the page. SECURE never asks for or sees a seed phrase or private key.

Only the admin sign-in uses a cookie. Visitors get none.

Supabase (database), Vercel (website hosting), Render (the agents), GitHub and OSV.dev (public repo and vulnerability data), OpenRouter (routes the AI that writes the summaries and research, including the Lab’s models from Anthropic, OpenAI, Google, xAI, DeepSeek and Mistral: they receive a check’s findings or public advisories, never your IP), X (the bot) and a Solana RPC provider (chain reads for the coin). Each handles requests under its own privacy policy.

Questions, or a request to remove a check of your site: SECURE's X account.