DevMethBot — how we scan live apps
DevMeth checks AI-built apps for common security and production-readiness mistakes. When someone asks us to scan their live URL, our bot sends a small number of read-only requests to that app. This page explains exactly what that means.
What we do
- Send only GET, HEAD, and OPTIONS requests — enforced in our code, not just policy.
- Cap ourselves at 25 requests per hostname per scan, with a 15-second timeout each and at most 3 redirects.
- Identify honestly: our User-Agent is
DevMethBot/1.0, and this page is linked from every request we send. - Wait at least an hour between scans of the same host, and require the scan requester to confirm by email before any request is sent.
What we never do
- No write attempts. No POST/PUT/PATCH/DELETE, no form submissions, no database writes — ever.
- No attack payloads. No SQL injection strings, XSS probes, or path traversal attempts.
- No authentication attempts. We never try logins or send credentials, cookies, or authorization headers.
- No aggressive retrying. If your WAF or host blocks us, we mark those checks as skipped and move on.
What we look at
Served pages and scripts (for accidentally-shipped secrets), common misconfiguration paths (exposed .git, debug endpoints), transport hygiene (HTTPS, HSTS), and whether public data APIs (e.g. Supabase, Firebase) allow anonymous reads. Findings go only to the person who requested the scan.
Opt out
Don't want us scanning your host, ever? Contact us at nick@devmeth.com with the hostname. We add it to our blocklist — no scan of that host will run — and removal is processed within 24 hours.
Contact
Questions or concerns about a request you saw from us? Email nick@devmeth.com with the timestamp and hostname and we'll trace it in our audit log.