Privacy and security model

Last updated: October 20, 2026

Nothing leaves your server by default. Page bodies are never stored; only findings, capped snippets, selectors and counts are.
Free makes no outbound call except Joomla's update check.
Pro adds the licence check and any alert channel you configure. Each is off by default.
The crawler is same-origin only and refuses private, loopback, link-local and carrier-grade NAT addresses, re-checking every redirect.
Every administrator action needs Joomla's token and an explicit permission. Output is escaped and queries use the query builder.
The install script makes no network calls.