Data

A scan stores the URL with the query string removed, the findings, and the timestamps. The email you enter is stored so the summary can be sent. A hash of a secret is stored so a later scan can tell whether the same issue is still there.

We never store user rows or full secrets. A readable table is recorded as the table name, the column names, a row count of “≥1 row” when the limit-1 request returned a row, and at most one example row with every value masked. A leaked secret is recorded as a prefix and a suffix, plus the file or URL and line where it was found. Environment-file bodies and source maps are not kept.

Scan data is deleted after 30 days. The scheduled maintenance job deletes scans that are not still running, using the finish time when there is one and the start time otherwise. Findings, share links, and Proof Report unlocks for that scan are removed with it. Apps, accounts, and the free-scan allowance record are kept.

The longer notice is on the privacy page. Questions: support@getleakwatch.online.