Meet the scanner.
It only reads.
StackSnack runs read-only security checks on websites whose owners have confirmed permission. This page explains what it requests, how to recognize it, and what to do if your firewall stops it.
How to recognize it
Every web request from the scanner uses this user agent:
StackSnackScanner/1.0 (+https://stacksnack.io/scanner; read-only security checks)
Anyone can copy a user agent, so treat it as a label, not as proof that a request came from us.
What a scan requests
The catalog contains 178 distinct check types: 130 public, 25 additional verified-website, 22 backend and 1 two-account check. The backend total includes 8 optional Supabase settings checks that require an owner-provided catalog export. These are conditional checks, not a fixed number performed on every site. Reports show actual coverage.
A surface scan requests the page you entered, up to 40 public scripts, 6 additional same-origin pages, 5 same-origin stylesheets and 5 source maps, and /.well-known/security.txt. It also sends one request with an untrusted Origin header to check cross-origin access, looks up your domain’s public mail records (SPF and DMARC) and reads your TLS certificate, including a bounded legacy-protocol handshake. Each scan has a 90-second limit.
After you verify the website, the scanner also tries up to 55 common sensitive file paths, such as environment files and database dumps. Verified website checks can also make anonymous GET requests to up to 20 literal API routes discovered in client code, send an MCP initialization handshake at three standard paths (never listing or calling tools), and check up to 30 unscoped registry dependency names from an exposed package.json. Returned personal field names may be recorded; their values are not retained. Supabase database access checks require a published ownership token; Firebase requires separate project approval. Access probes use your public client key, and the cross-user test signs in only with test accounts you provide. The separate Supabase settings review uses a read-only query you review and run in your SQL editor. It reads system-catalog flags, not table contents, and requires no database password or privileged key. Its eight configuration signals cover RLS, views, elevated functions and policy risks; the report identifies these as owner-provided signals that need confirmation.
Passive response analysis also reviews reserved cookie prefixes, explicit SameSite values, browser-policy restrictions on form destinations, embedded objects and framing, HSTS syntax, native password-form methods and runtime trace patterns in error responses. It does not submit forms or provoke errors. These findings retain no cookie values or stack-trace contents; ambiguous and incomplete inputs are not treated as passes.
External reference lookups
Recognized library names and versions are checked against OSV.dev advisory data. Software product names are sent to endoflife.date to check support status; scanned website URLs, code and detected versions are not sent to that service. Unscoped package names from an exposed manifest may be sent to the public npm registry to check existence; private registries and scoped packages are excluded. These reference services receive normal connection metadata.
What it never does
It does not submit forms, write to your database, try passwords, send attack payloads or sign in to your app except with test accounts you supply for the cross-user test.
Blocked by a firewall?
Bot protection from Cloudflare, Vercel and similar services can show the scanner a challenge page. When that happens, your report says so instead of showing a clean result. You have three options:
Scan a staging copy. A staging deployment without bot protection is the safest choice, because production protection stays on.
Allow the scanner briefly. In Cloudflare, add a WAF custom rule that skips bot protection when the user agent contains StackSnackScanner. In Vercel, add a firewall bypass rule for the same user agent, or pause challenge mode. Remove the rule after the scan, because anyone can send that user agent.
Accept partial coverage. If only some scripts are blocked, the report lists what could not be checked under coverage notes.
We do not publish fixed scanner IP addresses yet.
Report a problem
If the scanner caused trouble for a site, or you believe it scanned a site without permission, email support@stacksnack.io with the site address and the time. Please don’t include passwords or keys.