hackymacky

Policy

Terms of Service

Effective 10 September 2026

Use the scanner on URLs you are allowed to check. Preview is public HTML and JS. Deep scan waits until you prove the domain is yours.

  1. 01

    The service

    hackymacky (hackymacky.vercel.app) is an opt-in security scanner for public Vercel + Supabase-style apps. These terms are between you and the operator of hackymacky, an individual in Hungary. There is no separate company name on this product.

  2. 02

    Preview scans

    Anyone can paste a public URL. We fetch HTML and JavaScript that URL already serves to the world, look for secret shapes, and may probe a detected public Supabase anon key for permission signals. Preview does not require an account. You should only submit URLs you are allowed to have fetched this way. Do not use preview as a general attack proxy or to target systems you do not own.

  3. 03

    Domain claim and deep scans

    A full report needs an account (email magic link) and proof you control the hostname: DNS TXT hackymacky-verify=<token> or /.well-known/security-scan.txt. Verification kicks off a deep scan. You can rescan later, subject to rate limits.

    Deep scan is still a public-asset scan plus anon-key permission probes. It is not a pentest, not authenticated as you, and not a guarantee we will find every leak.

  4. 04

    Fair use

    • Rate limits apply. Do not try to bypass them.
    • We block fetches to private, loopback, and metadata addresses. Do not try to point us at internal networks.
    • Do not use the service to harm others, scrape at scale, or launder someone else's secrets into our logs.
    • We may refuse, rate-limit, or drop scans that look abusive, and we may close accounts that break these terms.

  5. 05

    Accounts

    Sign-in is a magic link to your email. Protect that inbox. You are responsible for projects added under your account. To close the account, email support@hackymacky.vercel.app. There is no in-app delete yet.

  6. 06

    Billing

    Paid plans, when offered, are charged through Stripe. You see the amount on Stripe Checkout before you pay. We store Stripe customer and subscription IDs, not card numbers. Extra project add-ons, if you buy them, bill through Stripe as well. Manage or cancel in the Stripe customer portal where we provide it. Taxes may apply. We do not hide a live pricing page in the product today; if checkout is available, the price is the one Stripe shows you.

  7. 07

    No security guarantee

    A green score is not a clean bill of health. We scan public HTML/JS and a handful of anon-key probes. We miss things. You still need your own reviews, RLS, and key hygiene. Findings are informational. Rotate anything that looks exposed.

  8. 08

    Liability

    The service is provided as-is. To the extent Hungarian and EU law allow, we are not liable for lost profits, leaked secrets we did not cause, or indirect damage. If we are liable anyway, that liability is limited to the amount you paid us in the three months before the claim (or €50 if you paid nothing).

    If you are a consumer in the EU, nothing here takes away mandatory rights you cannot waive.

  9. 09

    Governing law

    These terms are governed by the laws of Hungary, without picking a conflict-of-law rule that would apply another country's law. Courts in Hungary have jurisdiction, except that EU consumers may also bring claims in their country of residence where the law says they can.

  10. 10

    Privacy, cookies, contact

    How we handle scan data is in the Privacy Policy. Cookies and analytics are in the Cookie Policy. Questions: support@hackymacky.vercel.app.