Methodology
What we check, and what we do not
DeployVet is an outside-in check. It looks only at what a stranger can reach on the public internet, using fixed, rule-based checks. This page explains the scope, the scoring and the limits.
Approach
- Outside-in. We request your public pages, scripts and well-known file paths. We do not log in, submit forms or change anything.
- Light touch. A limited number of requests per check, with a hard time budget. We read your
robots.txtand skip probing paths it disallows for our crawler. - Authorised use. Check only sites you own or have permission to check. Paid scans require proof of ownership with a DNS TXT record or a meta tag.
- Nothing sensitive is kept. If we find a key, we store only a masked form. If a database table is readable, we record its name and column names, not the rows.
What is checked
| Area | What we look at |
|---|---|
| Exposed secrets | Public JavaScript and public files, searched for keys and tokens that belong on a server (payment, AI and database service keys, private keys). |
| Open databases | Whether a public Supabase key allows anonymous reads of tables, and whether the table schema can be listed. |
| Exposed files and routes | Environment files, .git folders, backups, source maps, admin and API routes that answer without a login, and common CMS files. |
| Security headers | Content-Security-Policy, HSTS, framing protection, content-type sniffing protection, referrer policy and CORS settings. |
| HTTPS | Whether the site is served over HTTPS, redirects from HTTP, and loads files over plain HTTP (mixed content). |
| Links and basic SEO | Broken pages and links, and basic search-visibility items such as titles, descriptions, robots.txt and sitemaps. These count for much less in the score. |
Paid scans can also read a public GitHub repository and a Supabase project you point us to, read-only.
What is not checked
- Anything behind a login, including user accounts, roles and permissions inside the app.
- Business logic, payment flows and other behaviour that needs a human to test.
- Injection and cross-site scripting testing, fuzzing, brute force or any attempt to break in.
- Servers, networks, open ports, DNS configuration and cloud settings.
- Vulnerabilities in server-side code or dependencies that are not visible from the outside.
- Mobile apps, APIs that need credentials, and third-party services you use.
- Legal and compliance requirements such as GDPR, HIPAA, PCI or SOC 2, and accessibility.
How scores and grades work
Every check starts at 100 points. Each finding subtracts points by severity:
| Severity | Security findings | SEO findings |
|---|---|---|
| Critical | −40 | −10 |
| High | −20 | −8 |
| Medium | −12 | −4 |
| Low | −5 | −2 |
| Info | 0 | 0 |
- Any critical security finding caps the score at 35. Any high security finding caps it at 55.
- Grades: A 90 to 100, B 75 to 89, C 60 to 74, D 40 to 59, F below 40.
- If part of your site is behind a firewall or bot challenge, those checks are skipped, the result is marked incomplete and the score cannot be above 89.
Where AI is and is not used
- Findings and scores are rule-based. They come from fixed checks that we wrote. An AI model does not decide what counts as a finding, its severity or your score.
- Fix prompts are templates. They are written by us, to be pasted into your own AI coding tool. Review any change before you apply it and keep a backup.
- The Launch Pack is written with AI. The copy is produced with AI assistance from the details you give us and delivered by DeployVet. It is marketing copy, not security advice.
- DeployVet is built with AI-assisted tools. That is how we develop the site and the service.
Limits and accuracy
- A check is a snapshot of one moment. Sites change, so results go out of date.
- We can miss problems (false negatives) and report things that are intentional (false positives). We mark likely-intentional cases where we can.
- A clean result means we did not find the issues we check for. It is not a guarantee, an audit or a certification, and it should not be presented as one.
- Nothing here is legal advice or a promise about the security of your site.
Found a mistake in a finding? Email support@deployvet.com with the address and the finding, and we will look at it.