RoastMyOpsec

Legal

Privacy Policy

Last updated: October 2, 2026

1. What we collect

  • URLs / hostnames you submit for scanning and the scan type you choose (website or app).
  • Scan results, scores, and timestamps needed to show your report and leaderboard entries.
  • Basic request metadata (approximate IP, user agent) for rate-limiting and abuse prevention.
  • Payment metadata from our processor if you unlock a full report (we do not store full card numbers).
  • Optional GitHub OAuth tokens/scopes only if you connect a repo for deepen scans.
  • Your email address if you subscribe to free vulnerability alerts.

2. How we use data

We use this data to run defensive audits, display reports, operate the leaderboard, prevent abuse, process unlocks, send vulnerability alerts you asked for, and improve the product. We do not sell personal data. Alert addresses are stored with Resend on a RoastMyOpSec alerts account, separate from Discord verification mail. Signup sends a confirmation when that sender is configured. This form does not send a news blast.

3. What a scan touches

Scans fetch publicly reachable responses for the URL you provide (headers, HTML, linked same-origin scripts, selected well-known paths, and public DNS records). We do not intentionally access private networks. Optional GitHub deepen reads repository contents you authorize.

4. Public leaderboard

Published free scans may show a sanitized hostname and score publicly. Avoid submitting sensitive internal hostnames if you do not want them listed.

5. Retention

Demo infrastructure may keep scan records ephemerally (including in-memory stores that reset). As the product matures we may retain reports longer to support unlock links; we will update this Policy accordingly.

6. Processors

We may use hosting (e.g. Vercel), payments (e.g. Stripe), email delivery (Resend, on a RoastMyOpSec alerts account separate from Discord verification), and analytics/error tools under their respective privacy terms.

7. Your choices

Do not submit personal data in URLs you do not control. To leave the alert list, reply to a confirmation and ask to be removed. To request deletion of a report identifier you control, email SookLabs.th@gmail.com. See also our Terms of Use.