Terms of Use

Last updated: 26 October 2026

The short version: CheckMyCode is free and open source. Your code is sent to the scanner only to run your scan and is deleted as soon as the scan finishes. We never store, sell, share or train on it. Results are automated and come with no guarantees. Only scan code you're allowed to scan. By using the scanner on this website you agree to these terms.

1. About these terms

These terms apply to the hosted scanner at checkmycode.dev (the "Service"), run by the CheckMyCode maintainers ("we", "us"). By selecting files or a folder and pressing Scan, or otherwise using the Service, you agree to these terms. If you don't agree, please don't use the Service. You can run the same scanner yourself with the desktop app or the command-line tool instead.

The CheckMyCode software (its source code, desktop app, CLI and Docker image) is licensed under the MIT License (see section 9), not under these terms.

2. The Service

The Service is free. We provide it as a community tool, with no account and no paid tier. We may change, limit (for example with rate limits or file-size limits) or stop the Service at any time, without notice. There is no guaranteed availability.

3. Your code: what happens to it

In your browser: folders you exclude (such as node_modules, vendor and .git), media and large binary files are filtered out before anything is sent. They never leave your device.
Sent over HTTPS: the remaining files are compressed and sent, encrypted in transit, to our server for this one scan.
Scanned in a temporary workspace: open-source scanners run against the files in a private, temporary folder.
Deleted immediately: the folder and every uploaded file are permanently deleted as soon as the scan finishes, whether it succeeds or fails. The scan summary shows the time of deletion. If a scan is interrupted (for example by a server restart), a cleanup task deletes anything left behind within 75 minutes.
Results expire: the scan results (findings, file names, line numbers and short code snippets around each finding) are kept temporarily so you can view them. They are tied to your browser session, not visible to anyone else, and automatically expire 60 minutes after the scan. Detected secret values are masked. Download a JSON or SARIF report if you want to keep them.

We do not store your code. We don't keep copies, back it up, sell it, share it, look through it, or use it to train any model. You keep all rights to your code. You give us only the limited permission needed to process it to run the scan you requested.

4. Other information we handle

Scan counter: we count completed scans per day (a date and a number) to show the community counter. Nothing about you or your project is recorded with it.
Server logs: like most websites, our web server keeps standard access logs (IP address, time, requested page, browser type) for security and abuse prevention. They are deleted after about 7 days. Your IP address is also used briefly to apply rate limits.
Cookies: we use only a session cookie and a security (CSRF) cookie, which the scanner needs to work. No analytics, advertising or tracking cookies.
Third parties: your source code is never sent to a third party. To check dependencies, the scanner compares package names and versions against public vulnerability databases it downloads to our server (Trivy and OSV.dev), audits GitHub Actions workflows offline, fetches open-source rule sets, and looks up runtime and framework versions (for example "Laravel 11" or "Node.js 20") on endoflife.date. Fonts and scripts are served from our own server.

5. Acceptable use

You agree that you will:

only scan code that you own or are authorized to scan;
not upload content you are not allowed to share, and avoid uploading personal data about other people;
not upload malware, or anything intended to harm, overload or break into the Service or other systems;
not try to access other people's scans or results, bypass rate limits, or run automated or bulk scanning beyond normal use;
not use the Service for anything unlawful.

We may block access or stop a scan if we believe these terms are being broken or the Service is being abused.

6. Scan results are not a guarantee

Results are produced automatically by open-source tools and rules. They can miss real problems (false negatives) and report problems that don't exist (false positives). A clean result or a good grade does not mean your code is secure. The Service is not a security audit, penetration test or professional advice. You are responsible for reviewing the results and for any decisions or changes you make based on them.

7. Security issues in the Service

If you find a vulnerability in CheckMyCode itself, please report it privately via GitHub rather than publicly, and don't access data that isn't yours while testing.

8. Open-source components

The scanner relies on open-source projects, each under its own license, including Trivy (Apache-2.0), OSV-Scanner (Apache-2.0), Semgrep (LGPL-2.1) and its rule registry, Gitleaks (MIT), zizmor (MIT), and data from endoflife.date. Those projects are not affiliated with CheckMyCode and don't endorse it.

9. License

The CheckMyCode software is free and open source under the MIT License:

MIT License

Copyright (c) 2026 Gbeila Aliu Wahab

Permission is hereby granted, free of charge, to any person obtaining a copy
of this software and associated documentation files (the "Software"), to deal
in the Software without restriction, including without limitation the rights
to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
copies of the Software, and to permit persons to whom the Software is
furnished to do so, subject to the following conditions:

The above copyright notice and this permission notice shall be included in all
copies or substantial portions of the Software.

THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
SOFTWARE.

10. No warranty

THE SERVICE AND THE SOFTWARE ARE PROVIDED "AS IS" AND "AS AVAILABLE", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING WITHOUT LIMITATION ANY WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, ACCURACY, AVAILABILITY OR NON-INFRINGEMENT.

11. Limitation of liability

TO THE MAXIMUM EXTENT PERMITTED BY LAW, WE WILL NOT BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, CONSEQUENTIAL OR PUNITIVE DAMAGES, OR ANY LOSS OF DATA, PROFITS, REVENUE OR BUSINESS, ARISING OUT OF OR RELATED TO YOUR USE OF (OR INABILITY TO USE) THE SERVICE OR ITS RESULTS, INCLUDING ANY SECURITY ISSUE THE SERVICE DID OR DID NOT REPORT. THE SERVICE IS FREE, AND OUR TOTAL LIABILITY FOR ANY CLAIM IS ZERO, OR THE SMALLEST AMOUNT ALLOWED BY APPLICABLE LAW.

Some jurisdictions don't allow certain warranty exclusions or liability limits, so some of the above may not apply to you. Nothing in these terms limits rights you have under laws that can't be waived.

12. Your responsibility

You agree to be responsible for the content you submit and how you use the Service, and to cover claims made against us by others that result from content you submitted without permission or from your breach of these terms, to the extent permitted by law.

13. Changes

We may update these terms. The date at the top shows the latest version. If you keep using the Service after a change, the updated terms apply.

14. Contact

Questions about these terms: reach the maintainer on GitHub.