Privacy

The scanner

The SixthWall command-line tool and MCP server run entirely on your computer. They do not send your code, your file names, your findings, or any usage data to us or to anyone else. They make no network requests during a scan. The only network activity is npm downloading the package itself when you install or update it.

One command is different, and says so when you run it: sixthwall deps sends the names and versions of the packages in your lockfile to the OSV vulnerability database (api.osv.dev) to check them for published advisories. It sends nothing else, and nothing to us.

This website

sixthwall.dev does not set cookies and does not run analytics or advertising scripts. Our hosting provider keeps standard server logs, which include IP addresses and requested pages, for operating and securing the service.

The waitlist

If you enter your email to be notified about a paid tier, we store that email address and which tier you asked about. We use it only to tell you when that tier is available. We do not sell it or share it. Email us from the same address and we will delete it.

The live app check

sixthwall probe sends requests to the site you name and to nothing else. Before the first request it looks up one DNS TXT record to confirm you control the domain. The requests are read-only: GET requests for the home page, a fixed list of well-known paths, and one GraphQL introspection query. Fewer than eighty requests are made. No result leaves your machine; nothing is sent to SixthWall. With --deep the open-source nuclei scanner runs a curated read-only template set against the same host, which sends more requests, still only to that host. With --recon subdomains of the verified domain are looked up in public sources (certificate logs, DNS datasets), checked for an HTTP response, and twenty database and admin ports are tested with a plain TCP connect on up to a hundred of those hosts. Nothing is sent to the services found.

The Supabase check

sixthwall supabase calls Supabase's official Management API with a personal access token you create and pass in SUPABASE_ACCESS_TOKEN. The token only works on projects your own account owns. The command runs one read-only query against the Postgres catalogue to learn which tables have Row Level Security on and which have an open policy. It never reads, writes or names a row of your application data. The token is used only to call Supabase; it is never sent to SixthWall and never stored.

Optional tools

sixthwall tools install downloads gitleaks and nuclei from their own GitHub release pages, checks each file against the release checksums, and stores them in your home folder. They run only on your machine. gitleaks reads your files; nuclei talks only to the site you probe.

The GitHub App (pull request scanning)

When you install the SixthWall GitHub App on a repository, GitHub sends us a webhook for each pull request. We fetch only the files that pull request changed, at that commit, scan them in a temporary folder on our server and delete them as soon as the scan ends. We never clone the repository and never keep source code. What we store is the scan result: file path, line number, rule id, severity, the Fix Pack text and the score, so the check run, the pull request comment, the badge and the public project page can show them. The public page and badge show the score and counts only, never file names or findings. Uninstalling the App stops scanning immediately; email us to have stored results deleted.

A full audit started from the dashboard downloads the default branch as an archive (no history), scans it in a temporary folder and deletes it; only findings and the score are kept, as above. The HTML report is generated from those on request and is visible only to signed-in accounts with access to the repository.

Signing in to the dashboard uses GitHub. We read your GitHub login, id, avatar and the list of App installations you can access, put them in a signed cookie that expires after seven days, and discard the GitHub token at once. We store no account record. Findings and Fix Packs for a repository are shown only to accounts that can access its installation.

Future paid features

Deep audits, reports and the full live app testing tier are still being built. When they launch, this page will be updated to say exactly what they access and store before you can sign up for them.

Questions

Open an issue on GitHub.