Your URL. Nothing else.

What we do and what we don't

We call your application the way any visitor does and read what it delivers publicly. We don't log in, we change nothing and we don't test write permissions.

If your database answers unauthenticated requests, we see that — just like everyone else. That's the point.