Trust starts with clear boundaries.

01 / Safety, scope & control

Browser checks have a defined scope.

Browser checks require proof that you own the app and reject private or local target addresses. Quick Checks and the four AI visitor personas use guarded browsing with restrictions intended to avoid submitting forms and performing data-changing actions.

A sampled browser visit cannot cover every route, state, account or interaction. Website behavior can also depend on your own server, so use an appropriate test environment and review what the check covers.

• Results describe the pages and interactions observed during the run.
• AI visitors simulate perspectives; they are not human testers.
• A successful check is not a guarantee that your app is secure.

02 / Safety, scope & control

Staging scenarios require explicit setup.

Cheater and Hacker target an independently verified staging origin. You approve the request recipes, use disposable accounts and define the response assertions. Redirects outside the approved origin stop the run.

These testers can send POST requests and perform approved writes. Data-changing tests require setup and cleanup; payment scenarios require test mode. Missing credentials or failed preparation should be resolved before the scenario can provide useful evidence.

• Use only apps and staging sites you own or are authorized to test.
• Use the stop control if a queued or running scenario should not continue.
• Review cleanup results and remove any remaining disposable test data.
• These are bounded scenarios, not a comprehensive penetration test.

03 / Safety, scope & control

Code access is read-only.

GitHub access is limited to the repositories you select and is read-only. Uploaded ZIPs are limited to 25 MB and deleted after the review. Detected secret values are redacted in saved findings.

Gauntly suggests fixes; you review and apply code changes in your own workflow. Avoid uploading unnecessary personal information or live credentials.

04 / Safety, scope & control

Share evidence with context.

A report or receipt is useful when it says what ran, when it ran, which environment and version it describes, and what remains unresolved. Review these details before you share.

Public receipts are optional and may include product promises, evidence scope and owner exception notes. Review the content for sensitive information. Retained staging evidence and rehearsal media follow their configured retention windows.

• A manual checklist is not automatic test evidence.
• Device previews use browser emulation, not a lab of physical devices.
• Gauntly does not claim SOC 2, ISO certification or complete security coverage.

05 / Safety, scope & control

Found a security concern?

Contact us privately with a concise description, the affected part of Gauntly and enough non-sensitive detail to help reproduce the issue. Do not include live passwords, access tokens or other people’s data.