How Lockpick checks a site

Only sites you own or are authorized to test. Check the exact HTTPS origin before starting. Permission for one site does not include other domains, shared hosting infrastructure or third-party services.

Start with the plain-language explanation, then open the evidence if you need more detail. Your coding agent can help with a repair, but you should review and test the proposed change.

Lockpick runs the assessment on its own infrastructure. Your coding agent can help apply the repair brief in your repository. Customer-facing results show the evidence and next steps; private execution workflows and internal logs are not part of the report.

Pulse inspects the public homepage and its observable security configuration, such as response headers and TLS. It does not sign in, submit forms, access your database or prove that user roles are isolated. Deep (30 pages) is free during the pilot once you verify you own the site.

No. It means the completed checks did not observe a concern in the sampled response. Unknown checks and untested areas remain visible. A public homepage check cannot establish the security of the whole application.

No changes are made automatically. Review the repair prompt with your coding agent, test the proposed fix, and decide whether to deploy it. Copying a prompt does not resolve a finding. Request a separate recheck to compare new evidence.

The result must distinguish completed observations from checks it could not finish. Timeouts, unavailable pages and scope restrictions can reduce coverage. A partial result is not a clean bill of health.

This pilot does not promise permanent report storage. Keep the repair brief you need in your own project records. Do not include passwords, access tokens or private customer data in a target URL or repair brief.