Security

What we actually do — and what we don't claim.

What we do

• Previews are always redacted — full secret values never appear in output, JSON, or Slack.
• No live credential validation: we don't call AWS/Stripe to check keys (that would need your cloud credentials and creates its own risk).
• LEAKPATROL_ALLOW_ROOT confines scan targets in multi-tenant CI.
• We are not SOC 2 certified. The scanner is open about its methods: regex + entropy heuristics.

What we don't claim

We are not SOC 2 certified, not ISO 27001 certified, and we don't use the phrase "military-grade encryption". If we name a cipher, we name the key management next to it. Security claims on this page describe the software as shipped — verified in the product repo, not in a badge.

Report an issue

Found a vulnerability? Email don+leakpatrol@lifeofmorr.com with details. We respond to good-faith reports promptly and don't pursue researchers who follow responsible disclosure.