Security

What our checks do on your app

Heedza opens your public pages in a browser, the way a visitor would, and checks that they load and show their forms and Pay button. It never submits forms, signs in or pays. Checkout checks stop before any payment step.

The security scan only reads what any visitor can already see: response headers, the HTTPS certificate, public files such as /.env and /.git, and the code your pages send to the browser. It does not try your public Supabase or Firebase key against your tables.

How we store your data

Passwords are stored as a salted hash, never as the password itself. If a scan finds a secret key on your site, we store only a shortened, masked version of it. Screenshots of your app are visible only to your account. Payments are handled by Stripe, so we never see or store card numbers.

The site runs on Cloudflare, data is stored in a Neon Postgres database, scheduled checks run on Cloudflare and email is sent through Resend. The privacy policy lists what we store.

On Pro and Business, Fix it for me uses GitHub and Anthropic. With the Heedza app installed on GitHub, only for the repositories you pick, Heedza reads the files a fix needs and opens the fix as a pull request after you press the button. It can’t change your GitHub settings, secrets or workflow files, and nothing is merged until you approve it. To write a fix for a page problem, the text of those files, with anything that looks like a key or password removed, is sent to Anthropic. See how Fix it for me works.

Reporting a security problem

If you find a security problem in Heedza, email hello@heedza.com with “Security” in the subject. Tell us the page or address, the steps to see the problem, and what you could see or change. We read every report and reply to tell you what we will do about it.

While you look, please don’t access or change other people’s data, don’t send large amounts of traffic, and don’t share the problem publicly until it is fixed. Test only against your own account.

Our contact details for security reports are also at /.well-known/security.txt.