How the Tuvio site scanner works

People who build a web app paste its address into Tuvio to see what it leaves open before they launch. To answer, we read the site's public pages the way a browser does. Here is everything we fetch, and how to opt out.

What we fetch

The home page, and the scripts it loads from the same site.
robots.txt.
One plain-HTTP request, to check that it redirects to HTTPS.
One request with a made-up Origin header, to check which sites may read the responses.
Where enabled: /.env, /.env.local, /.env.production, /.git/config, and up to 3 AI endpoints named in the site's own code.

What we never do

Every request is a plain GET. We don't log in, fill in forms or send cookies, we don't try to break anything, and we don't store the pages we read: a report records what kind of problem we saw and where. We don't read other companies' scripts, like analytics or Stripe.js.

How to recognize us

Our requests carry this user agent:

TuvioSiteScanner/1.0 (+https://tuvio.dev/scanner)

Opt out

To stop all scanning of your site, add this to your robots.txt:

User-agent: TuvioSiteScanner
Disallow: /

A User-agent: * rule is honored for the extra paths listed above. The home page and its scripts are what any browser loads.

Want those extra paths checked even though a User-agent: * rule blocks them? Add:

User-agent: TuvioSiteScanner
Allow: /

You can also ask us to block your domain, or report a problem with our scanner: info@tuvio.dev. A person reads it. See also who runs Tuvio.