We help web and app agencies spot security gaps on the public sites in their portfolio — using only the signals a normal visitor's browser already receives. No scans, no testing, no logins, no payloads. If you received a note from us, this page explains exactly what we did and how to opt out.
Every request we make is one a normal visitor or search crawler would make. We enforce this in code, through a single gateway — not just as a policy. Here is the exact line between what we do and what we never do.
robots.txt, sitemap.xml, /.well-known/security.txtOur crawler identifies itself honestly as AlanSecuritySignals/1.0 with a link back to this page. We make at most three requests per site, at least five seconds apart, one connection at a time, and we obey robots.txt. Every request we make is logged, and each report we send lists exactly those requests with timestamps.
We review the public sites listed in your portfolio using passive signals only, and note things like outdated components, missing security headers, or weak email protection.
You get a short, private summary with a real finding or two — the exact evidence, a severity, and an official fix link. It's free, and it names your clients only to you.
If it's useful, we can run a free, fully authorized deep scan on one site — only after the site owner signs a form naming the exact domain and a test window. If not, no problem.
We keep this minimal and tied to the purpose above. For each agency we store its name, website, city/state, a public contact route, and the public findings from the passive check (the header or HTML line each came from). We log the requests we make for our own audit trail.
Deleted within 30 days. We keep the specific evidence lines, not whole pages.
Kept up to 12 months for non-responders, then deleted.
Each outbound request (URL, time, status) is retained to prove the check was passive.
We never publish a client's name, never sell data, and never contact your end clients — outreach goes only to the agency. For the full picture, see our Privacy Policy.
Don't want to hear from us, or don't want your sites looked at? Email alan@wizeb.com with the domain, or just reply "no thanks" to any message we send. We add it to our do-not-contact and do-not-scan list right away and permanently — that list is checked before every request and every email.
Email us to opt outSecurity Signals is how we open the conversation. If you'd like WizeB to help your agency offer security as a service — authorized assessments, monitoring, and clear client reporting — we'd love to talk.
Talk to us