Terms of use

What Walkaround does when you ask it to check an app, what it costs, and what you get for it. Written to be read, not to be skipped. Last changed 21 October 2026.

What a scan is

A scan is one pass of twelve typed checks over one app: its public configuration, the routes it exposes without a login, and the client bundle it ships to the browser. The scanner fetches the pages a stranger can reach, reads the JavaScript those pages load, and asks the questions the twelve checks are written to ask - is there a table that answers an unauthenticated request, is a service key sitting in the page source, does an API answer without a token, is the route list open to anyone. It then prints a dated receipt: a stamp, a count of the open lines, and one line per check with the consequence in plain words.

It is read-only towards your app, with one exception you have to opt into: if you tick the box and hand it a test account, it signs in with exactly that account for the seconds of one scan - that is a POST to your own app's login form, and nothing else. If you choose the throwaway option it creates one account through your app's own sign-up form and uses only that. It never submits anything else, never writes to your app, and never tries a password it was not given.

What it cannot see

A receipt is an honest photograph of a small surface, and it is worth being blunt about the rest:

• Your database, beyond what your app exposes. If a table answers an unauthenticated request, the scan will show you - with the request and the response as evidence. What your row-level security does for the queries your own code makes, it cannot see at all.
• Anything behind a login, unless you hand it a test account for that one scan.
• Runtime traffic. It never watches your app in use, and it cannot tell you what your users actually do.
• Your infrastructure. Server configuration, network rules, secrets stored outside the bundle, your hosting account, your dependencies' published vulnerabilities - none of it.
• Whether the app is good. Nothing here is a code review, an architectural opinion or a judgement about your product.

It is not a penetration test. It does not attack your app, it does not chain findings, and it does not attempt to prove impact. A clean result is not a guarantee. It means these twelve checks, at that address, at that moment, found nothing open. A clean receipt is not a certificate, and we do not offer it as one.

What you are buying

• The free receipt. All twelve lines, dated, with every consequence spelled out and the stamp that says what to do. Free, and complete in what it tells you. The evidence underneath each line and the fix paragraph are what is folded away.
• £39 once - one app, one report: the roll unsealed for that receipt (the exact request and the response behind every open line), a fix paragraph written to paste back into the tool that built the app, the model's read of your app as a stranger sees it, and rescans of that same address for 30 days so you can watch the lines close.
• £19 a month - unlimited rescans and unsealed checks for the address you subscribed from, for as long as you keep the subscription. Cancel whenever; see refunds and cancellation.

Scanning is rate limited to keep a free endpoint from being used as a fetching service, and the limit is printed on the page when you reach it.

Paying

Card payments are handled by Stripe. We never see or store your card number. Prices are in pounds sterling and the amount shown on the checkout page is the amount your card is charged - our checkout sessions deliberately switch Stripe's own tax add-ons off, so nothing is added on top of the price you were shown.

A subscription is charged monthly, in advance, until you cancel it. Cancelling stops the next charge; it does not take back the month already paid for, which stays live to its end.

The receipt, and the owner's door

There is no account to create to use Walkaround. A receipt is addressed by a random reference, and anyone who has the reference can read that receipt - so treat the address of a receipt like the receipt itself. The monthly subscription can be managed, and cancelled, from the billing portal, which is the only place your card details live.

We may change these terms; when we do, the date at the top of this page changes, and a change that affects a subscription you are paying for will be said plainly by email before it takes effect.

Limits and liability

The service is provided as it is. We do not promise that a scan will find anything in particular, or that an app it reports as clean is safe to ship - see "what it cannot see" above. We are not liable for losses that follow from a decision you took on the strength of a receipt, or from a scan that could not reach your app. What we do promise is the part we control: if a report you paid for was never delivered, or a rescan you paid for never ran, we refund it - see refunds and cancellation.

These terms are governed by the law of England and Wales. Nothing in them affects your statutory rights as a consumer.

Getting in touch

Anything at all - a receipt that looks wrong, a report you want deleted, a refund, a question about a subscription: hello@walkaround.dev.