CheqvoBot

CheqvoBot (CheqvoBot/1.0 (+https://cheqvo.com/bot)) runs when someone asks Cheqvo for a security check of a website, usually the site's own builder.

What it does

• Loads the page you asked about, like a browser would, plus up to 12 of the site's own JavaScript files.
• Checks a few standard paths with small requests: /robots.txt, /sitemap.xml, /.env, /.git/HEAD, /.git/config, /config.json, /.DS_Store, /.env.local, /.env.production, /supabase/config.toml, and source maps of the files it loaded.
• Looks up the domain's public SPF and DMARC DNS records through a public DNS resolver. This sends nothing to your site.
• If the site's public code includes a Supabase project URL and anon key, it sends at most 6 read-only HEAD requests to check whether common tables are readable without login. It never downloads, stores or shows any rows.
• About 10 to 30 requests per scan, with results cached so the same site isn't rescanned repeatedly.

What it never does

• No logins, form submissions, writes, fuzzing, brute force or exploit attempts.
• No crawling beyond the files listed above.
• No scanning of private or internal network addresses.

Questions or want your site excluded? Email support@cheqvo.com.