Not publishable yet — T-01

This page still contains unfilled placeholders. It is delivered in this state on purpose: the code is finished, the legal text is not. Open items:

• T-01

If you are here, you probably found this line in your access logs:

• Root92-MigrationScanner/1.0 (+http://134.122.72.232/about-scanner)

That is us. This page explains exactly what that request did, and how to stop it. It takes about a minute to read, and there is a "how to make us stop" section at the bottom if that is all you want.

Who we are

Root92. We migrate apps built on Lovable to code the owner actually controls.

The free surface check is how that conversation starts: the owner of an app pastes its address, ticks a box confirming they own it or are authorised to have it analysed, and gets a report on what an outsider can see from the outside. There is no crawler, no list, no discovery. We only ever look at an address somebody typed in themselves.

Legal contact: TODO(gabriel) T-01 — legal name, VAT number, registered address.

What we read from your server

In one session, within a total budget of 20 seconds and 20 MB across everything:

• /robots.txt, first, before anything else.
• The HTML of the home page.
• Up to 40 first-party JavaScript bundles that the markup itself declares — via <script src>, <link rel="modulepreload"> or <link rel="preload" as="script">. Third-party scripts are not fetched: they are not the owner’s to show us.
• A HEAD request — headers only, never the body — on /.env, on /.git/config, and on any .map file that a bundle we already downloaded declares itself.

From all of that we keep metadata: which builder produced the site, whether a backend is referenced, which security headers were present, sizes and timings. We do not keep page content.

What we never read

• We never read data from your database. Not a row, not a count, not "just to see if it answers".
• We never use a key or token we find. A public key in a bundle gets decoded and reported; it is never presented to your backend, in any form.
• We never download the body of /.env or /.git/config, even when they answer 200. We record the status code and close the connection. The finding is "this is reachable", and it has no field for the contents.
• We never download source maps. We only check whether they exist.
• We never guess. No wordlists, no /.env.local, no /backup.zip, no table names. The paths above are the entire list.
• We never write anything anywhere.
• We never disguise the request. The user-agent above is the only one we use.

Why we were allowed to

Because the owner of the application asked us to, one address at a time, with a tick box, before the first request went out.

That consent is recorded with the version of the text it was given under, and it is the only thing that starts a scan. There is no code path that scans anything outside that form: no batch, no list, no scheduled job, not even in development.

If you are reading this and you are not the person who asked, then somebody submitted an address that was not theirs. Tell us at the address below and we will handle it.

How much load this puts on you

Deliberately little, because a tool that stresses the site it is checking would be the wrong tool.

• One session per check, capped at 20 seconds and 20 MB in total — not per request. When the budget runs out the scan stops and reports what it managed to establish.
• At most 40 bundles.
• At most 3 checks per hour against the same hostname, no matter who asks, and 20 per hour from the same submitter. One check can mean up to two scan sessions: the report is computed when the address is submitted, and computed again if that person then asks to be contacted, so the saved report is the fresh one. That is why you may see up to 6 sessions in an hour and not 3. The cap follows redirects: if the address we were given forwards to yours, it is your hostname that is counted.

How to make us stop

Two ways, and there is no third.

Put us in your robots.txt. We read it before the home page and we respect it — if the path is disallowed for our token, we do not fetch it, and the check closes as blocked with nothing collected:

• User-agent: Root92-MigrationScanner
• Disallow: /

Or write to us and we will block the address on our side: TODO(gabriel) T-01 — contact address.

If a request from us caused you a real problem, say so in that email. We would rather hear it than not.