AODAChecker
Security
Access protection
Supabase authentication, verified email, server sessions with HttpOnly cookies, membership checks and optional TOTP MFA for customers. Real MFA is required for production administration. Support never asks for your password or codes.
Scans and documents
Scans are limited to authorized public pages; crawling stays on the same host and enforces a strict page cap. The browser must be isolated without secrets and its outbound network tested before public activation. Private documents, authorized downloads and evidence links without automatic fetching.
Reporting and limitations
No guarantee of zero vulnerabilities, SOC 2 certification or absolute availability is made. Security tests do not replace checks on the actual deployed host. For sensitive reports, use the dedicated address when configured, without submitting exploitable secrets in the general form.