ShipLatchBot performs a passive, read-only scan when a user submits a URL: it loads the page and its same-origin JS like a browser, plus up to 3 of its same-origin source maps and one GET each for a short list of files that should never be public (/.env and variants, /.git/HEAD, /.git/config, /.DS_Store, supabase/config.toml, firebase.json, .replit and similar). Contact hello@shiplatch.com to opt out.