Security

• Everything is served over HTTPS; payments happen on the payment provider's hosted checkout, never on this domain.
• The scanner only fetches what a site serves to any anonymous visitor, identifies itself with the topmarketing-scan user agent, and respects blocks: a site that refuses the fetch simply gets no score.
• The public API is read-only. There are no accounts and no credentials to steal.

Reporting

Found a vulnerability? Email hello@topmarketing.lol. We read everything and fix real issues fast; good-faith research on the public surface is welcome.