Terms
Scan apps you own.
NextPlay Solutions · October 26, 2026
The service
Burnproof is a read-only check of a public web page, operated by NextPlay Solutions. It fetches HTML and same-origin scripts, looks at response headers, and requests /.env and /.git/config to see if those files are being served. It does not sign in, submit forms, change data, brute-force paths, or send attack payloads.
Acceptable use
Use it on apps you own, or on apps where the owner has given you permission to test. Do not use it to look for other people's keys, customer data, or source code. You confirm that permission before a URL scan and before an ownership check.
What we will not pull
If a Supabase anon key is in the page, Burnproof may ask the project's public API whether a table answers without a user session. It records that access exists and, when the server sends one, a row count. It does not store or display row contents. It will not send a service_role key anywhere. Exposure checks report whether a file looks real. They do not return the file.
Reports
Secret values in a report are masked. A masked value is still a leaked credential. Rotate it. A report link is unlisted, not a vault. Anyone with the link can read the masked findings. Do not put a raw secret into a URL you paste here.
Ownership checks
A deeper scan runs only after the site publishes a token we issued, either as a meta tag or as /.well-known/burnproof.txt. That scan is still read-only. It reads more scripts. It does not log in or change the site.
Paid plans
Launch Check is $24 once. It unlocks a checklist on the access page for the checkout email. The checklist is the same for every purchase: rotate any key a scan masked, move provider keys out of client code, confirm /.env and /.git/config are not being served, and run the ownership check before you scan again. Launch Check does not run a scan, hide the free report, or start a Monitor subscription. Monitor is $12 per month and lets that email save up to 3 app URLs. Agency is $49 per month and lets that email save up to 10 app URLs. About once a week, Burnproof scans each saved URL again with the same read-only public check and stores the result. Each scan has a report link. The page still says Burnproof. New findings are emailed to that address from alerts@burnproof.dev after the weekly rescan. The first scan of a URL does not send an alert. You pay on Polar's page. Burnproof unlocks the plan when Polar's webhook arrives. Cancel a subscription with Polar.
Refunds
You can get a full refund within 14 days of purchase, no questions asked. This covers the $24 Launch Check and the first month of any subscription (Monitor at $12 per month, and Agency at $49 per month). Email hello@burnproof.dev to request it. Payments and refunds are processed by Polar, our merchant of record.
No warranty
The scan is a point-in-time look at public files. A clean score does not mean the app is safe, and a finding is not a promise that a bill has already been run up. The service is provided as-is. NextPlay Solutions is not liable for lost profits, provider invoices, or indirect damages arising from your use of the site, to the extent the law allows. You are responsible for what you scan and for fixing what the report shows.
Contact
hello@burnproof.dev. Privacy requests: privacy@burnproof.dev.