FAQ

Does a passing scan mean my app is secure?

No. It means the checks we ran did not find a problem.

Can I check someone else’s website?

No. You must own the app or have permission. Report abuse at /report.

Will Watch email me when a visitor hits an error?

Yes, once an SDK is on that app, the error reaches a project you own or admin, and Profile → live errors (or the Watch “app breaks” switch) is on. Also email me must be on. Mail goes through Resend. Repeated events on the same fingerprint do not send another email. If mail is not available, the bell still works.

Does Invince re-run AI on every Sync?

No. Unchanged HEAD in the last 24 hours reuses the last completed scan. Your own AI key is never cached into the shared pool.

How do I turn on the extra sign-in step?

Profile → Two-factor authentication. Scan, verify the 6-digit code, save backup codes. The next password login asks for that code.

How do notifications work?

The bell shows job results, critical findings, live errors, bot floods, Watch changes, and agent loops. The same events can email you when mail is configured and “Also email me” is on in Profile.