Your files.
Your decisions.

This public website

The sample checker runs in your browser. Snippets are never uploaded, saved in browser storage or executed. There is no source-upload form, cloud account or cloud source analysis here. Local Accounts holds only an optional display name and web scan summaries in this browser profile. The desktop edition has a separate Cashfree checkout when enabled. Assets and the download are served by Vercel; hosting may process ordinary request logs, including your IP address and requested URLs.

No third-party analytics, tracking pixels, external font service or wallet integration is included. The optional donation button copies the exact displayed address. It does not connect a wallet, select a network or start a transaction. The product video and images are served from this website.

The downloaded local app

The file picker reads only your selection. The CLI reads the folder you explicitly submit, skipping dependency/build folders and symlinks; environment files require its explicit option. Submitted source, hooks, skills and tools are never executed or sent to an external AI provider.

Selected source is encrypted in the local SQLite database and waits for owner approval. Reports contain locations, generic evidence and advice. Source excerpts and credential values are omitted. Completion, rejection or failure removes stored source; reports and audit history remain. Older private backups may retain encrypted pending source.

Protect the installation folder, database and .env encryption key with your operating-system account permissions. The Windows 0.4.0 desktop installer includes its runtime and creates local shortcuts. The older developer source setup downloads Python dependencies from PyPI. No public gateway or system service is installed.

Permissions and notifications

Submission clients can submit and read their own reports, never approve scans or run code. Administrators review exact snapshots and can revoke clients. You can sign out other sessions for your own account.

Browser alerts require your click and browser permission. In-app only pauses browser alerts. The choice is stored for the account in that browser’s local storage; up to 100 audit states and incident revisions are kept in session storage to reduce duplicate notices. Browser notices use generic text and work while a signed-in tab is open. Website indicators need a connected signed event source, and website email needs secure SMTP.

Useful checks, clear limits

Registered patterns can flag possible credentials, deployment commands, server access, destructive commands, AI instruction files and broad permissions. They can miss issues and produce false positives. The public preview checks a smaller subset; it is not a full report.

Installed apps, executable binaries, Windows .lnk shortcuts, media content and live system behavior aren’t malware-scanned. AppoSlash doesn’t test credentials, discover the entire computer or intercept live AI sessions. It cannot guarantee safety or detect every compromise. Website alerts are indicators that require review.

The free local reviewer reads bounded public resources without ownership proof. Deeper website assessments require verified ownership and approved scope. The legacy $3/$9.99 packages remain local trial/access requests and do not take payments. The separate Windows desktop installer has a ₹999 one-time purchase when Cashfree checkout is enabled.

Read the details

Free UPI tool, payer pages and Steady

The UPI tool builds instructions in browser memory without sending the form fields to our server or storing them in browser storage. The shared payer-page URL contains readable, editable instructions after #. Anyone with the link can access those details; it is not encrypted or signed. Browsers, clipboard history, downloads and the channels you share through may retain copies. Our hosting provider receives ordinary page requests and technical request data.

Steady case notes stay in page memory. Leaving or refreshing loses them unless you deliberately export a plain-text copy. Keep exported files private. Quick exit clears the page state but cannot erase browser history or downloaded files. These notes are separate from payment instructions.

The free web companion caches only an allowlist of public home, scanner, Accounts and supporting static files for offline use. It does not cache payment URLs with query data, payer instructions, Steady, checkout, APIs, downloads or merchant records. The older merchant-specific worker is retired when the new companion loads. Notification permission is requested only by pressing the test button; this sends a labelled local test, not a payment alert or push subscription. Read-aloud uses browser voices and some voices may use an online service.

QR review, camera and local Accounts

Camera access is requested only by Start camera, with no microphone. Frames are decoded on this page and never uploaded. The camera stops after a QR is found, when you stop or clear it, or when the page is hidden or left. Selected image pixels stay local and are discarded after processing.

QR checks inspect text structure, URL and UPI fields. They do not visit the destination, resolve short links, check files behind the link, verify a bank recipient or confirm a payment. A review checkbox and a separate opening tap are required. Destination content, redirects and payment-app behaviour can change after this check.

By default, up to 200 web scan summaries are kept in IndexedDB: timestamp, type, review status, fixed description and hostname where relevant. Raw QR text, full URLs, queries, fragments, UPI recipient fields, camera images and source snippets are not stored. Browser text previews also save only a generic summary. Pause new history, export a JSON copy or clear summaries in local Accounts. Your optional display name can be removed by saving it blank.

This local profile is not a cloud account or encrypted vault. Anyone using the same browser profile may see it. Browser data clearing or storage eviction removes it. Exported JSON is unencrypted. Installed web apps, especially on iOS, may have separate storage from their browser. The website cannot read the Windows desktop app’s private database or detect its installation. Install becomes Accounts when this page receives actual web-app installation evidence or opens in standalone mode.

Steady notes and the desktop audit database remain separate. No payment data, personal case notes or credentials belong in scan history. The merchant notification test is still a labelled local test; no live payment verification or background push sender is connected.