How scan credentials and page content are handled

What to know

Scan credentials are sent to worker memory for the run and are not stored in project configuration. Page findings and screenshots are different: they can contain content from the page being audited.

What to do

1. Use a test account with only the access the scan needs.
2. Supply credentials only through the scan form, never through a page URL or support message.
3. Review report evidence before sharing it, especially for authenticated applications.
4. Ask the team about your deployment’s inference configuration before scanning sensitive content.

What happens next

AI guidance may send redacted page context to the configured inference provider. Redaction reduces exposure but is not a promise that all sensitive page information is removed.

If you need more help

Exported session files on your computer are still secrets. The temporary handling inside LatchKey does not protect a file that you commit or email elsewhere.

• Session guide
• Contact support