Methodology

What each check actually does, and how it can be wrong.

Trustfield is an external, read-only review. We fetch public pages and headers, resolve DNS, and probe a small set of well-known paths. We do not log in, do not exploit, and never store source code.

How a scan works

1. Fetch the public page and follow redirects (public IPs only — private ranges are blocked).
2. Read HTML, JavaScript bundles and response headers.
3. Resolve DNS records (SPF, DMARC, CAA, MX) and TLS certificate details.
4. Probe a short list of commonly exposed files (/.env, /.git/config, source maps) — read-only GETs.
5. Check compliance pages by following the links the homepage itself advertises, then common paths (privacy, terms, deletion).
6. Score findings by severity, with confidence labels on each one.

Confidence labels

• High — direct evidence: we saw the thing itself (a key in the bundle, a header, a file).
• Medium — strong inference: shared hosting behaviour, framework defaults, a rule that may be intentional.
• Low — heuristic or informational. Treat it as a question, not a verdict.

Known limitations (published on purpose)

• No authentication testing, no exploitation, no privilege escalation.
• No mobile binaries, browser extensions or Shopify admin apps.
• Server-side code is only reviewed when you attach a public GitHub repo.
• A clean scan is not a guarantee: it is a point-in-time check of what is publicly visible.
• Some pages render with JavaScript; we read what a browser would receive without executing user actions.

When we are wrong

If a finding is factually wrong, tell us and we fix the check, add a test for it, and refund that report (/refund). Corrections are listed in the changelog.