Email scan
POST /api/scan
Send a JSON body with an email field. The response returns a masked report with risk, findings, source status, and tips.
API
Simple endpoints for exposure checks.
The public interface uses the same server routes listed here. Responses are intended for user-facing triage, not proof of compromise.
Password check
POST /api/password
Hash the password in the browser, then send only the five-character SHA-1 hashPrefix. The response returns a padded range so the browser can compare the suffix locally.
Privacy
Email reports mask the searched address. Password checks send only a short hash prefix to Limito; neither the raw password nor its complete hash leaves the browser.