# Safety

> What a prospect is never allowed to do, and where the guards stop.

Prospects may go anywhere, including pricing and checkout. Reaching the wall is the finding. The action that commits is blocked.

## Permission first

Only test sites you own or have written permission to test

A run creates real accounts, triggers real emails and webhooks, and records what it sees. Use a staging copy when you can.

## What it never does

**Pay**
Card fields, anything that passes a card-number check, pay buttons in several languages. A bare "Subscribe" stays clickable.
**Book a meeting**
Scheduler commit buttons are refused. "Book a demo" still opens, because a demo-gated signup is a finding.
**Sign in with a provider**
Google, GitHub, SSO and work-account buttons. "Continue with email" is allowed.
**Delete, invite or publish**
No deleting data, inviting teammates, publishing, opening support chat or contacting third parties.

- Every session starts in a fresh browser with no saved cards or logins.
- Typing never presses Enter, and the email is always the assigned mailbox.
- A refusal does not end the session: the prospect is told why and routes around it or leaves.

## Where the guards stop

Best effort, not a guarantee

The payment, booking and sign-in guards match button labels. An unseen label, an uncovered language or a control with no accessible name can pass. Do not point Leakdown at a live checkout and assume it cannot buy.
The last rule above is a prompt rule, not a mechanical block. A "request a demo" form or a free trial with no card is submitted like any other form.

---
Source: https://docs.leakdown.dev/safety