How we know
Trust is the whole product
Is It? is a free public service. It has no accounts, no ads, no trackers and no analytics cookies. Here is exactly where every answer comes from and what happens to what you type.
What happens to what you type
- Products and bug names are matched in your browser against a list it downloads. What you type is not sent.
- My stuff is saved in your browser (local storage) and checked against a list your browser downloads. It never reaches us.
- Email addresses and phone numbers you type get advice on locking them down. They are not looked up or sent anywhere.
- Messages you paste ("Is this real?") and questions you ask are sent once to an AI model running on Cloudflare Workers AI. We do not store or log them. Before sending, your browser (and our server again) blanks out numbers that look like card numbers, one-time codes or ID numbers. That is best effort, so do not paste anything you would not read aloud.
- Links are opened by our server, not your device, so you can see where they lead without visiting them. The website at the other end sees a visit from our server.
- What we count: the kind of thing checked (a message, a link, a product), the verdict, the scam pattern our checker recognized (for example "toll text" or "fake celebrity ad"), your country and which site sent you here. Never the words you typed. That is how we learn which scams are spreading without keeping anyone's messages.
- Only if you tick "Share this message" do we keep that one message, with names, numbers, emails and link paths removed, so we can add it to our scam examples and warn others.
Those two outside parties (Cloudflare, which runs the AI model, and the website a link points to) are the only places anything you type can go, and only for the check you asked for.
Where the answers come from
- Being used in attacks: the US government's Known Exploited Vulnerabilities catalog (CISA KEV). If it is on that list, attackers have used it for real.
- Cloudflare's watch list: Zero Wire briefings on Cloudflare Radar. We link to them instead of copying them.
- What people are saying: social data from LunarCrush, which tracks posts across X, Reddit, YouTube, TikTok and news. Attention is not the same as harm; we show it so you know what your coworkers are about to ask you.
- Code on GitHub: public repositories named after the bug. Some are scanners, some are attack code.
- What to do: written and reviewed by us, following official guidance from CISA, the FTC and the vendors.
How the plain English is written
Summaries are drafted by an AI model from the official text only. A script then removes any dotted version number (like 8.4.27) that does not appear in that source text. It does not check every sentence, which is why each page shows the official description and links its sources. When we are not sure, we say less, not more. Every page links its sources so you can check us.
What we will never do
- Ask you to install anything to "scan" you.
- Ask for a password, ever.
- Sell what you type, use it for ads, or keep it.
- Send you email you did not ask for.
Data for everyone
Everything here is free to reuse: wire.json, RSS, and per-bug playbooks for AI agents. The code goes public on GitHub soon.