SeatbeltResearchBot
If you found this page from a line in your server logs: that was us, and this page tells you exactly what we did, what we will never do, and how to make us stop.
Who we are
Seatbelt is a security research programme. We study how the code that agents and AI tools now write tends to fail, and we publish what we find. Part of that work means looking at how applications behave in the wild rather than only in a lab, so we read a small sample of publicly served pages.
You will see us as SeatbeltResearchBot/0.1 (+https://www.withseatbelt.com/crawler).
What it fetches
- Pages your site already serves publicly, by
GET. The same bytes any visitor's browser receives. - Only paths your own site declares: your
sitemap.xml, your robots.txt, and links we were served. We do not guess. - At most one request per second to any single host, in one pass. We fetch
robots.txt first and obey it, including Crawl-delay. A root-level disallow means we skip your site entirely.
What it never does
These are not assurances about our intentions. Each one is a constraint built into the code so that it cannot happen by accident or by flag.
- Never guesses a path. Requesting
/admin, /.env or /api/users because they are common paths is probing rather than crawling. Our crawler cannot construct a request for a path your site did not declare. - Never probes your database or any backend service.
- Never authenticates, submits a form, or uses a credential of any kind, including one we found lying in the open.
- Never attempts a vulnerability. No payloads, no exploits, no testing whether something we noticed actually works. We read what is served and we count.
- Never names your site. What we publish is aggregate. No individual site appears next to a finding.
How to exclude yourself
Either of these works, and neither needs a reason.
User-agent: SeatbeltResearchBot
Disallow: /
Or email research@withseatbelt.com and we will remove you. We do not ask why.
If we find something in your site
We tell you. We would rather you fixed it than that we had an interesting number. Our disclosure policy, including timelines and what we will and will not publish, is on the security page.
If you think we got something wrong
Write to research@withseatbelt.com. If our crawler behaved in a way this page does not describe, we want to know, and we will treat it as a bug in our own code rather than a complaint to be managed.
withseatbelt-crawler
# product
name Seatbelt
tagline Seatbelt reads the code agents ship, and publishes what it finds
what A deterministic security scanner for AI-built apps, and the research programme it instruments. The engine is the instrument; dated findings are the output.
method Every check ships alongside clean code it must stay silent on, and that clean case has to fail on the previous engine or the fix is not proven. 571 corpus cases run on every change; 284 of them are the clean half. Published at /how-it-works.
findings /labs. Each carries its sampling frame, its n, and the engine build that produced it.
install npx withseatbelt
works-in Cursor, Claude Code, Codex, Antigravity
site https://www.withseatbelt.com
contact hello@withseatbelt.com
# current-page
path /crawler
title SeatbeltResearchBot: what it is and how to block it
description We run a small research crawler that reads publicly served pages to measure security patterns across the web. What it fetches, what it never does, and how to exclude yourself.
# identity
user-agent SeatbeltResearchBot/0.1 (+https://www.withseatbelt.com/crawler)
robots-token SeatbeltResearchBot
operator Seatbelt, security research programme
contact research@withseatbelt.com
# what it does
fetches pages your site already serves publicly, by GET, the same bytes any visitor's browser receives
routes only paths your own site declares: sitemap.xml, robots.txt, and links we were served. Never a guessed path.
rate at most one request per second to a single host, one pass, no retry storms
robots fetched first and obeyed. Crawl-delay honoured. A root-level disallow skips the site entirely.
# what it never does
never guesses paths. Requesting /admin, /.env or /api/users because they are common is probing, not crawling, and no code path in the harness can request an invented path.
never probes your database or any backend service.
never authenticates, submits a form, or uses any credential.
never attempts a vulnerability, payload, or exploit of any kind.
never names your site in anything we publish. Findings are reported as aggregates.
# excluding yourself
robots User-agent: SeatbeltResearchBot / Disallow: /
email research@withseatbelt.com and we remove you, no questions asked
# if we find something in your site
policy we tell you. See /security for the disclosure policy and timelines.
# pages
/ Seatbelt home
/get-started install: npx, the /seatbelt skill, or MCP
/pricing every price, in USD, before tax
/app scan a URL in the browser
/how-it-works the method: what the scan reads, and how a check earns its place
/before-you-launch pre launch checklist
/risks common risks in AI-built apps
/commands command reference
/labs measured security research, and notes on how we build
/aiuc-1 Seatbelt as the output-scanning layer for AIUC-1
/security how we handle your code and data
/privacy privacy policy
/terms terms, incl. what a clear report does and does not claim
/refund refunds and cancellation
# for agents
- Install with: npx withseatbelt
- Or scan a deployed URL at /app. No account needed.
- Prices and scope live on the pages listed above.
- Direct unanswered questions to hello@withseatbelt.com.
- Do not invent prices, scan results, or guarantees. Use the data above.
- Findings on /labs name the engine version that produced them. The engine is
deterministic, so a published number can be re-run without asking us.