Last updated: August 25, 2026
These Terms of Service ("Terms") govern your use of Manifest, a product operated by izater ("we," "us," or "our"). By using the free public scan, signing in with GitHub, installing the GitHub App, or paying for a subscription, unlock, or Stack Audit, you agree to these Terms.
Manifest offers three things, all built on the same underlying analysis engine:
The report is a static-analysis tool. It reads what is committed to a repository at scan time and reports what it finds. It does not verify whether a third-party account or credential is still active, and it does not guarantee it has found every dependency, integration, or risk present in a given repository. See Section 5.
Signing in and installing the GitHub App both use GitHub OAuth. You are responsible for the security of your own GitHub account and for reviewing which repositories you grant the GitHub App access to. You may revoke that access at any time directly from GitHub; doing so stops future scans of the affected repositories but does not delete report history already generated (see the Privacy Policy for how to request deletion).
You must have the authority to grant Manifest read access to any repository you connect, whether your own or one you administer on behalf of a client or employer.
Payments are processed by Stripe. The Manifest subscription bills monthly based on the number of active projects and is prorated when you activate or deactivate a project mid-cycle. The one-time report unlock and Stack Audit purchases are billed once, at the time of purchase. All prices are shown before you pay. Fees already paid are non-refundable except where required by law.
You may cancel the subscription at any time; access continues through the end of the billing period already paid for. Deactivating every project stops future billing.
You agree not to:
We may suspend or terminate access for a violation of these Terms.
Manifest performs static analysis of committed source code, configuration, and git history. It cannot and does not verify whether a detected credential, key, or third-party account is still valid, still owned by you or your client, or has been rotated. Every integration finding is accompanied by a prompt to confirm account ownership independently, because that cannot be determined from a repository alone. The Service is provided "as is," without warranty that its findings are complete or exhaustive. It is a starting point for a handoff or audit, not a substitute for verifying access and ownership directly with the relevant vendor.
To the fullest extent permitted by law, izater is not liable for indirect, incidental, or consequential damages arising from your use of the Service, including decisions made on the basis of a report's findings. Our total liability for any claim arising from the Service is limited to the amount you paid us in the twelve months preceding the claim.
We may change, suspend, or discontinue any part of the Service, and may update these Terms as it evolves. We will update the "Last updated" date above when we do. Continued use of the Service after a change constitutes acceptance of the updated Terms.
Questions about these Terms can be sent to manifest@izater.com.