Scan policy

How a scan is authorized

1. 1. You explicitly confirm ownership or written permission before the scan starts. That acknowledgement is timestamped and stored with the scan.
2. 2. The target is checked against the global blocklist below — on the client, on the server, in the public API, and again on every redirect hop the scanner follows.
3. 3. An AI classifier reviews the hostname as a second layer, so protected organisations on ordinary .com or .org domains — a regional hospital, a defense supplier, a credit union — are refused even when they match no keyword or TLD rule.
4. 4. Private, loopback, link-local and cloud metadata addresses are refused, so a scan can never be pointed at internal systems.
5. 5. Probes are read-only, rate limited and time bounded. We never attempt exploitation, brute force, or data modification.
6. 6. Refused attempts are logged for audit and reviewed for abuse.

Domains we never scan

These categories are blocked worldwide, in every country and language, regardless of who requests the scan — including you, on your own account.

Why

Unauthorized probing of protected systems can violate the Computer Fraud and Abuse Act (USA), the Computer Misuse Act (UK), and equivalent legislation elsewhere — even when the intent is defensive. Blocking these categories outright protects our users and us. Attempts to bypass the blocklist may be reported to the relevant authorities. See the terms of service.