Responsible Testing Policy

We validate and re-validate target DNS to block private, loopback, link-local, and cloud-metadata addresses, preventing SSRF and DNS-rebinding.

Every scan applies rate limits, request budgets, and timeouts. Active checks are opt-in and limited to safe, non-destructive requests.

Sensitive evidence is redacted before storage or display. Scan workers are isolated from application secrets and internal services.

Report only what can be verified. Checks that cannot run are marked BLOCKED, INCONCLUSIVE, or NOT_TESTED with a reason — never a fabricated pass.