Responsible Scanning Policy

ScanBastion sends requests to websites. That is only acceptable when the person running the scan is entitled to, and when the scan behaves predictably. This policy sets out the rules we hold our users to and the controls we build into the service itself.

1. Who may be scanned

You may only add a target to ScanBastion if one of the following is true:

• you own the domain, or
• you operate the website on the owner's behalf and the owner has given you explicit permission to run security assessments against it, or
• you hold a written engagement from the owner that covers automated vulnerability scanning of that domain.

"Permission" means permission from the person or organisation that controls the website, not from a hosting provider, a registrar or a content-delivery network. If you are unsure whether you are authorized, you are not.

2. How authorization is verified

Before any scan can run, a target must be verified. The planned first release verifies domain control with a DNS TXT record that you place at the domain. For a client domain, you will typically ask the client to add the record, which doubles as their acknowledgement that assessments will run.

During target setup you also confirm, in your own name, that you are authorized to assess the domain. That confirmation is recorded with the account, the domain and a timestamp. Verification is planned to be re-checked periodically, and a target whose record disappears is paused until it is restored.

3. What a scan does

Each scan runs under a named profile with a defined set of checks, so you know in advance what traffic a target will receive.

Across all profiles, the first release is designed to:

• keep request rates within fixed limits per target, so load stays predictable;
• stop each stage on a timeout, and report a stage that did not complete as partial rather than as clean;
• let you cancel a running scan at any stage;
• use only vetted templates. Templates that exploit a vulnerability, attempt denial of service, brute-force credentials, or modify data are excluded.

4. What a scan does not do

The first release is not planned to include active OWASP ZAP scanning, authenticated or logged-in testing, port scanning, scheduled or recurring scans, or any exploitation of findings. Scans are external and unauthenticated: they see what an anonymous visitor on the internet can see.

5. Prohibited use

You must not use ScanBastion to:

• assess a website you are not authorized to assess, or keep assessing one after authorization has been withdrawn;
• circumvent or spoof domain verification, or add a domain using DNS access you are not entitled to;
• gather information for an attack, or pass findings to anyone who is not entitled to them;
• present an automated scan report as a penetration test, a certification, or a guarantee of security;
• probe, overload or interfere with ScanBastion itself.

6. Enforcement

We may pause a target or suspend an account while we look into a complaint, and we may terminate accounts that break this policy. Where the law requires it, we cooperate with lawful requests from authorities. Scan records, including the authorization confirmation and the verification history for each target, are retained for this purpose.

7. If you operate a website and have a concern

If you believe your website was scanned without authorization, or you want a domain excluded, contact us at info@scanbastion.com or through the contact page, and include the domain and the approximate time. We will investigate and pause the target while we do. We are planning to publish the IP addresses scans originate from and to identify our scanner in the User-Agent header, so operators can recognise and, if they wish, block it.

8. Reporting a vulnerability in ScanBastion

If you find a security problem in this website or, later, in the service, please tell us privately first. Details are in security.txt. We ask that you avoid accessing other people's data, give us reasonable time to fix the issue, and do not run automated scanning against ScanBastion itself beyond what is needed to demonstrate the problem.

9. Limits of automated scanning

Automated results can include false positives and miss real issues. Coverage is limited to the chosen profile, the permitted templates and what is publicly reachable. A report with no findings means the checks that ran did not detect anything; it does not mean the site is secure. For assurance, commission a manual penetration test.

10. Changes

We will update this policy as the product takes shape, and will date each revision at the top of the page. Material changes after launch will be announced to account holders before they take effect.