What we will and will not run against your infrastructure.
We identify vulnerabilities. We do not attempt to exploit them, pivot through them, or extract data using them. Where a tool offers an exploitation mode, it is not enabled.
Denial-of-service checks are excluded in code rather than by configuration, and there is deliberately no setting that restores them.
We do not brute-force passwords, spray credentials, or enumerate user accounts. Where our tooling supports those behaviours they are disabled, and the options to re-enable them are not exposed.
The standard scan is calibrated to be safe against production systems. Web fingerprinting is rate limited, and concurrency is kept well below the defaults our tools ship with.
One intensive option exists — an exhaustive probe for known-bad web paths. It is off by default and must be deliberately purchased, because it is loud enough to trigger alerting and, on shared hosting, loud enough to affect a neighbour who authorised nothing.
We maintain a blocked list and will not scan against it regardless of the evidence supplied. We also refuse private and reserved address space on client engagements, since a scan of an internal range cannot be authorised by the person requesting it from outside.
An order that fails ownership verification is rejected. We do not scan on the strength of a tick-box assertion.
Last updated 18 August 2026.