Scanning policy

What we do, what we never do, and how to make us stop.

If you found this page because of traffic in your logs, email amitmudaliar143@gmail.com with the domain and we will remove it permanently, usually within one business day. You do not need to explain why and we will not ask.

Two kinds of check, and the difference matters

Free check — no authorisation, minimal footprint

When we produce a free report for a website we have not been engaged by, we limit ourselves to:

Public DNS records, queried from public resolvers — never from your server.
Public domain registration records, via RDAP at the registry.
A standard TLS handshake, the same one every browser performs.
A single request for your homepage, and optionally /robots.txt and /.well-known/security.txt — files published for retrieval.
At most one further request, only to a "contact" page your own homepage links to.

That is a maximum of five HTTP requests, identical in shape to a person visiting your site once. We identify ourselves honestly in the User-Agent header on every request, with a link back to this page.

Full scan — only with proof and permission

An active scan runs only after both of the following, and stops the moment either is withdrawn:

The customer proved control of the domain by publishing a DNS TXT record we generated.
The customer accepted a written authorisation. We store their email address, IP address, timestamp, and a cryptographic hash of the exact wording they agreed to.

What we never do

Port scanning of any kind, on any target, authorised or not.
Password guessing, credential stuffing, or any login attempt.
Denial of service or load testing.
Accessing, copying, altering or deleting data.
Probing paths on unauthorised sites — no guessing at admin pages, backup files or configuration files.
Continuing after someone asks us to stop.

Contact and email

Where we email a business about a finding, we use an address that business published on its own website or in a public directory. We never guess addresses. Every message carries a working one-click unsubscribe, and unsubscribing is permanent — not a pause. We send at most three messages and then stop regardless of whether anyone replies.

Removal

To be excluded from everything permanently, email amitmudaliar143@gmail.com from any address at the domain, or use the unsubscribe link in any message you received. The domain goes onto a suppression list that every stage of our system checks before acting.

Security researchers

Reports about our own infrastructure are welcome at amitmudaliar143@gmail.com. Our security.txt is published.