What a scan is allowed to do
Reads only, nothing written, nobody logged in - and one bounded active probe, with its rules written down.
- Every request is one an anonymous visitor could make.
- Nothing is written, nothing is submitted, no state-changing request is sent.
- No account is used and no login is attempted.
- Requests are rate-limited, carry a scanner user agent, and back off when a site struggles.
- Only the origin you submitted is scanned, after it has been validated.
The one active check
To prove that a data API answers anyone, something has to ask it. The access-control probe replays a request your own page already made, using the public key your own page already ships, a bounded number of times - and records only that the data was readable, never the data itself.
The scanner behaves like a careful visitor, but permission to point it at a system is yours to have. Do not scan somebody else’s application.
Questions
Could a scan break my site?
It is bounded, rate-limited and read-only, and it backs off rather than pushing through. It behaves like one careful visitor, not like load.
Will it trip my WAF?
It might, because it fetches paths like /.env to see whether they are exposed. That is the check. If you allowlist the scanner, remember you are also hiding real exposure from yourself.
Does it read data returned by my API?
It records that a response was readable and classifies whether it looked like personal data. The contents are not kept.
Something here wrong, missing or out of date? Tell us and we will fix the page.