Limit destinations
Domains are validated and private, local, or reserved addresses are rejected so the reading stays within the intended public space.
SÉCURITÉ / Service security
How Scanapse protects the service
Reading a public domain means handling inputs that Scanapse does not control. Service security therefore starts with a simple rule: reduce the scope, revalidate each step, and refuse destinations that do not need to be reached.
Safeguards
Four protection families
Detailed controls remain available below, but their purpose can be understood without knowing the internal implementation.
Control connections
DNS resolutions and redirects are revalidated, ports are bounded, and secure connections verify the presented host name.
Limit resources
Timeouts, response sizes, redirects, and frequency are bounded so a reading does not monopolize the service or become aggressive.
Protect the output
Reports, forms, and assets use validation and integrity mechanisms so the public output does not expose internal service secrets.
See the technical controls currently applied
- Strict ASCII domain validation and rejection of IP literals
- Blocking of private, local, reserved, multicast, and documentation ranges
- Connection pinned to the validated public DNS address
- Every redirect revalidated and ports limited to 80/443
- TLS certificates verified with SNI and host name
- Short timeouts, capped response size, and limited redirects
- Stateless CSRF tokens, HMAC-based rate limiting, and per-domain lock
- HMAC-signed reports, atomic writes, and private directories blocked from the web
- Strict CSP, no third-party resources, no inline scripts, and SRI on assets
What this page does not promise. It describes safeguards implemented in the application as delivered. It is not a security certification and does not replace hosting security or an independent review.