Trust model
What crosses the boundary.
A scanner asks for network position and a view of every request your application serves. This page says exactly what that means in our case, so the answer is on the record rather than in an email thread.
Two components, one direction of travel.
The agent
- Runs Chromium against your application and executes one instruction at a time.
- Enforces scope locally — it refuses any host you have not verified, whatever it is told.
- Redacts obvious secrets before anything leaves the machine.
- Holds no checks and no planner: it cannot decide what to test.
- Source-available, so the two files that decide those things can be read:
agent/scope.py,agent/redaction.py.
The engine
- Plans the crawl, chooses the checks, evaluates evidence, writes the report.
- Never connects into your network. It cannot: it has no route and accepts no inbound session from us to you.
- Sees what the agent reports — observed requests, responses and DOM state for the hosts you authorised.
- Proprietary. This is the half you are trusting, and the boundary above is what limits it.
The agent opens an outbound HTTPS connection, asks for its next instruction, and posts back what it observed. There is no inbound rule, no port to expose and no path from us into your network.
Authorisation before anything is touched.
A host cannot be scanned until you have proved you control it, by publishing
a DNS TXT record at _sekuscan-verify.<host> or a
file at /.well-known/sekuscan-verify.txt. We record which key
verified which host, by which method, and when.
That record exists for your protection and ours. A scanner that will point anywhere is a liability its customer inherits, and the audit trail is what answers the question if it is ever asked.
Reporting a vulnerability in SekuScan.
Send it to security@sekuscan.com. We will confirm receipt, tell you what we found when we have looked, and credit you unless you would rather we did not. Our machine-readable policy is at /.well-known/security.txt.
If a vulnerability in SekuScan is being actively exploited, we notify ENISA through the EU Single Reporting Platform within 24 hours, as the Cyber Resilience Act requires of us.
Unauthorised scanning is the one thing that will end an account immediately. Report abuse to abuse@sekuscan.com.