Authorised targets only
The full engine is for domains you own or are explicitly authorised in writing to assess. The public sandbox is limited to five reserved test domains, each published for that purpose.
Responsible use
A scanner that is proud of what it refuses to do.
Six commitments the project is built around. Each one is enforced by the runtime or the reporting model, not just stated in a policy document.
Responsible use commitments
The restriction is enforced, not requested
The five-domain allowlist lives in the runtime. A look-alike subdomain, an alternate port, a raw IP address or a trailing dot is rejected before a network request is made.
No claim without evidence
A finding quotes the record, header or handshake behind it. Silence from the network is reported as inconclusive, never converted into an invented failure.
No exploitation
SMB is identified with a single unauthenticated negotiate that reads dialect and signing requirements. There is no login, no share listing, no fuzzing and no payload.
Consent before action
Each sandbox run records a hash-chained receipt on the operator's machine before any lookup. The receipt travels with the report.
Not a commercial audit
A sandbox report is a lesson and a demonstration. It is not a certificate that a business is secure, and it must not be presented as one.
Authorisation
If you cannot answer "who said yes?", do not run it.
Assessing a system you do not own can breach computer-misuse law in most jurisdictions, regardless of intent. The five public domains exist precisely so that learning does not require that risk.
- OwnershipYou own the domain and the infrastructure behind it.
- Written permissionOr the owner has given you documented authority to assess it, for a defined scope and period.
- Scope clarityHosting providers, CDNs and managed platforms may be separate parties — their terms apply too.
Licence and acceptable use
The published code is MIT licensed. That licence governs the software itself — it does not grant permission to test third-party infrastructure, and it does not turn a sandbox report into a commercial audit.
The public edition is restricted to five testing domains. Attempting to bypass, modify or circumvent that allowlist, or to extract the protected runtime, is outside the acceptable use described in the privacy policy.
If you receive a report about your domain
Ask who ran it, under what authority, and at what time. A legitimate report names the target, the scanner version, the timestamp and the consent receipt used. Without those, treat it as unverified.
Reporting a concern
If you believe this project or its documentation has been used irresponsibly, contact the maintainer with the details. Concerns about misuse are treated as priority correspondence.
Teaching with it
The sandbox edition exists for teaching and demonstration. The five reserved domains make it safe to run in a classroom without touching anyone else's infrastructure.
Use it where you have the right to use it.
For anything outside the five public domains, request an assessment and start with authorisation.