Scan Consent & Authorisation

What the scan is

When you submit a URL, Prodable makes ordinary web requests to it and inspects what comes back — the way a browser or a search engine crawler would. It is read-only and non-destructive. We look at your public surface only; we do not see inside your database, your backend, or anything behind a login.

You must be authorised

Your responsibility

Only submit a URL you own or are authorised to have security-tested. Scanning a site you don't control may be unlawful, and that responsibility is yours, not ours. By running a scan you confirm you have the right to test that target.

What we look at

Across roughly 48 checks in several categories, the scan inspects things like:

›Transport / TLS — whether HTTPS is enforced and configured well.
›HTTP headers — security headers such as CSP, HSTS, and clickjacking protection.
›DNS & email hygiene — public records such as SPF, DMARC, DNSSEC, and CAA.
›Public files — we request a short list of commonly-exposed paths (for example /.env or /.git/HEAD) to check they aren't publicly readable.
›Client-side code — the JavaScript your site already serves to every visitor, checked for secrets accidentally shipped to the browser.
›Configuration & privacy — CORS settings, cookie flags, and the presence of third-party trackers.

What we never do

›We do not log in, guess passwords, or brute-force anything.
›We do not attack, exploit, overload, or attempt to break your site.
›We do not change, delete, or add any data.
›We only read what your server already makes publicly available.

Targets we may decline

To keep the scanner responsible, we may refuse or block certain targets at our discretion — for example government domains or third-party sign-in pages that aren't yours to test.

What a scan stores

A scan records the target URL, your IP address (for rate-limiting), the findings, and — only if you choose to unlock the full report — your email address. Full detail is in our Privacy Policy. To keep the service fair, scans are rate-limited per IP.

A clean scan is not a guarantee

A good score means we didn't find the issues we check for from the outside — not that your app is free of all vulnerabilities. Security is ongoing, and a deeper look (the Fix, with your access) covers what an external scan can't reach. See our Terms of Service for the full picture.