Security
How we keep scanning safe — for you and for the targets
This page describes the controls we run. We describe them plainly and we do not claim certifications we do not hold.
Scanner behavior
What our scans do and never do
What our scans do
- Only contact targets that are verified (ownership proven) and covered by an authorization record. The one exception is the free check: a small, fixed, read-only set of requests to a public hostname you enter (see the Scanner page for the exact list)
- Run on isolated workers with no database credentials, egress filtering (no private, loopback, link-local or cloud-metadata addresses) and pinned-IP connections with DNS-rebinding defence
- Respect hard ceilings: ≤ 5 requests/s, ≤ 2000 requests, ≤ 30 minutes, ≤ 8 redirects, ≤ 2 MiB per response, ≤ 4 concurrent connections
- Identify themselves with a clear User-Agent linking to this page
- Redact secrets (authorization headers, cookies, tokens, API keys, passwords) before results leave the worker, and again server-side
What they never do
- Credential guessing, form submissions that create or modify data, file uploads
- Payloads that execute or persist, resource exhaustion, exploitation
- Run scans on the customer-facing API servers in the production configuration (only isolated scanner workers open connections to targets)
- Retaining page content beyond a ≤ 512-character excerpt around an observation
- Contacting any address that is not public
In the production configuration, scanning never runs on the application servers: only isolated scanner workers with no database credentials open connections to targets. On the single-VM development and staging layout the workers run on the same host as the application, as separate processes without database credentials. Automated scanning is not a penetration test.
Scanner User-Agent
TasScan/1.0 (+https://tasscan.com/security; authorised assessment)The User-Agent configured for this deployment.
Scanner egress addresses (allow-listing)
Egress addresses are provided on request by TAS Group LLC: security@tasscan.com. No address list is published for this deployment.
To stop the free check running against your domain, publish a DNS TXT record at _tasscan.<your-domain> with the value tasscan-optout=1. Scans you launch yourself on a verified asset are not affected.
Platform controls
How customer data is protected
- Tenant isolation, twice. Every query is scoped to your organization in the application and again by PostgreSQL row-level security; automated tests assert that one organization can never read another's data.
- Authentication. Argon2id password hashing, minimum 12 characters with breached-password checks, email verification before login, TOTP two-factor authentication with recovery codes, opaque server-side sessions with rotation, lockout after repeated failures.
- Browser protections. HttpOnly, Secure, SameSite cookies; CSRF double-submit tokens and origin checks; a strict nonce-based Content-Security-Policy, HSTS and frame denial on every web app.
- Separate administration. The operations portal uses a separate identity domain, separate database role, mandatory MFA, short sessions and step-up authentication for high-risk actions. Every administrative read of customer data is audited.
- Audit logging. Append-only audit records with actor, action, target, IP, user agent and request id; protected against update and delete in the database; exported nightly.
- Evidence and retention. Raw scan results are stored encrypted in object storage for a limited retention window; findings keep only redacted excerpts; free-check results are deleted when they expire (24 hours by default, set by the platform operator).
- Transport and secrets. TLS everywhere, secrets injected from a secret store — never in images or source.
We are not currently certified against SOC 2, ISO 27001 or similar frameworks and do not claim to be. If that changes we will say so here.
Free Security Check
Opting a domain out
The free check performs the small, fixed set of read-only requests described on the Scanner page, at most once per domain every 10 minutes. Anonymised means the visitor: your IP address is stored only as a keyed hash that drives the rate limit, and nothing links a check to an account. The checked domain name is stored with the result, and the result contains only the score, severity counts, short finding titles, technology names and a TLS summary: no evidence, URLs or page content. If you would like us not to run it against your domain at all, email security@tasscan.com from an address at that domain, or publish a DNS TXT record at _tasscan.<your-domain> with the value tasscan-optout=1. Opt-outs never affect scans that the domain's verified owner launches from their own account.
Responsible disclosure
Found a vulnerability in TasScan?
We welcome reports about our web applications, APIs, scanner behavior and published container images. Please read the disclosure policy and send details to security@tasscan.com. Our security.txt lists the canonical contact. We do not publish a PGP key; if you want to send details encrypted, say so in your first message and we will arrange a secure method.
- Do not access, modify or exfiltrate data that is not yours; use test accounts.
- Do not run denial-of-service tests or automated scanners against production at volume.
- Give us reasonable time to fix before public disclosure; we will acknowledge within 3 business days.