Legal
Authorization and acceptable use
Northstead Security assesses websites only within the limits below. These limits are enforced by the platform itself, not only by this policy.
Free snapshot
A snapshot reads only what a web browser reads when it loads a page: the home page, the scripts and stylesheets it references, /robots.txt, /.well-known/security.txt, and public DNS records. At most 20 requests. It sends no payloads, guesses no paths and submits nothing. By requesting a snapshot you confirm that you own the website or are authorized to assess it.
Our requests identify themselves with a User-Agent beginning NorthsteadSecurity-Check and a link to this page. Website owners can opt out with a robots.txt group for NorthsteadSecurity-Check (or Penthera-QuickCheck) containing Disallow: /. Every snapshot reads robots.txt first and stops there if such a rule is present:
User-agent: NorthsteadSecurity-Check Disallow: /
Verified reviews
Any assessment beyond the passive snapshot requires (a) proof of control of the hostname, by a DNS TXT record or a file on the website, and (b) a scope authorization signed in the platform by an owner or administrator of the organization. The authorization records the hostnames, permitted methods, exclusions and validity period, along with who signed it, when, and from where.
Active testing
Active testing (injection probes, fuzzing, rate-limit checks, public-record reconnaissance) requires an authorization with a testing window and a request-rate limit, and is approved by Northstead Security before it runs. Nothing is sent outside the window.
Outreach snapshots
When Northstead Security contacts a business, any assessment we have performed beforehand is limited to the passive snapshot described above. We never perform deeper testing of a website whose owner has not verified control and signed an authorization.
What we refuse
- Internal, private, loopback, link-local and cloud-metadata addresses, and reserved names.
- Any target on our abuse denylist.
- Requests that exceed rate limits designed to protect target websites.
Your responsibilities
You are responsible for the accuracy of the authorization you give. Authorizing an assessment of a website you do not control may be unlawful. We may suspend accounts that misuse the service.
Stopping an assessment
You can stop a running assessment at any time from your dashboard; the scanner process is terminated within seconds.