About the devsecurity scanner
If you saw requests from us in your logs, this page explains what they were.
How to recognise us
Requests identify themselves with this user agent:
devsecurity-scanner/1.0 (+/about-scanner)What it does
- Fetches the public front page over HTTP and HTTPS
- Reads response headers, cookies and public HTML
- Inspects the TLS certificate, chain and protocol versions
- Compares detected software versions with published vulnerability records
- Uses ports 80 and 443 only, with strict size, redirect and time limits
What it does not do
- No exploitation, login attempts or password guessing
- No port scanning or access to internal networks
- No fuzzing, crawling beyond the front page, or load testing
- No scanning without the requester confirming they are authorized
Not expecting this?
Scans only run when someone confirms they are authorized to assess the website. If you did not expect one, or you want your domain excluded, contact us with your domain name and we will follow up.