The network boundary comes first
A scanner should not become a proxy into private infrastructure. Our request path normalizes URLs, rejects credentials and nonstandard ports, checks all resolved addresses, pins a validated IP to the connection and verifies redirect destinations. Local, private, link-local, reserved and metadata targets are blocked. DNS checks without connection pinning leave a gap between validation and use.
Bound the work
Every scan has request, response-size and time limits. It reads robots before content, identifies itself and stops on access restrictions. It parses static responses without running JavaScript or forwarding user cookies. Checkout, cart, account and action paths are excluded. These limits reduce scope as well as abuse opportunities; a large or dynamic store may produce Cannot verify publicly.
Keep output inert and private
Untrusted page content is parsed into short text findings and rendered as text. The result is not a new public page. You may explicitly save or download your report; this does not publish it to a benchmark. A security failure blocks release regardless of visual quality or test counts elsewhere.