Authorized testing policy
A penetration test without permission is an attack. These are the rules that keep ours a test.
Proof before testing
The deep test runs only after the domain proves it’s yours: a DNS TXT record with a code we give you (covering the domain and its subdomains), or a file or meta tag on the website (covering that host only). We check the proof when you verify, and again before any retest more than an hour later. Without it, only the free, passive scan is available.
What we refuse
- Domains whose addresses are private or reserved, IP addresses typed in place of a domain, and addresses inside our own cloud.
- Testing hosts outside what you verified: a file on www.example.com doesn’t cover example.com’s other subdomains.
- Network addresses that belong to a CDN or cloud edge rather than to you: we skip port tests there.
How we test
Non-destructively and politely: we prove a weakness and stop, we don’t guess passwords, we don’t generate load, and every request identifies itself as PentrailScanner/1.0 (what that is).
Third-party services
If your site runs on a hosting provider or CDN, their acceptable-use rules may also apply to testing. Most allow customers to test their own resources; check yours if you’re unsure.
Report misuse
If you think someone verified a domain they don’t control, write to security@pentrail.thetowers.ai.