Acceptable Scanning Policy
Only authorized testing of systems you control or have explicit permission to assess.
Before a scan
Verify control of every target with a DNS record or verification file and grant explicit consent. You must also have legal permission from the relevant organization and infrastructure provider. Technical control alone is not proof of every necessary legal authorization.
Active scenarios
SQLi, XSS, active CVE checks and state-changing scenarios require the supported staging profile, separate approval and appropriate test fixtures. Do not supply production accounts or real customer data for experiments. Respect rate limits and plan budgets.
Prohibited activity
No unauthorized access, theft of data, denial-of-service, credential stuffing, malware, evasion of scope controls or attacks on third parties. Do not upload arbitrary exploits or use the service to distribute sensitive findings publicly without permission.
Enforcement and contact
We may stop a run or restrict access to prevent abuse or respond to a legal obligation. Report suspected misuse to owner@scantelio.com. The Terms of Service govern use of the product; this policy explains the scanning rules.