News
Consent-Based URL Scans vs Unsolicited Probing
August 2, 2022
Consent-based URL scans vs unsolicited probing is the difference between a self-audit and someone else's problem. RoastMyOpsec is for a public HTTP URL you assert you control. Checks are reads, OPTIONS, bounded path GETs, and DNS — not exploit payloads, not password sprays, not private-network mapping. Localhost and RFC1918 targets are blocked. Pasting a competitor, a random government site, or a customer's staging host you do not own is outside the product. A security.txt Contact is how strangers report issues to you; it is not a voucher to run our scanner against them.
The practical difference
Consent here means you are the operator (or have written authorization) for that origin. Unsolicited probing is scanning hosts because they are interesting. The roast cannot see your contract with a client; the Terms still require you to only submit targets you are allowed to audit.
A pentest SOW is a different consent artifact — scoped, often authenticated, sometimes with exploit proof. See defensive audit vs penetration test.
How to choose what to paste
Your production marketing host and the app origin you run: yes. A vendor's SaaS login you merely use: no, unless they invite you. Internal hostnames that should never be public: do not paste them to a cloud scanner. If DNS is not global, the scan will fail closed — that is a feature.
| Target | Consent-based roast | Unsolicited probe | Takeaway |
|---|---|---|---|
| Your public www | Yes | N/A — you own it | This is the product |
| Competitor homepage | No | Don't | Not research; against Terms |
| 127.0.0.1 / 10.x | Blocked | Still wrong on our cloud | Wrong tool |
| Client site with a signed SOW | Only if they authorized this scanner | SOW ≠ our Terms | Get it in writing; still no exploits here |
What 'blocked' and 'defensive' mean
The scanner refuses private IPs and localhost so you cannot use us as a pivot. Findings are headers, files, DNS, and scripts that already showed up on the public internet. Hostile Origin for CORS is a request header, not a stolen session.
If you need someone to break in, hire a pentest. If you need a punch list on a costume you own, roast it.
Common mistakes
The first mistake is scanning a site because security.txt invited reports — that invites email, not our bot.
The second mistake is pasting a preview URL that is supposed to be secret.
The third mistake is treating a 10/10 roast as a license to scan the rest of the internet.
Free audit the URL you own
RoastMyOpsec is a defensive public-surface roast: headers, cookies, sensitive paths, and more — no exploit payloads. Start with the free audit, then open the vault if the blurred findings look expensive.
Free audit nowFAQ
- Can I roast any public URL?
- Only URLs you are authorized to audit. Public reachability is not consent. See the Terms.
- Is RoastMyOpsec hacking?
- No. It is a defensive, consent-based read of public responses. No exploit payloads.
- Why was my internal hostname rejected?
- Private and loopback targets are blocked on purpose. Use a public origin you own, or a pentest scoped to that network — not this product.