About SamtaroScan

Automated scan of publicly visible website signals. Not legal advice, not a security audit or penetration test.

User-Agent

SamtaroScan/1.0 (+https://samtaro-security.pages.dev/scanner)

Free mini-scan (anyone who confirms they're authorised)

• One request to the homepage over HTTPS, one HTTP request to check the redirect, and a request for /robots.txt.
• Public DNS lookups (SPF, DMARC) through a public resolver.
• No other paths, no forms submitted, no logins, no exposed-file checks.

Full scan (owner-verified domains only)

• Runs only after the domain owner proves control with a DNS TXT record (samtaro-verify=<token>), a file at /.well-known/samtaro-verify.txt, or a reply from an admin address at the domain.
• Up to 10 public pages, at a low request rate (at most about one request per second), in a single pass, respecting robots.txt.
• A headless browser loads pages without accepting cookies, to see what loads before consent.
• A short list of common sensitive paths (for example /.git/HEAD, /.env) is checked for existence only, using the HTTP status code. Contents are never downloaded, read or stored.
• No exploitation, fuzzing, brute-forcing, port scanning or authenticated testing.

What we never do

• Scan government or state-affiliated domains without verified owner consent.
• Publish results about any named website or business. Reports go only to the verified requester.

Opt out

• Add this to your robots.txt: User-agent: SamtaroScan then Disallow: /. Both the free and full scans respect it.
• Or email [email protected] with the domain. We add it to our block list.

Report a concern: [email protected].