Scanner Policy
Effective date:
Access and authorization
SecurityFuse is an informational scanning and reporting tool operated by Digital Magnet Corporation.
SecurityFuse is available by invitation and sign-in, subject to the residence restrictions in the Terms. Hosted website scanning is not currently enabled. The authorization and allowance requirements below apply when supported scanning is enabled.
When enabled, Quick will require authorization attestation, Deep will also require current ownership proof, and any offered repository work will require separate grants and processing authorization.
Anonymous scanning and public hosted repository access are not currently offered.
Scanner identification
When scanning is enabled, the scanner will identify itself as SecurityFuse/0.2 (+https://securityfuse.com/trust/scanner).
Limits
Quick’s limits are one HTML page, two scripts, ten target contacts and ninety seconds.
Deep’s limits are thirty HTML pages, twenty scripts, two hundred target contacts and six hundred seconds.
These are limits that apply when hosted scanning is enabled, not completion-time or response-time promises. Limits on requests to a target are distinct from customer scan allowances.
When scanning is enabled, redirects, retries, proof and verification contacts count against target-contact budgets; DNS and advisory work have separate bounded limits.
Scope and exclusions
When enabled, supported website collection will be restricted to the exact authorized public HTTPS origin and supported resources, rejecting credentials and private or reserved destinations.
We do not provide authenticated-browser testing, form submission, mutation requests or active exploitation. Repository code is not executed. Hosted scanning is not enabled.
When enabled, Quick will inspect a bounded homepage and script sample. Deep will add a bounded same-origin crawl and supported exposure evidence. These descriptions are not an invitation to start a hosted scan.
The default deterministic website-scanner path leaves model analysis unassessed and contains no model invocation.
Optional AI processing stays disabled for the initial invitation beta and cannot be enabled by this public site.
DNS and repository capabilities are not represented as public hosted services and need their applicable authorization and operational checks before enablement.
Reading evidence and rechecks
A report describes checks performed, assessed resources and observation time, keeping observations, inferences, coverage gaps and comparison states distinct.
A missing header alone does not establish exploitability, and an unassessed area is not a pass.
Configuration scores summarize assessed settings and must be read alongside coverage; a report or absence of findings does not certify safety, compliance or completeness.
You decide how to act and must review and test repair guidance; a repair statement is not fresh evidence.
A comparable authorized recheck may show a finding still observed, no longer observed or inconclusive, and does not approve an application.
The sample report is from an owned test site with a fictional display target, is not customer evidence and launches no scan.
Concerns, withdrawal and target opt-outs
The owner monitors security@securityfuse.com for abuse, vulnerability reports and owner opt-out requests.
We aim to acknowledge messages within three business days, excluding weekends and Ontario public holidays and using America/Toronto local time, without a fixed resolution or exclusion-completion promise.
Credible ongoing unauthorized scanning or immediate harm is prioritized without a promise of continuous monitoring or emergency-response times.
The owner reviews target opt-out requests manually and may ask for DNS, website-file or other appropriate authority evidence; the request covers only the demonstrated scope.
Hosted scanning is disabled. The owner handles exclusion requests manually; no automated cross-account exclusion or running-scan stop service is represented as operating.
The owner manually reviews fresh authority before removing an exclusion.
Send individual withdrawal requests to hello@securityfuse.com. The owner handles the stated grant or scope manually; unrelated grants and existing records remain subject to their own authorization, retention and deletion limits.
Vulnerability reports
Report vulnerabilities in SecurityFuse itself privately to security@securityfuse.com; neither reporting nor security.txt authorizes deliberate testing without separate written scope and permission.
No bug-bounty reward or safe-harbor commitment is offered during beta, and public use of customer findings or aggregate research needs separate review and required permissions.
Security contact file
Our contact file at https://securityfuse.com/.well-known/security.txt identifies security@securityfuse.com and states its expiry. It does not grant permission for testing.
The owner maintains and renews the published contact file before expiry.
The contact file uses the canonical URL https://securityfuse.com/.well-known/security.txt and the contact mailto:security@securityfuse.com.