Scanning & authorization

CyberGuard is built to be safe to point at a live website. This page explains exactly what it does to a platform, what it never does, and how to reach us if you believe it’s checking a site without permission.

Daily monitoring: looking, not touching

Once a day, CyberGuard visits each registered platform the way an ordinary visitor or a search engine would. Every check is passive: it reads public pages and public DNS records and changes nothing. A platform sees a few dozen ordinary requests per day, sent from our hosting provider’s servers. The checks are:

• Uptime — whether the site answers, and how quickly.
• HTTPS — whether plain-http visitors are sent to the secure version.
• SSL certificate — certificate validity, expiry date and encryption strength.
• Security headers — which protective browser headers the site sends.
• Sensitive files — whether a short list of well-known files (like .env or .git/config) is publicly downloadable.
• Server fingerprint — whether the server advertises its software versions.
• Email & DNS security — SPF, DKIM, DMARC and CAA records — public DNS lookups.
• Session cookies — the security flags on cookies the public pages set.
• Dependencies — for a linked repository: known vulnerabilities in the packages it uses.
• Secrets in public files — whether publicly reachable files contain anything that looks like a key or password.
• Config files — whether common environment or configuration files are exposed.

What monitoring never does

• Try to log in, guess passwords, or use any account.
• Send attack payloads, submit forms, or change data on the site.
• Port-scan servers or probe internal networks.
• Block, slow down or sit in front of anyone’s traffic.

Who may register a platform

Only someone who owns the platform, or has the owner’s permission to monitor it, may add it to CyberGuard. That is a condition of our terms of service.

Active testing (Red Team) — written authorization only

CyberGuard also contains deeper, active security tests. They are kept separate from monitoring and run only when all of these are true: the organization’s plan includes active testing; an owner has recorded written, time-limited authorization for that specific platform; the person running the test has the right role; and they confirm the exact target before every run. Every run is logged. Active testing is currently switched off in production.

Think we’re checking your site without permission?

Email security@gusforce.ai with the address of your site. We’ll confirm who registered it and stop scanning it promptly if they weren’t authorized.