Our scanner
What it is
Citadel Cyber runs passive security checks for people who own web apps, mostly apps built with AI coding tools. Our requests identify themselves with a User-Agent that starts with CitadelCyberScanner/1.0:
| User-Agent | When |
|---|---|
CitadelCyberScanner/1.0 (ownership verification) | Checking that the person who asked for a scan controls your site |
CitadelCyberScanner/1.0 (owner-verified passive scan) | The scan itself, after ownership is proven |
Only sites whose owner proved it
We don't scan a site until its owner proves control of the domain, either with a DNS TXT record at _citadel-verify.<host> or a <meta name="citadel-verify"> tag in the <head> of the site's root page. Each code is tied to one host and one email address and expires after 72 hours. A verified host stays verified for 30 days.
Before that proof exists, the only request your web server can get from us is the verification check: one GET to your home page (/), following at most 3 redirects on the same hostname, and only when the requester presses "Check". It's capped at 10 checks per request. The DNS check is a normal DNS lookup and doesn't touch your web server.
What a scan does
Scans are passive. They only make requests an ordinary browser visitor could make:
- your home page, its security headers, cookies and TLS certificate
- public DNS and email records (SPF, DMARC)
- the JavaScript files your page loads, up to 8 of them
- a fixed list of public paths:
robots.txt,sitemap.xml,/.well-known/security.txtand common accidental exposures (/.env,/.git/HEAD,/config.json), one GET each
There are no logins, no form submissions, no fuzzing or exploit attempts, and no load testing. If an exposed file contains a secret, we record only the status code and the kind of pattern that matched. We never store the file's contents or the secret.
Hard limits per scan
| Limit | Value |
|---|---|
| Requests to your site | At most 25 |
| Rate | At most 1 request per second |
| Total time | 60 seconds, then the scan stops |
| Data downloaded | 10 MB in total |
| Redirects | Followed only on the same hostname, HTTPS only |
| How often | At most 1 free scan per host per 24 hours, and 4 per month, no matter who asks |
| Where we connect | Public IP addresses only, ports 80 and 443 only |
Report or opt out
- Opt out or report abuse: email [email protected] with the domain (and, if you have them, the time and IP from your logs). We add opted-out domains to our denylist, which blocks both scans and new scan requests for them.
- Block it yourself: drop or deny requests whose User-Agent contains
CitadelCyberScannerat your firewall, CDN or web server. If we're blocked, the scan stops and its owner gets a partial report. - Other questions: [email protected].
Security researchers: our vulnerability contact is also in /.well-known/security.txt. See our Terms (section 5) and Privacy Policy (section 10) for the rules every requester agrees to.