You found us in your logs.

It ran 65checks against the URL it was given. In practice that’s a few dozen ordinary GET requests over two or three seconds: the page itself, some well-known paths like /robots.txt and /sitemap.xml, and a TLS and DNS lookup for the host.

Requests are made one at a time, not in parallel. We don’t think firing a burst of concurrent connections at someone else’s server counts as read-only behaviour, whatever the response codes say.

• It did not attempt to log in, or guess any credential.
• It did not submit a form, or send anything other than reads.
• It did not try to exploit anything it found. Where a check looks for an exposed file, it requests the path and reads the status code — nothing more.
• It did not change anything on your site.

We read your robots.txt— it’s one of the things we report on — but we do not treat it as permission to fetch the page, because this isn’t crawling. Every request happens because a person entered that URL and pressed a button, once, and waited for the result. It behaves like a browser, not a spider, so it’s scoped the way a browser is.

Reasonable people disagree about that. If you’d rather we stayed away regardless, the next section is under your control and takes effect immediately.

Match on the user-agent above — the token Shipleakis enough — and refuse the request at your CDN, WAF, or server. We send it on every request, we don’t rotate it, and we won’t work around a block.

A 403is the clearest response. We won’t retry it, we won’t come back from a different address, and we won’t change the user-agent to get around you.

Email security@shipleak.comwith the timestamps from your log and we will look at it the same day. If our scanner behaved badly against infrastructure you run — too many requests, a path it had no business touching, anything that looks like more than a read — we want to know, and we’ll say so publicly if we got it wrong.

For anything else, hello@shipleak.comreaches us. The rules we hold users to, including that they may only scan sites they’re entitled to scan, are in the terms of use.