The rules for using Scan.now

The service

Scan.now is operated by Targa Limited and provides passive security checks, bounded owner-authorised active tests, paid scanning subscriptions and educational content. It is offered as is, without warranty. A clean result is not a guarantee that a site, browser or file is secure; a finding is not proof of a vulnerability. You are responsible for decisions you make based on a report.

Acceptable use

• Scan websites you own, operate, or have permission to assess, or public sites you are evaluating as a user. The checks are read-only, but you remain responsible for complying with the laws that apply to you.
• Do not use the scanners to harass a site operator, automate around the built-in paid 10-site bulk limit, or circumvent rate limits.
• Do not upload files you do not have the right to share for analysis. Uploaded files are not stored.
• Do not attempt to make the scanner reach private, internal or non-public addresses.

What a scan actually does to the target

This matters for whether you are allowed to run one. Passive scans request pages, follow redirects, open TLS connections, resolve DNS and request a short fixed list of public paths. Dedicated active tools send the bounded check-specific input described on their page only after you confirm ownership or explicit permission; path traversal, SSRF and authenticated checks additionally require verified control of the hostname. They never guess credentials, submit forms, extract data or change the target. How we scan lists what each scanner sends.

The LLM scanner requires an ownership or permission confirmation because it checks additional common exposure paths. Premium deep scans crawl discoverable pages on that authorised site, within the selected plan limit and while honouring robots.txt. A signed-in paid owner may supply one Authorization or Cookie header for a known private URL; authenticated mode is single-page and is not combined with a crawl. You must have the right to use that credential. It is used for read-only requests during that scan, removed before cross-origin redirects and never stored.

Outreach audits are intentionally narrower: They may check a public page, its linked same-origin client assets, and a small robots-aware SEO sample before a notification is sent, but they do not probe unlinked LLM-secret paths or authenticate. The email reveals only whether a recognisable public LLM key was detected. Sensitive locations remain restricted to a paid account whose verified email matches the recipient address.

Rate limits

Limits are applied per address, and they are generous for a person and tight for a loop. A full website scan is limited to 12 an hour and 3 a minute; a deep crawl to 6 an hour; a file scan to 8 an hour. Hitting a limit returns HTTP 429 and costs you nothing. Automating around the limits — rotating addresses, distributing requests — is the one thing in these terms that will get an address blocked rather than throttled.

Scanning a site you do not own

The checks are the ones any visitor’s browser performs, so running them against a public site is not an intrusion. That is a statement about what the tool does, not legal advice about your jurisdiction, and it does not extend to using the results to pressure or embarrass an operator. If you are scanning on a client’s behalf, have their permission in writing, as you would for any assessment.

Reports

Reports are stored for 30 days at a link that is not listed anywhere. Anyone with a general report link can view that report. LLM key locations remain visible only to the paid account that created the report; other viewers receive the YES or NO projection. Do not share other report links if you do not want those results seen.

How report links behave

• They are unguessable, not secret. The token is random; treat the link like a password.
• They are served noindex and excluded in robots.txt, so they do not appear in search results.
• They expire after 30 days and are deleted, not archived.
• They can be deleted sooner on request, with no account and no proof of ownership required — send the link through the contact form.

Paid plans

Scans of up to 25 pages are free, subject to a daily allowance per visitor that we may adjust to keep the service usable for everyone. A paid plan removes that daily allowance entirely. Rate limits still apply on every plan — not to ration what you have paid for, but because these requests land on somebody else's server and no plan is a licence to overload one. Paid plans exist for auditing a whole site rather than a sample, and buy scale only: The same checks run at the same severities whether you have paid or not, and a paid report is stored and deleted on identical terms. Credits are consumed when a full audit completes; an audit that fails or is cancelled costs nothing, and unused credits do not roll over.

Premium access begins when Stripe confirms the first payment. Monthly subscriptions renew monthly and annual subscriptions renew yearly on the date Stripe shows at checkout and in the billing portal. The payment method on file is charged automatically at each renewal unless the subscription is cancelled beforehand. Credits reset at renewal and do not roll over.

You can cancel at any time from the Stripe billing portal linked from your account. Cancellation takes effect at the end of the paid billing period, and access continues until then. A charge is refundable when no paid feature has been used during the period it covers; the definitions and request process are in the refund policy.

Content

Guides and reference pages are © Scan.now. You may quote short excerpts with attribution and a link. The browser extension is released under the MIT licence; its source is included in the download.

Availability and changes

We may change, rate-limit or withdraw any tool at any time. We may block addresses that abuse the service.

Liability

To the fullest extent permitted by law, Scan.now is not liable for any loss arising from use of the service or reliance on its output.

Contact

Questions about these terms go to the contact form. Scan.now is operated by Targa Limited.