How BlueSwarm tests your app.
Read-only tests, verified ownership and plain evidence. These are the rules the scanner follows on every request.
Permission first
We only test a site after its owner has verified it and accepted the terms. An agency can verify on a client's behalf. We check again before every scan.
Reads, not writes
Requests are GET and HEAD. The one POST we send asks a storage bucket for its file list. We never create, change or delete records.
A small footprint
No more than 2 requests a second and 300 a scan, each with a 10 second timeout. We follow at most 3 redirects and check each one.
Only your site and its database
Requests go to the domain you verified and the Supabase project named in your own code. Nothing else, and never internal or private addresses.
Your keys stay yours
We use only the public key your app already ships. Admin keys and third-party keys we find are never used or tested, and we keep a fingerprint, not the key.
No content kept
We throw away every response after reading it. What we store is counts, hashes and the path that answered.
Spotting our requests
Every request carries this user agent, so you can find us in your logs or allow us through a firewall.
BlueSwarmScanner/1.0 (+https://blueswarm.co.uk/scanner)
IP addresses
We will publish our fixed scanner addresses here before live scanning opens.
Questions or concerns about a scan? info@mithos.co.uk
Read the terms