Security scan

A security scan checks a website you are authorised to test and reports findings you can review.

From domain to findingsYou add a domain and publish a DNS record that ZeroLog names. Once control is confirmed you pay CHF 20 for the scan. The scan runs as a background job in your workspace, repeating plan, act and observe, with only verified hosts reachable. A finding is recorded only with a working proof-of-concept. You read the findings; for your own workspace or a built site you can start a fix job.noyesAdd your domainPublish the DNS recordZeroLog namesTXT or CNAME at_zerolog-verifyControl confirmed?No scan; checked again later,scans stop if the record goesPay CHF 20 for this scanBackground job in yourworkspaceplan, act, observe, repeatonly verified hosts reachableFinding counts only witha working proof-of-conceptYou read the findingsOptional fix jobown workspace or site only
A scan starts only after the DNS proof and the per-scan payment, and a finding counts only with a working proof-of-concept.
Diagram as text
  1. You add the domain under Security scan, Prove domain ownership.
  2. You publish the DNS record ZeroLog names: a TXT record or a CNAME at _zerolog-verify under your domain. An A record alone is not accepted.
  3. If control cannot be confirmed there is no scan. It is checked again later, and scans for the domain stop if the record disappears.
  4. You pay CHF 20 for this scan. Model usage during the scan is billed from your credit on top.
  5. The scan runs as a background job from your workspace. It repeats planning, acting and observing, and only verified hosts are reachable.
  6. A finding is recorded only when it carries a working proof-of-concept.
  7. You read the findings. For a scan of your own workspace or a built site, an optional fix job patches fixable findings in your code and scans again.
  1. Checks the authorised website
  2. Reviews potential issues
  3. Records scan findings

Goes again

Leaves the loop

Validated findings include the reproduction from the scan so you can assess what was detected.

Proving the domain is yours

ZeroLog checks that you control the domain before allowing a scan.

Security scan › Prove domain ownership

Follow the on-screen instructions to confirm control of your website. You publish a DNS record that ZeroLog names: a TXT record at _zerolog-verify. plus your domain, or a CNAME at the same name. An A record alone is not accepted. The record is checked again later.

Authorisation matters

If control can no longer be confirmed, scans for that domain cannot continue. Only scan websites you own or have permission to test.

Running one

  1. Add and verify the domain.

  2. Pay for the scan. It is a service you buy each time, not an unlock you buy once.CHF 20 per scan · card, TWINT where enabled

  3. Start it. It runs as a background job, so you can close the browser.

  4. Read the findings. Each one carries the proof-of-concept that established it.

Scans run from your own workspace, so you need a plan with a container (Mini or higher). Besides a verified domain, a scan can target your own workspace or a site made with the site builder. Scanning a guest VM is not available yet. You choose how deep it goes: quick, standard or deep, and deep is the default.

Model usage during the scan is billed from your ordinary credit on top of the scan fee, priced per request like everything else.

If the target workspace stops during a scan, that scan cannot finish. ZeroLog reports the scan error and stays available; start the workspace and run the scan again.

Scope

The scan is limited to the authorised website. ZeroLog applies safeguards intended to keep a scan within that scope: requests to a domain go out on a dedicated route that reaches only verified domains and their subdomains.

After a finished scan of your own workspace or a built site, a separate fix job can patch the findings marked fixable in your own code and scan again. For a domain scan the fixes are guidance only, because there is no code of yours to change.

Scan only what you own. Only scan websites you own or have permission to test.