<!-- https://zerolog.ch/docs/pentest · Docs / Research and security -->
# Security scan

A security scan checks a website you are authorised to test and reports findings you can review.

1. Checks the authorised website
2. Reviews potential issues
3. Records scan findings

Goes again

Leaves the loop

Validated findings include the reproduction from the scan so you can assess what was detected.

## Proving the domain is yours

ZeroLog checks that you control the domain before allowing a scan.

Security scan *&rsaquo;* Prove domain ownership

Follow the on-screen instructions to confirm control of your website. You publish a DNS record that ZeroLog names: a TXT record at `_zerolog-verify.` plus your domain, or a CNAME at the same name. An A record alone is not accepted. The record is checked again later.

Authorisation matters

If control can no longer be confirmed, scans for that domain cannot continue. Only scan websites you own or have permission to test.

## Running one

1. **Add and verify the domain.**
2. **Pay for the scan.** It is a service you buy each time, not an unlock you buy once.CHF 20 per scan · card, TWINT where enabled
3. **Start it.** It runs as a background job, so you can close the browser.
4. **Read the findings.** Each one carries the proof-of-concept that established it.

Scans run from your own workspace, so you need a plan with a container (Mini or higher). Besides a verified domain, a scan can target your own workspace or a site made with the site builder. Scanning a guest VM is not available yet. You choose how deep it goes: quick, standard or deep, and deep is the default.

Model usage during the scan is billed from your ordinary credit on top of the scan fee, priced per request like everything else.

If the target workspace stops during a scan, that scan cannot finish. ZeroLog reports the scan error and stays available; start the workspace and run the scan again.

## Scope

The scan is limited to the authorised website. ZeroLog applies safeguards intended to keep a scan within that scope: requests to a domain go out on a dedicated route that reaches only verified domains and their subdomains.

After a finished scan of your own workspace or a built site, a separate fix job can patch the findings marked fixable in your own code and scan again. For a domain scan the fixes are guidance only, because there is no code of yours to change.

**Scan only what you own.** Only scan websites you own or have permission to test.

## From domain to findings

Mermaid source of the diagram on this page:

```mermaid
%% Security scan: from domain to findings. Facts from server/pentest-domain.js, pentest-pay.js, pentest.js, routes/pentest.js.
flowchart TB
  d["Add your domain"]
  dns["Publish the DNS record ZeroLog names<br/>TXT or CNAME at _zerolog-verify"]
  v{"Control confirmed?"}
  stop["No scan; checked again later,<br/>scans stop if the record goes"]
  pay["Pay CHF 20 for this scan"]
  job["Background job in your workspace<br/>plan, act, observe, repeat<br/>only verified hosts reachable"]
  f["Finding counts only with<br/>a working proof-of-concept"]:::hot
  r["You read the findings"]
  fix["Optional fix job<br/>own workspace or site only"]

  d --> dns --> v
  v -->|no| stop
  v -->|yes| pay --> job --> f --> r
  r --> fix

  classDef hot stroke:#8f7ac9
```