DRAFT, not legal advice — placeholders only. Do not rely on this page until {{COMPANY_NAME}} publishes a final version.

Gardvale

Gardvale · ABN {{ABN}}

How we scan

Gardvale is operated by Gardvale (ABN {{ABN}}). We mainly perform passive checks of public records. We do not port-scan, do not probe SMTP STARTTLS, do not attempt logins or send payloads, and do not use paid vulnerability feeds unless a key is explicitly configured later. On Business and Partner monitors, after ownership verification, we may also make a small fixed list of safe GETs to well-known admin and debug paths (see below).

What we look at

  • Public DNS — SPF, DMARC, DKIM selectors, MX, CAA, DNSSEC signals, CNAMEs
  • Mail policy published over HTTPS (MTA-STS) and related TXT records (TLS-RPT, BIMI)
  • Registry data via RDAP (registrar, registration/expiry, age, locks; .au via auDA ccTLD RDAP). Registrant details only after ownership verification, and only when the registry publishes them
  • Certificate transparency hostnames via crt.sh — only after you verify ownership with a DNS TXT record
  • Optional search mentions via a configured search API — off without a key; no search-engine scraping
  • After ownership verification: passive CMS/platform fingerprints, with optional CVE matching via the free NVD API and end-of-life data from endoflife.date (see docs/platform-vuln-sources.md). WPScan stays mocked unless explicitly enabled

Exact HTTP(S) paths we may fetch

For a domain under check, outbound GETs are limited to these fixed URLs (no crawling beyond them):

  • Homepage: https://<domain>/
  • MTA-STS policy: https://mta-sts.<domain>/.well-known/mta-sts.txt
  • https://<domain>/.well-known/security.txt
  • https://<domain>/robots.txt
  • https://<domain>/sitemap.xml
  • Privacy paths (first successful hit): /privacy, /privacy/, /privacy-policy, /privacy-policy/, /privacy-statement, /legal/privacy
  • Soft-404 probe: https://<domain>/gardvale-no-such-page-<random>
  • CMS / platform fingerprints — only after ownership verification; GET/HEAD of homepage headers, meta generator, and well-known public files such as /readme.html, /CHANGELOG.txt, /wp-json/, /core/misc/drupal.js, /status.php, /api/v4/version (full list in docs/platform-vuln-sources.md). No exploit payloads.
  • Business / Partner monitors only, after ownership verification — a capped list of safe GETs (no login attempts, no payloads) to well-known admin/debug paths such as /wp-admin/, /wp-login.php, /phpmyadmin/, /.env, /server-status, /_debug/, /actuator, /actuator/health, /setup, /install, /admin/, /.git/HEAD, /console. Free one-off scans never run these probes. Matches use response fingerprints, not status codes alone, and every request goes through the SSRF guard with a per-domain request budget.

What we never do

  • Port scanning or intrusive vulnerability probing. Active Nmap is disabled by default (NMAP_ENABLED); when enabled it runs only against ownership-verified domains, and serverless runtimes still skip spawning nmap
  • Advising on insurance products or pricing (reports are information only)
  • Selling your scan results; reports are for your information (a printed copy may be kept as a pre-renewal security settings report for your own records)

Our User-Agent

Outbound HTTP requests identify as GardvaleBot/1.0 (+https://gardvale.invalid/how-we-scan) so operators can recognise us. See also security.txt.

Safety controls on outbound fetches

Homepage and other user-domain HTTP(S) fetches resolve DNS first, refuse private or reserved addresses, pin the connection to a validated public IP, re-check redirects (limited hops), reject literal IP hosts and non-standard ports, time out quickly, and cap response size.

Rate limits and bot checks

Scans always require Turnstile. We also apply per-IP (hashed, purged every 24 hours) and per-domain rate limits in our database. If those controls are unavailable, or if production is misconfigured with Cloudflare test secrets, scans are refused.

Ownership and opt out

Verify ownership with a DNS TXT record on Verify to unlock subdomain discovery. Domain owners can request exclusion; excluded domains and their subdomains are never scanned.

Abuse

Report scanning abuse to abuse@{{DOMAIN}}.

Legal drafts

See draft Terms, Privacy, and Email policy. They carry a DRAFT banner until counsel signs off.