Start with permission.
Keep the scope clear.

PUBLIC SITE UPDATE · 2 NOVEMBER 2026

1. Use systems you are authorised to assess

Only submit a domain or provider target when you own it or have appropriate permission to assess it and view its results. Confirm the scope with the responsible owner or provider. Domain control and possession of an API key do not by themselves grant permission to test every underlying system.

Do not use the service to access another person’s workspace, bypass access restrictions, interfere with systems or attempt to evade request limits.

2. Understand the selected assessment

The no-key public route requires domain verification and reviews a defined set of DNS and web observations. It does not provide a port scan, exploit assessment, malware assessment, full certificate analysis or authenticated application test.

New connected jobs launched from the protected workspace use HostedScan SSLYZE or Pentest-Tools.com Website Scanner light mode on an existing provider target. Imported scans retain their own configured scope. Review the comparison and coverage details before proceeding.

3. Use your provider account responsibly

Supply only an API key you are entitled to use. Your provider’s terms, permissions, subscription, quotas and charges continue to apply. Starting a provider job may use your account’s resources. Check its status before repeating a request whose outcome is uncertain.

CyberScan does not persist your provider key. Keep it out of report notes and shared documents, and manage revocation in the provider account.

4. Interpret findings with their evidence

Results describe the observed target, time and stated coverage. Provider findings are attributed to the provider and are not independently verified by CyberScan. Unavailable checks, incomplete imports and failed jobs must not be treated as passes.

A report, score summary, checklist or completed action is not a guarantee of security, regulatory compliance, certification, insurance acceptance or a successful claim. Validate significant changes with the people responsible for the service and appropriate testing.

5. Keep records appropriately

Reports and action notes may reveal technical information about your services. Share them only with appropriate recipients, keep unnecessary personal data and credentials out of notes, and review the data-handling information before use.

6. Current beta availability

The public site provides guides and browser-local tools. The separate owner-private workspace runs checks on demand for its authorised users. It does not include an availability commitment, continuous monitoring, scheduled news publication or managed incident response. Features and provider compatibility may change as the beta develops.

These conditions explain the current beta’s operation and intended use. They are not presented as a legally reviewed commercial service agreement.