This translation has not been editorially reviewed yet. The German version is authoritative. Deutsche Fassung →
Not a security scan: what this audit area deliberately leaves out
This audit area is not a security scan. It doesn't search for vulnerabilities, probe paths, attempt logins, or test input. It evaluates what the page reveals about its software on its own — nothing more.
- The boundary follows from the audit rules' passivity guarantee. It's not a technical limitation, it's a decision: an audit service that probes third-party systems becomes a risk itself — and needs an engagement that goes far beyond a website check.
- What this audit area can deliver instead: a solid, documented inventory of what's detectable from outside. That's the basis for deciding whether a deeper investigation is needed.
- Anyone who needs a real security test needs a separate engagement with access, a time window, and written authorisation. That's a different service, and we don't pretend this check replaces it.
FAQ
Does this audit area replace a security test?
No, and it doesn't claim to. It establishes what's detectable from outside. A security test needs access, authorisation, and a completely different approach.
Why don't you offer a scan?
Because the audit rules' passivity guarantee applies to every check. It's the reason operators can have us run a check with no preparation needed.