On the target

Limits and refusals

The scanner stays on the verified host, stays read-only on a new target, and skips actions that change data.

1. 01

   Stay inside the host

   Requests to any other host are dropped. Cloud metadata addresses are refused. Private addresses are refused. Localhost is allowed only when Routelint is running in its own local test mode.

2. 02

   Skip mutating actions

   While the target is read-only, POST, PUT, and DELETE are not replayed. The worker will not click or replay a path that looks like logout, delete, destroy, password reset, payment, checkout, unsubscribe, send email, or transfer.

3. 03

   Expect a tighter free scan

   A guest gets one completed or in-progress scan per browser, three guest scans per network address per day, one request per second, and anonymous replay only. A signed-in account is not held to the one-scan cap. Payments and daily scans are coming soon.

Staging      about 2 requests per second, read-only
Production   1 request per second, read-only, extra confirmation
Free scan    1 request per second, anonymous only