Skip to main content
Vantyris

Methodology & Safety

What Vantyris actually does.

VT-2026 · v1.0.0 · Last reviewed 2026-05-23

This page explains what a Vantyris scan actually runs, what it doesn't, why we draw those lines, and the safety controls we apply so we can scan public-internet systems without becoming part of the problem we're trying to solve.

Vantyris is a safety-constrained scanning service. The UK Computer Misuse Act 1990 criminalises unauthorised access to computer material. OWASP guidance on Server-Side Request Forgery shows how a loose outbound request can reach internal services. The architecture below is grounded in both.

Two-speed scanning

A target gets two kinds of attention. The teaser scan runs without ownership verification and is deliberately passive, DNS lookups, public SSL/TLS handshake reads, security-header read, MX-record check. No active probing. It returns a partial grade in seconds.

The verified standard scan only runs after you've proven ownership through DNS TXT, a file, or a meta tag. It includes a passive module set first (returns a first report fast), then progressively enriches with deeper modules: port discovery (limited, bounded Nmap), known-web-vuln checks (curated signed Nuclei templates only), email-security posture (SPF + DKIM + DMARC analysis), and DNS hygiene (CAA, DNSSEC, look-alike detection).

Six categories

Safety controls

We run scan jobs in isolated containers with strict egress allow-lists. A worker can reach the public-internet target IP and approved third-party APIs, that is all. It cannot reach private IP ranges (RFC 1918), link-local addresses, the cloud-metadata endpoint at 169.254.169.254, loopback, or CGNAT space.

We re-resolve DNS mid-scan and abort if the IP suddenly changes (a DNS-rebinding pattern). We apply per-target, per-workspace, and per-IP rate limits to remain a polite citizen of the internet.

We never run exploit frameworks, credential stuffing, brute force, or fuzz testing. We never run Nuclei's code, headless, or fuzz template paths. We only run pinned, signed template bundles that we have reviewed.

False-positive policy

We deliberately prefer a shorter, more correct report over a longer noisy one. When two scanners disagree about a finding, we surface it as medium rather than the higher of the two ratings. Suppressions you set on a finding (via the Ignore with reason action) carry an expiry, they don't silently hide an issue forever. We review the suppression queue weekly and roll back any template that produces a surge of false positives.

What we don't do

Remediation library

Every finding maps to a human-authored remediation note: a one-sentence "what this means for your business," a concrete "how to fix it" with an ownership hint (your web host / your developer), and an approximate time-to-fix. The library is maintained by named expert reviewers on retainer and is updated quarterly.

Eating our own dog food

We run Vantyris against vantyris.com itself. The security headers on this page (HSTS, CSP, X-Frame-Options, Referrer-Policy, Permissions-Policy) are configured to the standards we describe. Our staging environment runs the same scanner pipeline against itself before every release.