Exposure scans: profiles, tools and limits

An exposure scan runs a set of scanners against a domain and its watched hosts from a sandboxed container, and DomainGuard's own passive checks from the Worker. Every domain gets one scan when it is added; after that a scan runs when you ask, and on a schedule only if you say yes.

Where

Web: Security, or a domain's Vulnerabilities module, Scan.
iOS: the domain's Vulnerabilities module, the Scan button beside the title. A "waiting on results" bar shows on the domain page while it runs, and the card moves on the server's count of scanners finished.
API/MCP: POST /api/vuln-scan/start (domain_id, scan_profile, optional target_hosts), GET /api/vuln-scan/results/:scanId, /latest/:domainId, /history/:domainId; tools start_vuln_scan, get_vuln_scan_results, get_vuln_scan_latest, get_vuln_scan_history.

Profiles

Profile	What runs	Needs clearance
Quick	DomainGuard's passive checks only: security headers, TLS and certificate, the technology fingerprint	No
Standard	Quick plus active web checks (Nuclei templates), exposed-file probes, subdomain discovery (Subfinder), dependency CVE lookups (Trivy) and the port probe (Naabu)	Yes
Deep	Standard plus secret detection (Betterleaks) and the full template set	Yes
Port-scan	The port probe alone, across every watched host, with the longest wall clock	Yes
Extreme	Everything, including the port scan; the slowest. Results can be emailed to you	Yes; paid

The findings name the check that produced them in words: "Active web checks", "Server disclosure checks", "TLS & certificate checks", "Exposed files", "Secrets", "Open ports". Active tools cover the apex plus up to 40 in-scope hosts per run.

Manual allowances

Plan	Vulnerability scans
Free	1 every 7 days
Starter	5 a day
Pro	10 a day
Enterprise	50 a day

A refused scan returns the reset time. The scanner fleet also has a daily launch budget across all accounts; when it is exhausted a scan is queued and retried rather than failed, and the domain page says so.

The schedule (paid plans)

Scheduled exposure scans run the Standard profile on the account's cadence (daily on Starter and Pro, hourly on Enterprise) for domains that are active, inside the automated allowance, cleared, and have answered yes to "Keep scanning for exposure?" in the setup guide. Until you answer yes, nothing is scanned on a schedule, and you can stop it from the same place.

Passive baseline

A domain without ownership proof still gets the Quick profile automatically at add time: reading what a site already serves needs no proof. The proof decides whether the active tools join in.

What you get back

Findings with severity, the host each was found on, the evidence, and a fix; hosts with open services; and the software the scan observed. A finished scan can send the Scan finished push if that switch is on.

Common questions

The scan says "ownership proof needed". See Scan clearance. Since 2026-09-10 one proven domain clears the whole account.

Can a scan hurt my site? The templates are non-intrusive reads and the port probe is a connect test. Nothing exploits, writes or floods. Even so, the scanners only run on domains the account has proven it controls.