A passive scan reads what's public. Once you verify you own a domain, Vigil runs authorized active tests — the signal a pentester collects on their own target. Every probe is detection only: nothing is modified, deleted or exfiltrated, so it's safe to run on production and you stay in the clear.
Add a DNS TXT record, upload a small file, or drop a meta tag — the same way you verify a site with Google. Vigil checks it instantly.
Everything in a passive scan, plus the active probes. From a dedicated, fixed IP you can allow-list, with a hard request budget and a per-job timeout.
Each probe result carries its evidence, a curl to reproduce it, and the fix prompt. Turn on monitoring and deep tests run on every schedule.
This is authorized testing of your own property, not an attack. The limits are in the code, not in a policy.
No verification, no active tests. The check runs server-side on every request and can't be bypassed from the client.
Probes send a single benign marker or one quote character. Nothing is written, deleted or read out of your systems.
A fixed request budget, low rate, and a per-job timeout. A scan can't turn into load.
Deep scans run from a dedicated fixed IP, so you can allow-list it — or block it — in your firewall.