1. Scope and authorization
The organization defines domains and public hosts that belong in scope. Ownership verification and scan authorization are completed in the workspace before an available assessment starts. Discovered names remain leads until ownership is confirmed.
2. Observation and evidence
Checks observe the selected public surface. A report should connect a finding to the affected asset, the available evidence and the time of observation. Sensitive workspace data is not published on the marketing website.
3. Severity and context
Severity helps order work but does not replace validation. Asset purpose, reachability, existing controls, exposure duration and business impact influence the remediation decision.
4. Coverage and limitations
Completed, failed, unavailable and not-applicable checks are distinguishable. No result must be presented as a clean result. The service is not a certification, a guarantee that every vulnerability will be found or a replacement for a scoped penetration test.
5. Remediation and retest
The responsible team confirms the finding, plans the change, tests service functionality and repeats the relevant assessment. Accepted risks and exceptions need an owner and review point.