Testing Methodology and Safe Harbor

Authorization gate

Before scanning, an account holder confirms authority and verifies control by an email link at the target domain or a DNS TXT record. The service records the authorization time and keeps unverified or unpaid targets disabled.

What we test

• Public DNS records, HTTP response headers, exposed network services, and discovered web-application routes.
• A daily baseline scan and a weekly full assessment with active OWASP ZAP checks.
• Signed-in testing when the site owner supplies a test account, including access-control probes for authentication bypass and insecure direct object references (IDOR).
• AI-assisted analysis: endpoint classification that decides which routes the access-control probes target, attack-chain review across all findings (reported separately, without changing severity totals), and, when the customer enables it, business-logic tests planned from the customer's description of the application and judged from the recorded responses.
• A CISA Known Exploited Vulnerabilities check of every CVE identifier the scanner reports, matched by exact CVE ID against a catalog refreshed daily. Software without a reported CVE is not matched by product name.
• Repeat scans that compare findings over time and confirm whether previously observed issues remain.

Boundaries

Targets resolving to private, loopback, link-local, or reserved networks are rejected. Scan workers pin the approved hostname to a validated public address at launch. Crawling and active tests remain scoped to the registered target.

Smoke Test does not intentionally perform denial-of-service, destructive exploitation, persistence, phishing, social engineering, or attacks against unrelated third parties.

Evidence and limitations

Reports include affected endpoints, available request or response evidence, severity, standards mappings, remediation guidance, an immutable version, and an integrity-verification record. Finding types with a reviewed vector carry a CVSS v4.0 base score (CVSS-B) assigned from black-box evidence and not adjusted for the customer's environment; other types are marked not scored. Each report records the CISA KEV catalog version it was checked against, or states that the check was not performed. Automated reports are explicitly identified as not analyst-attested. Human Reviewed subscriptions include review and signed attestation of one selected full assessment per subscription year.

Coverage depends on reachable application states, test-account permissions, defenses, time limits, and the target behavior observed during that scan. Framework crosswalks identify relevant supporting evidence; they do not independently certify compliance.

Verifying a report

Every report version carries a report ID and a verification link. The verification page confirms that Smoke Test issued that exact version, checks its Ed25519 publisher signature, lists the SHA-256 fingerprint of each sealed file, and shows whether the report is automated or analyst-attested. It does not reveal findings.

To verify independently, compute the SHA-256 of the file you received, compare it with the fingerprint on the verification page, and check the signature against the public key published at /report-verification-key. Retired keys stay published for the reports they signed.

Safe-harbor commitment

We consider good-faith customer testing performed within an authorized Smoke Test scope to be permitted activity. We will not pursue legal action for accidental, non-destructive effects reported promptly and handled in accordance with these terms. This commitment does not authorize testing of systems outside the registered scope or override the rights of third parties.

Report a concern

To request exclusions, coordinate a maintenance window, report unintended impact, or disclose a vulnerability in Smoke Test itself, contact admin@smoketest.pro.