What the scanner does
If you found this address in a server log, the requests came from Ship Safe, a product run by AISynq. Somebody asked us to check an app and attested that they own it. This page says exactly what we do.
How to recognise us
Every request carries this user agent:
ShipSafe-Scanner/1.0 (+https://aisynq.com/shipsafe/scanner)
What we do
- Request the page at the address we were given, and follow at most three redirects.
- Download the JavaScript files that page tells a browser to load, and read them for keys that should not be public.
- Read the response headers.
- Ask whether a small number of commonly named database tables answer a read request from someone who is not logged in.
What we never do
- We never write, change or delete anything. There is no write probe and there will not be one.
- We never store the contents of a row. If a table answers without a login we record that it answered, the column names and how many rows it said there were. Not the data.
- We never try passwords, never look for a way in, and never run anything against your app. This is not a penetration test.
- We never scan an address the requester has not attested they own.
Rate and volume
A scan is a few dozen requests over well under a minute, once, when somebody asks for it. We do not crawl, we do not come back on a schedule unless the owner is paying for weekly monitoring, and we time out after ten seconds per request.
How to block us
Add this to your robots.txt:
User-agent: ShipSafe-Scanner Disallow: /
Or block the user agent at your edge. We honour both. If you would rather tell a person, write to hello@aisynq.com with the address and we will stop and tell you who asked.
What we keep
The findings and the evidence behind them for 90 days, then they are deleted. If a customer deletes their app from Ship Safe, everything about it goes at once. Where a scan reads a code repository, the copy is deleted the moment the scan finishes, every time, including when the scan fails.