Permission comes first.
Only connect applications you own or are explicitly authorized to test. Document which environments, domains, and actions are in scope.
Security & trust
Clear scope.
Careful testing.
Good security testing starts with permission, a clear scope, and careful handling of what it finds.
Use dedicated identities.
Create test accounts with clear roles and synthetic records. Keep credentials scoped, and revoke them when you no longer need the connection.
Start in staging.
Agree on state-changing tests before they run. Keep real payments, destructive actions, and third-party services outside a first test scope.
Treat evidence as sensitive.
A finding can contain tokens, identifiers, and application responses. Redact secrets before sharing reports outside your team.
What a scan needs
Depending on what you connect, testing can involve application URLs, authentication material, an API specification or source code, and request-and-response evidence.
Access and retention settings belong in the product’s security documentation. Ask for the current details before connecting a production environment or data with special handling requirements.
Ask a security questionWhat a report tells you
A report describes what was tested and what was reproduced under those conditions. A clean result does not prove that an application has no vulnerabilities.
Evidence can support a security or compliance review. It does not, by itself, certify compliance with SOC 2, ISO 27001, or PCI DSS.
Responsible disclosure
Found something in rootscan?
Share the affected URL, a short description, and safe steps to reproduce using your own test data. Please stop once you can demonstrate the issue. Do not access other users’ records, disrupt services, or include live credentials.
rootscan is a product of Shiprocket Limited. For this website preview, the form prepares a report for download. It does not send it. A dedicated disclosure contact must be confirmed before this site goes live.
This policy does not authorize testing outside systems you own or have explicit permission to test. No bounty, safe-harbor promise, or response time is implied.
Good testing starts with a clear scope.
Read the setup guide, then connect your first app.