Scanning policy

Sonar observes public infrastructure submitted by authenticated customers. We do not operate a global internet scanning index.

ASN routes are passive observations and do not establish authorization. A discovered range stays out of scan scope until a workspace submits written authorization and the operator reviews it. After approval, a workspace administrator can explicitly activate a range of at most 16 public addresses. Each generated IP must also pass its hosted verification challenge. Activation does not start a scan; ordinary workspace scan limits and controls still apply. Larger prefixes remain passive.

Authorization and scope

Domains require a DNS TXT verification record. Public IP addresses require a hosted HTTP verification challenge. Sonar checks the challenge before each scan. Domain ownership permits discovery within that domain; it does not establish permission to scan unrelated infrastructure or every tenant on a shared address. Customers remain responsible for the scope of their authorization.

Current scan behavior

Scans use DNS queries, public certificate-transparency lookups, a bounded set of TCP connection attempts, HTTP requests and TLS handshakes. Optional authenticated checks are limited to exact HTTPS paths on verified assets and a customer-provided test credential. HEAD checks collect headers; explicit GET checks compare response status with and without authentication and discard the body after at most 16 KiB. Workspace administrators must confirm each GET path is read-only. GET endpoints can still have side effects if the customer misidentifies an endpoint, so these checks do not submit forms or follow redirects. The scanner does not perform password guessing, exploitation or denial-of-service testing. Requests identify themselves as TohouSonar/1.0.

One scan runs at a time across the service. Network probes are sequential with a pause between them. HTTP responses have time and size limits. Redirects are recorded rather than followed to other targets. Private, loopback, reserved and metadata addresses are excluded.

Customer controls

Customers can exclude individual assets, run manual scans, select a daily scan hour, disable scheduling, and cancel pending or running scans. Cancellation takes effect between bounded checks. Active jobs also stop when a workspace is suspended.

Report unexpected activity

Contact [email protected] with the target, source address, UTC timestamp and relevant request logs. Do not send credentials or unrelated personal information. The operator can suspend a workspace and stop its scans while investigating.

Hosting constraints

Scanning can be disabled globally. Deployment on a provider does not imply permission to scan; the operator must confirm applicable provider policies before enabling active observation.