how we operate
plain language.
no security-vendor-speak.
this is how recon.sh works - and what we won't do.
attack surface
we attack from the outside.
external ips only. we don't see your code, your infrastructure, or your team. if the attacker can't see it, we can't see it.
domain verification
we check you control the domain.
before any scan you add a DNS TXT record at _recon-verify.<your-domain> with the value recon-verify=<token>, using a token we issue. we look it up. we re-check at scan-start, every time. verifying once doesn't authorize us forever. no record, no scan.
ai infrastructure
your credentials pass through a third-party ai.
a person isn't running this scan, an ai is, and it's operated by a third party, not recon.sh. so test credentials you supply pass through that provider during the scan; there's no way to log in as you without the ai seeing them. we delete our stored copy when the scan starts, or after 24 hours if it hasn't started by then. the scanner deletes its working copy when the scan ends. rotate any credentials you give us once it's done, the report will remind you.
non-destructive
we don't break things.
no delete, no drop, no rm. if we touch state, we snapshot and restore. if we authenticate, we use the test credentials you provide - not credentials we forged.
data ownership
we don't sell what we find.
findings are yours. evidence is yours. your report opens only for your account. if you create a share link, anyone with that link can read and download the report until you revoke it. revoking doesn't recall a copy already downloaded.
reproduction guarantee
every finding must reproduce.
every finding ships with reproducible evidence. if it doesn't reproduce on your side, you get back the credits it cost. findings bought through our earlier per-finding checkout keep their cash refund. (within 7 days, with a documented reproduction attempt - see terms)
contact
questions.
email team@recon.sh if anything here is unclear.