About our scanner
Last updated 2 August 2026
If you got here from an entry in your server logs, the traffic came from SecureMyVibe. We run security checks on websites and translate the results for the people who built them, who are usually not security specialists. This page exists so you know exactly what happened and what you can do about it.
How to identify our traffic
- User-Agent
- SecureMyVibe-Scanner/1.0 (+https://securemyvibe.ai/scanner)
- Source address
- 18.229.7.238
- HTTP methods
- Almost all GET, HEAD and OPTIONS. Two checks send POST without writing — see below
- Volume
- About 70 requests per second at peak, and a scan takes from a few minutes to ten
What the scanner does
It fetches public pages, reads response headers, walks the JavaScript files looking for addresses written into them, and checks for configurations known to expose data: missing security headers, permissive CORS policies, keys left in public files, endpoints that answer without authentication. It is the same kind of check anyone could run by opening the site in a browser, only done systematically.
What the scanner sends, and what it does not do
Endpoint discovery is read-only: to learn whether an address accepts writes, the scanner makes a single OPTIONS request and reads the headers your own application returns, never sending POST, PUT, PATCH or DELETE. No check creates, changes or deletes data in your system. Two exceptions send POST without writing anything. The first asks whether your GraphQL API exposes its own schema: it tries GET first, and only retries over POST at /graphql and /api/graphql, addresses that exist only if a GraphQL server is really there; the query just reads the schema. The second is a Firebase configuration check, which asks whether an email is already registered without creating or changing anything. The scanner does not try to guess anyone's password, does not create accounts, does not trigger emails, does not read or copy user data, and does not exploit the flaws it finds beyond what detecting them requires.
Who asked for this scan
A scan only starts when someone enters a site address in our form. We do not crawl the internet or pick targets ourselves. We cannot prove that whoever typed the address is the person responsible for the site, which is why this page exists: so that the responsible person can identify us and act if the scan was not authorised.
How to block us or opt out
You can block the source address at your firewall or CDN, or block the User-Agent above. The scanner does not try to evade any block, and nothing about your site changes if you do. If you would rather your domain were never scanned, write to the contact below with the domain: we keep an exclusion list and apply it by hand, with no proof of ownership required beyond control of the domain.
Talk to a person
For opt-out requests, questions about a specific log entry, or any concern about how the scanner behaved, write to support@securemyvibe.ai. We are a small team and we read everything; if it is urgent, say so in the subject line.