Define a Safe Scope for Authorized Website Security Testing

Establish permission and the responsible owner

Confirm who owns the target infrastructure and who holds the authority to approve security testing. For an engineering team, record the approving owner, the specific assessment contact, the target environment, and the intended testing purpose. Maintain this authorization in a definitive format that the personnel or systems operating the test can reference at any time. Access to an application user account does not automatically grant permission to assess the underlying platform.

This preparation applies universally, whether a human operator, an automated script, a scanner, or an AI agent executes the work. The automation level of a tool does not expand the baseline permission granted by the infrastructure owner. If a target's ownership, hosting relationship, or acceptable testing terms are uncertain, resolve that boundary before any active testing begins. WarHound AI requires verified origin and explicit ownership or permission for intended assessment targets.

List exact targets and exclusions with a worked example

Document the allowed domains, subdomains, URL paths, APIs, and environments. Explicitly state whether HTTP redirects may be followed and define which downstream destinations remain within the testing scope. A modern application regularly links to external payment providers, identity services, analytics hosts, or customer-controlled domains without implicitly authorizing testing against any of those third parties.

Consider a concrete worked example: A staging application is hosted at staging.example.com, relying on an API at api.staging.example.com. The authorized scope specifically allows authenticated checks against api.staging.example.com/v1/users and api.staging.example.com/v1/reports. However, the production API (api.example.com), the shared internal authentication service (auth.internal.example.com), and a third-party billing portal are strictly excluded. If an automated tester discovers an endpoint outside this list, the required behavior is to record the observation, avoid active checks against the out-of-scope endpoint, and halt interaction.

Prepare accounts and synthetic data

Use dedicated test identities with documented roles and specific tenant memberships. Provision these accounts with the minimum privileges necessary to verify the intended application behavior. Engineering teams must prefer synthetic records, disposable file uploads, and non-production payment or email destinations. A security test designed to examine cross-tenant permissions should not require interacting with an actual customer's private data.

Define exactly how test credentials are provided to the execution environment, where they are temporarily stored, and the automated process for revoking them upon completion. Avoid injecting production passwords into evaluation prompts or resulting reports. If production testing is specifically authorized by the responsible owner, implement stricter execution limits and active observation methods, ensuring an owner is available to terminate the activity immediately.

Implement a safe test matrix

Before executing the full assessment, run a safe test matrix to verify that the enforcement mechanisms correctly permit in-scope requests and drop out-of-scope requests. This matrix must cover variations in subdomains, paths, and protocols to prove the boundary logic is sound.

• Target: api.staging.example.com/v1/users (Expected outcome: Allowed)
• Target: api.example.com/v1/users (Expected outcome: Denied - Production domain)
• Target: staging.example.com.malicious.com (Expected outcome: Denied - Subdomain spoofing)
• Target: api.staging.example.com/admin/settings (Expected outcome: Denied - Excluded path)
• Target: 169.254.169.254 (Expected outcome: Denied - Cloud metadata IP)

Set request limits, tradeoffs, and failure modes

Agree on a fixed test window, maximum request concurrency, rate limits, network timeouts, and specific categories of excluded actions. Even a low volume of requests can cause meaningful financial cost or operational disruption when they trigger expensive backend jobs. Implementation tradeoffs exist: setting rate limits too low might fail to identify race conditions, while setting them too high risks denial of service against the staging environment.

Identify the precise failure modes that dictate an immediate stop condition. These include the unexpected exposure of real customer information, measurable service degradation, an out-of-scope redirect loop, repeated HTTP 500 operational errors, or an explicit halt request from the environment owner. Ensure your execution system enforces these controls programmatically, rather than relying solely on written instructions.

Keep URL-fetching tools inside the boundary

If your testing infrastructure fetches URLs, you must validate destinations server-side and account for DNS resolution discrepancies. A public-looking URL can ultimately resolve to an unintended private IP or internal metadata address. A simple domain allowlist is insufficient without careful URL parsing. According to the OWASP Server-Side Request Forgery Prevention guidelines, where a URL crosses a service boundary and is parsed again, implementations can read different hosts from the exact same bytes. For example, a parser following the WHATWG URL Standard might read http://example.com\@evil.com with example.com as the host, while CPython's urllib.parse derives the host as evil.com. Reject any URL whose host is not parsed identically by every component in the chain.

To prevent DNS rebinding attacks, domain allowlisting alone is inadequate. The testing client must validate the resolved destination IP addresses against the application's permitted networks, ensuring the IP is globally routable. Crucially, the HTTP client must connect only to the validated IP address while preserving the original allowed hostname for the HTTP Host header, TLS Server Name Indication (SNI), and certificate verification. Furthermore, disable the automatic following of HTTP redirects in the web client to prevent an attacker from bypassing the initial input validation.

Understand platform limits and evidence handling

Define how reports handle redacted credentials, restrict who may read the resulting evidence, establish data retention periods, and verify how deletion requests are processed. After testing concludes, remove disposable records, revoke temporary access tokens, and confirm that all queued background jobs have stopped. Retest identified fixes strictly under the agreed scope rather than allowing a verification step to escalate into an unlimited new assessment.

When utilizing WarHound AI, specific product limits define the execution boundaries. WarHound AI operates via the Mini Hound (v1 Gemini 3.8 Flash) and Pro (Gemini 3.1 Pro preview through Google Cloud) models. Testing consumes execution budgets, and credits charge at 2x the actual provider tokens, which includes reasoning overhead. Assessments are conducted via bounded isolated browser checks and owner-configured synthetic retests. Interactions happen through the authenticated MCP endpoint /api/mcp handling account, targets, review, and retest commands. The customer MCP includes account-scoped browser, search and fetch tools; deployment and service configuration determine availability. Explicit evidence limits apply: the tool outputs evidence-backed candidates, but makes no blanket security guarantees and performs no automatic code changes.

Sources and Acknowledgments

Drafted with Gemini and checked for source links, advisory identifiers, structure and unsupported product claims. Examples are synthetic and are not scan results.

Drafted with Gemini and checked for source links, advisory identifiers, structure and unsupported product claims. Examples are synthetic and are not scan results.

• OWASP SSRF Prevention Cheat Sheet