The Greenlight Scan bot, and how to let it through your firewall

When you scan a site with Greenlight Scan, the requests come from our scanner. Every request carries this user agent:

GreenlightScan/0.1 (+https://greenlightscan.com/bot; authorized security check)

What it does

• Free preview. It reads what any browser would get: your pages, their JavaScript and the response headers.
• Deep scan. This only runs after you prove you own the site. It adds read-only probes, such as checking whether /.env or /.git/config can be downloaded, whether your database allows anonymous reads, and whether your API routes answer without a login. It also sends up to ten failed logins with a fake, undeliverable address to test rate limiting. It never changes or deletes data.
• Pace. At most two requests run at a time, at least 150 ms apart. If your firewall pushes back, the scanner slows down and stops retrying.

"The site's firewall answered our scanner"

Edge networks like Vercel and Cloudflare sometimes challenge our scanner. The deep scan asks for paths like /.env or /backup.sql, and to a firewall that looks like an attack, even though the answer is exactly what you want to know. When that happens:

1. Your report stays usable. We stop sending requests as soon as the firewall pushes back. Anything that depended on a challenged answer is dropped from the report, so you won't get false alarms, and the report is clearly marked as partial. The TLS, email and DNS checks still run, and so does the Launch Audit's code review.
2. Wait and re-scan. On Vercel, the automatic challenge usually lifts after about 10 minutes.
3. Firewall rules you set yourself:
   • Vercel: Project → Firewall → add a custom rule: User Agent contains GreenlightScan → Bypass. This covers your own rules, Bot Protection and Attack Challenge Mode. It does not cover Vercel's automatic DDoS mitigation. That can only be bypassed per IP address, and our scanner doesn't have a fixed IP yet.
   • Cloudflare: Security → WAF → custom rule: User Agent contains GreenlightScan → Skip (Super Bot Fight Mode / managed challenge).

Anyone can copy a user agent, so treat this rule as temporary and delete it after the scan.