# How the scanner works

What the scanner sends to a site, what a security result means, how severity is graded and what we do with anything exposed.

Ruleset sha256.8c985cc03868. Security checks are provisional.

## What a security result means

Security checks are new, and we have not yet measured how often they are right.

- A clean result means we found none of the listed faults in what we read. It is not a security assessment, a penetration test or a certification.
- Not using a technology is never a fault.
- When we could check only part of something, the result says so.

## What the scanner sends

It reads what a site publishes, with limits on time, size and where it may connect. A few checks also send small requests, so it is not read-only.

- It reads public pages, response headers, published metadata and public key sets.
- It tries the usual addresses for discovery files, including several for MCP server cards and OpenAPI descriptions.
- It sends a POST to /ask and /mcp on every host, signed out, even when the site advertises neither. For MCP that can be a discovery request (server/discover), the older initialize request, a request for the tool list (tools/list) and one request for a method that does not exist.
- It sends one empty message to an A2A endpoint (message:send).
- It follows published metadata to other hosts. A separately found MCP server card or A2A card can also point those same POST requests at another host, still signed out.
- It reads at most three key sets named by a signed A2A card, through the same cache as other metadata.
- It compares published keys with known test keys by fingerprint. That does not check a signature or say whether the signer can be trusted.
- For UCP it reads sign-in provider metadata and A2A cards, and never calls the services themselves. Those stay unchecked.
- It skips any address or redirect that carries a username, password or credential in the URL. That check stays unchecked.
- Headers you give it to get past a bot wall go only to the site you scanned, and are dropped if a redirect leaves it.
- It never signs in, buys anything, replays a payment or tests a site's defences.

## How severe a fault is

Severity says what to fix first. It does not mean a fault can be exploited, or that anything has happened.

- High: leaked credentials or signing keys, and an identity that does not match the site that publishes it.
- Medium: insecure connections, weak published keys and other limited configuration risks.
- Low: small departures from guidance.
- These are examples, not fixed groups. Each check is graded on its own, by the protection we saw and what could follow.
- Each fault names the document that requires the fix and its CWE weakness entry. Lumar's own recommendations are marked as ours and never claim to be a specification requirement.
- Links to security frameworks point to related risks. They do not mean we cover the whole framework.

## If we find something exposed

We report that private material is public. We never show what it is.

- The scanner, its API and its MCP tool can report that a public site publishes private material, or a test key that is already public. Findings name the fault and the private field names, never their values.
- Usernames, passwords and credentials in URLs are hidden in every result, request list, fix prompt and anything we store. This applies to every domain, because we do not check who owns the domain scanned.
- Our research data hides private key values and credential fields before it is saved, and leaves out sensitive files we cannot parse. Older research data gets a separate, restricted review before anyone reuses or publishes it.
- If you find a key, do not use it, publish it or put it in a ticket. Take it out of the public file and replace it promptly.
- To report an exposure or dispute a finding, use Lumar's contact page. Include the domain, ruleset, check, scan time and the evidence with secrets removed.
- A finding is automatic. It does not contact the site owner or start a disclosure deadline.
- Access controls and data retention on the Lumar platform are not part of this scan.

[Report or dispute a finding](https://www.lumar.io/contact/).