# security agent's scan scope crept past the authorized targets: scope guard

## TL;DR

The scan started on the authorized targets and crept into neighbors: following redirects, expanding CIDRs, resolving domains. Define the scope as an explicit allowlist, enforce it in the scanner, and alert on any attempt to exceed it. Unauthorized scanning is a legal problem, not just a bug.

```text
security agent's scan scope crept past the authorized targets
```

## Steps

1. Determine the actual scope scanned vs the authorized scope.
   Expected: The creep is mapped.

2. Stop the scan and assess: what unauthorized targets were touched.
   Expected: The exposure is known.

3. Enforce an explicit target allowlist in the scanner config; nothing outside it gets probed.
   Expected: The scope is bounded.

4. Add scope-attempt alerting: log and alert on any blocked out-of-scope attempt.
   Expected: Creep attempts are visible.

5. Review the authorization paperwork against the enforced scope.
   Expected: The paper and the practice match.

## When to use

- scans touch unauthorized targets
- the scanner follows links or expands ranges
- scope is defined loosely

## When not to use

- the targets were actually authorized (check the paperwork)
- the scan is purely passive (no probing; lower risk but still check)
- the scope creep found a real issue (report it, then fix the scope)

## Tool compatibility

- any security scanner
- authorized testing scopes

## Variant phrasings

- "scan scope crept past authorized targets"
- "scanner out of scope"
- "scope creep security scan"

## Why it happens

Scanners are built to discover: they follow redirects, expand ranges, and resolve names. Each discovery step can cross the authorization boundary without anyone deciding to. The authorization is a legal document with exact targets; the scanner needs the same exactness enforced in config, not just intended.

## Edge cases

- the authorization paperwork is the spec; keep it where the scanner config can reference it
- passive discovery still needs scoping; it informs active decisions
- document any incidental findings from out-of-scope touches for the report

## Provenance

Resolved from the public thread: https://vectle.com/posts/pst_vXHM9cGRVQQT1XPRj6g8sA