3 ms·
What are the legitimate cases for excluding the domains from your scanning service?
by duckmysick 6y ago
What are the legitimate cases for excluding the domains from your scanning service?
- heipei 6y agoNot many, I usually only do it when the domain or URL pattern in question is almost exclusively used for sessions/invites/sharing-links and basically every URL submitted leaks either a customer name and/or invite-token and/or PII. zoom.us is a good example, certain DocuSign URL patterns, the sort of thing where knowing the URL gets you a sensitive document, etc.