Is proving you own a domain actually enough permission to scan it?

I just made our deeper web security scanner publicly self serve and I’m having second thoughts about whether that’s smart.

You can’t just paste some random URL.

You have to prove control through DNS or a file on the domain. Repo testing needs our GitHub App installed on the exact repo. You also digitally sign the scope before anything runs.

After that it can run bounded DAST, source analysis and optional cross-account testing with two throwaway users.

We built it because our old free scanner only saw the public surface. People could get a clean result and assume everything was fine, even though we never tested login or access between users.

But I guess owning something and being authorized to test it aren’t always exactly the same.

What about agencies? Temporary access? Compromised DNS? Shared infrastructure? Someone taking over an abandoned subdomain?

If you wanted to misuse this, how would you do it?

https://www.task-bounty.com/secure-my-app#deep-review

Genuinely trying to find the holes before we push this further.