Responsible use and audit modes

Audit authorized targets only

VICE is a defensive tool. Audit applications, repositories, and infrastructure that you own or are explicitly authorized to test. A public endpoint is not permission for unrestricted active testing.

A Platform light scan stays limited and does not require domain verification. Full, custom, and module-specific managed audits require a verified domain and a deliberate launch.

Choose the audit mode

• Light: bounded checks of a public web surface for a fast first signal.
• Full: the broad managed profile available for a verified Platform domain.
• Custom: selected managed modules for a verified domain and a focused question.
• Remote: a CLI scan of a deployed URL from the outside.
• Local: a CLI audit of source, configuration, dependencies, migrations, Git history, containers, and workflows.

1vice scan https://app.example.com
2vice audit .

Keep discovery inside scope

VICE may follow public resources discovered during an audit, but every destination must remain within the selected protocol, host, redirect, DNS, IP, and request budgets. A discovered hostname does not automatically inherit trust.

• Separate staging and production when their deployments or trust boundaries differ.
• Review redirects before extending the intended scope.
• Use a focused custom profile when only one module needs to be retested.

Keep credentials origin-bound

Authenticated remote scans can use a cookie or authorization header. VICE must never propagate that material to a secondary origin. Use the narrowest test account possible and revoke it after the audit when appropriate.

Read coverage before relying on a score

A scan is evidence, not a guarantee. Network failures, hidden routes, authentication boundaries, unavailable browser support, and incomplete source context can limit what was checked. Compare scores only when the selected modules, versions, and coverage are comparable.