prod
Our bot

The Security Audit HTTP headers bot

Who are we?

Security Audit is a service published by Code Rhapsodie. Our bot checks that the HTTP security headers (HSTS, Content-Security-Policy, cookies, CORS…) of a website follow the OWASP and MDN recommendations. It only scans the websites declared by our users who proved they own them (DNS record or file on the website).

How to identify it?

  • User-Agent: CodeRhapsodie-SecurityAudit/1.0 (+https://audit.security.code-rhapsodie.fr/bot)
  • IP addresses: 54.38.71.190

As a User-Agent can be spoofed, preferably allow the User-Agent and IP address pair.

Which requests does it send?

On each analysis of a project, for each of its environments:

  • a GET request of the declared URL, following at most 5 redirects;
  • the same URL over http://, to check the redirect to HTTPS;
  • a request with a dummy Origin header (https://….cors-check.example) to test the CORS policy, unless the user disabled it;
  • /.well-known/security.txt for the production environments;
  • /.well-known/security-audit-verification.txt as long as the ownership of the website is not proven.

The bot does not run JavaScript, submits no form and does not crawl the website. It is limited to 10 requests per minute and per domain, and honours the Retry-After header of 429 and 503 responses.

How to allow it?

If your website is behind a WAF or an anti-bot, allow our IP addresses and User-Agent. You can also set, in the project settings, a secret header (e.g. X-Scan-Token) allowed by your WAF: it is only sent to your website and stored encrypted.

  • Cloudflare: Security › WAF › Custom rules, create a rule with the Skip action (every protection, including Bot Fight Mode / Super Bot Fight Mode) and the expression (http.user_agent contains "CodeRhapsodie-SecurityAudit" and ip.src in {…}).
  • Akamai: add our IP addresses to a Network List used as a Bot Manager exception, or declare a Custom Bot in an allowed category.
  • DataDome: Settings › Custom rules, an Allow rule on the User-Agent and our IP addresses.
  • Imperva: Security › Policies, add an exception (Allowlist) on our IP addresses for the Bot Protection rules.
  • AWS WAF: create an IP set with our IP addresses and an Allow rule evaluated before the Bot Control rule group.
  • Sucuri: Firewall › Access Control › Whitelist IP Address.

Contact

A question or an abuse to report? Write to us at contact@code-rhapsodie.fr with the domain concerned.