Scanning is separate
Public assessment uses a dedicated URL Scanner credential. A customer remediation credential is never used for general scanning.
Security model
Site-changing access is treated as a serious responsibility.
AgentReadyToday is designed around separation of duties, least privilege, explicit approval, verification, and an audit trail.
Ownership is verified
Consequential changes require verified domain control through Cloudflare zone access, DNS, or a well-known verification file.
Credentials stay server-side
Cloudflare tokens are validated, encrypted with AES-GCM, stored server-side, and never returned through the API.
Approval binds the plan
The approval digest identifies the exact proposed operations. If the plan changes, approval must be given again.
Network access is constrained
URL inputs are checked against private and reserved networks, DNS is validated, redirects are rechecked, and fetches have byte and time limits.
Every change is recorded
Site-changing actions include the actor, site, target, result, request identifier, and timestamp in an append-only audit history.