Security methodology

Scope

PixelPrivate performs passive, low-impact checks against publicly accessible assets: DNS, email authentication records, HTTPS and certificate behaviour, HTTP response headers, and the public homepage. It makes a small, bounded number of ordinary requests, identifies itself as PixelPrivateScanner, and follows safe limits on time, size, redirects and concurrency.

Checks currently available

• DNS resolution and nameservers (dns.basics v1.0.0) — Resolves core records and checks nameserver redundancy.
• CAA records (dns.caa v1.0.0) — Checks whether certificate issuance is restricted with CAA.
• DNSSEC (dns.dnssec v1.0.0) — Checks for a DS record at the parent zone (best effort).
• Dangling CNAME indicators (dns.dangling-cname v1.0.0) — Checks common subdomains for CNAMEs to names that do not resolve.
• SPF record (email.spf v2.0.0) — Checks that the domain publishes a valid SPF policy listing who may send its email, and counts DNS lookups through every include.
• SPF includes still resolve (email.spf-includes v1.0.0) — Follows each SPF include and redirect and flags targets that no longer publish an SPF record.
• DMARC policy (email.dmarc v2.0.0) — Checks the DMARC record, its enforcement level, subdomain policy and report authorization.
• DKIM keys (email.dkim v2.0.0) — Looks for DKIM public keys at commonly used selectors, and checks any selectors you supply.
• Mail servers (MX) (email.mx v1.0.0) — Lists MX records, identifies the mail provider when the hostnames make it certain, and checks that the servers resolve.
• Email transport posture (MTA-STS, TLS-RPT, BIMI) (email.posture v1.0.0) — Looks for MTA-STS, TLS-RPT and BIMI records and validates them.
• HTTPS availability and redirect (http.https v1.0.0) — Checks HTTPS works and plain HTTP redirects to it.
• Certificate validity and TLS version (tls.certificate v1.0.0) — Checks certificate trust, hostname match, expiry (configurable thresholds) and negotiated TLS protocol.
• Security headers (headers.security v1.0.0) — Checks key HTTP security response headers.
• Cookie flags (http.cookies v1.0.0) — Checks Secure/HttpOnly/SameSite on cookies set by the homepage.
• Website hygiene (website.hygiene v1.0.0) — Checks security.txt and mixed-content indicators.
• Technology exposure (tech.exposure v1.0.0) — Identifies public technology fingerprints and version disclosure.
• Page fingerprint (website.content v1.0.0) — Records the favicon fingerprint used to notice when a site icon is replaced.
• Data exposure (files, backups, listings) (exposure.files v1.0.0) — Passively checks a fixed list of paths for exposed secrets, repositories, dumps, listings and source maps.
• Reputation lookup (reputation.webrisk v1.0.0) — Checks whether the site address is on Google Web Risk lists of known malware, phishing and unwanted-software addresses.

Severity and confidence

Severity (critical, high, medium, low, info) says how serious an issue could be if it applies. Confidence (high, medium, low) says how certain PixelPrivate is that the issue applies. They are independent: a high-severity finding can have low confidence if the evidence is indirect. We never state something is vulnerable unless the evidence supports it.

PixelPrivate Security Score

PixelPrivate Security Score is our proprietary indicator based on the security checks currently available in PixelPrivate. It is not a guarantee of security and should not be interpreted as a complete security assessment. It is not an industry-standard score.

Each category starts at 100 and loses points for open issues: critical 60, high 35, medium 18, low 6, multiplied by a confidence factor (high ×1, medium ×0.7, low ×0.3). Category weights: domain 12%, email 18%, website 22%, TLS 13%, configuration 12%, brand protection 8%. Categories with no applicable checks are left out and the remaining weights are rebalanced. Weights are configurable and may change; changes are explained in score history.

What PixelPrivate does not do

• It does not exploit vulnerabilities, run attack payloads, brute force, or test credentials.
• It does not perform denial-of-service or load testing.
• It does not access private systems, internal networks or authenticated areas.
• It does not claim complete coverage of the OWASP Top 10; OWASP itself notes no tool can comprehensively detect every risk. OWASP Top 10.
• It does not prove a site is free of malware, or that an organization is secure.
• It does not change your DNS or website.

Known limitations

• DKIM: selectors cannot be listed from DNS. PixelPrivate tries common selectors; “not found” means unknown, not absent.
• SPF lookup limit: counted at the top level; nested includes may add more.
• Headers and cookies: read from the homepage only.
• Technology detection: pattern-based and may be incomplete.
• DNSSEC: DS presence is checked; the full chain is not validated.
• Brand Shield: samples common lookalike patterns, not every variant; similarity is an indicator, not a legal determination.

How AI is used

The scanner produces structured facts; deterministic rules produce the score and the base explanations; an optional AI model may rephrase those explanations. AI never creates findings, and answers are grounded on the findings of your scan. See trust.

Safeguards

All requests to user-supplied hosts go through a hardened client that allows only HTTP/HTTPS on ports 80/443, resolves DNS once and connects to the vetted address, blocks private, loopback, link-local, metadata and internal ranges (IPv4 and IPv6), re-validates every redirect, and enforces timeouts and response-size limits.