Scope permissions per host

Scope decides what SQUR may touch. You set a permission for every host in the scope during setup, and you can change it later on the app's Settings tab under Scope permissions.

Permission	What SQUR does
Test	Reaches the host and attacks it, including exploitation. This is for your own app and the hosts you own.
Pass through	Reaches the host (for example a dependency your app calls) but never attacks it.
Ignore	Never touches the host.

The app you are testing is always in Test and includes its subdomains. Hosts you remove from the list are not tested.

Find scope

Click Find scope to scan the target for other hosts it uses, such as APIs and backends. The proposal is safe by default: only the target's own domain and subdomains are proposed as Test, and third-party or unknown hosts default to Pass through or Ignore. Review and adjust every row. Find scope is required before launch.

You can also add a host you own by typing it into the host field, one per line.

Rate limit

Use Limit request rate on a host if its capacity is limited. The default is unlimited.

Reference URLs

Reference URLs (API docs, OpenAPI specs, runbooks) are read by SQUR and never attacked.

Tips

• Test on a non-production copy if you can. Exploitation proves findings and finds more, and in Test mode SQUR may affect the availability of the host.
• When unsure, use Pass through. SQUR reaches the host but does not attack it.
• Never put a host you do not own in Test. Set third-party hosts to Pass through or Ignore so other people's property is not attacked.