Authorization must survive scheduling
A one-time checkbox is not enough for recurring scans. Domains expire, agencies lose clients and infrastructure changes hands. Ownership proof should have an expiry and should be validated again when a scheduled job executes.
A safe template policy
Recurring monitoring should favor detection-only templates and explicit allowlists. Templates that attempt login guessing, aggressive fuzzing, denial of service or destructive behavior do not belong in an unattended agency workflow. Rate limits and bounded concurrency reduce operational risk further.
More templates do not automatically mean better coverage. The useful set is the one whose behavior you understand and can defend to the site owner.
Triage before reporting
Template matches are observations, not final verdicts. Normalize duplicates, retain the evidence, identify confidence and explain likely impact in plain language. When a result needs manual confirmation, label it that way rather than turning uncertainty into urgency.
Protect the scanner too
Glarion checks resolved addresses before scanning and rejects addresses that match its non-public filters, including private, loopback and cloud-metadata destinations. Internal HTTPS fetches use a validated address and disable redirects; the TLS probe connects to a validated socket address. Nuclei receives a hostname and resolves it independently. Glarion passes -restrict-local-network-access, but enforcement depends on the installed scanner. The wrapper test checks that the flag is present; it does not prove end-to-end DNS-rebinding resistance. See the documented limitations.
Read next
- How Glarion worksThe gates in front of each step, in order.
- About the Glarion crawlerWhat a site owner sees in their log, and how to block it.
- The free public checkThe tier that probes nothing and needs no permission.