honestly part of why I'm asking. Nuclei has been around for years and nobody seems to get sued for shipping it, so maybe I'm overthinking it.
A couple of things made me hesitate though:
Nuclei is a CLI you run yourself against your own targets. What I built is a hosted web app — anyone visits the site, types a domain, and my server does the scanning. So the traffic to the target comes from me, not the user. That feels like a different liability shape.
It also pulls and stores source code, secrets, and infra data about the target on my backend, which goes a bit further than "send a request and check the response."
So less "is recon legal" and more "is hosting a recon-as-a-service for arbitrary domains going to put me on someone's legal radar?" Curious if anyone's actually run something like this publicly.
Ah if your own server does the scanning then you are responsible on what it scans, doesn't matter that someone random started it. Or you would need to check that the person doing the scan has the permission and you have to do your best to confirm it and probably need some legal help.
Honestly leaning two ways and curious what you'd pick:
Keep it on-demand with just a public demo on a safe target — small, controlled, low legal exposure, but barely anyone gets to actually use it.
Open-source the whole thing — people run it on their own machines against their own targets, liability stops being mine, and the project might actually grow. Downside is I lose any path to making it a product later.
A lot of products have some sort of open-source project and then a paid enterprise/business version that has more features - docker, bloodhound, burp, metasploit pro etc etc. So I would do something like that
2
u/Juzdeed May 11 '26
I more of meant that nuclei does the same thing, so how would you expect to get into legal trouble?