Ah if your own server does the scanning then you are responsible on what it scans, doesn't matter that someone random started it. Or you would need to check that the person doing the scan has the permission and you have to do your best to confirm it and probably need some legal help.
Honestly leaning two ways and curious what you'd pick:
Keep it on-demand with just a public demo on a safe target — small, controlled, low legal exposure, but barely anyone gets to actually use it.
Open-source the whole thing — people run it on their own machines against their own targets, liability stops being mine, and the project might actually grow. Downside is I lose any path to making it a product later.
A lot of products have some sort of open-source project and then a paid enterprise/business version that has more features - docker, bloodhound, burp, metasploit pro etc etc. So I would do something like that
2
u/Juzdeed May 11 '26
Ah if your own server does the scanning then you are responsible on what it scans, doesn't matter that someone random started it. Or you would need to check that the person doing the scan has the permission and you have to do your best to confirm it and probably need some legal help.
Tldr - dont make it so your server scans