Scope and Safety

An accessibility scan only reads your site, far more gently than a pentest, but it is still a browser visiting many pages, signed in as one of your users. This page sets out exactly what it does and does not do.

Only sites you have proven you own

A scan runs only against a domain your organization has verified (see Domain Verification). The start URL, the login page and every listed page must sit under that domain, and every run re-checks this when it starts.

What the scan will reach

• Only the start URL's host. Links to other hosts, including other subdomains of your own domain, are not followed. A redirect off the host is not followed either; the page is listed as not checked.
• Only public addresses. The scanner runs from the internet and refuses private, loopback, link-local and other non-public addresses.
• Only pages in scope. Skip these paths keeps it out of whole sections.

What the scan will do on a page

• Open pages. It only navigates with ordinary page loads.
• Never submit forms, other than signing in once with the login you configured.
• Never follow links that change or end something. Links that look like delete, remove, unsubscribe, deactivate, revoke, cancel or sign out are skipped, by their address and by their text, as are links that ask for confirmation or use a non-GET method.
• Press Tab, and open menus. The keyboard walk only presses Tab and Shift+Tab. To check hidden content it opens buttons that declare themselves disclosure buttons (menus, accordions, dropdowns), never links, form submit buttons, or anything labelled like buying, deleting or cancelling, and it stops if a click ever starts a navigation.

Use a test account for the login, ideally on staging. The scan behaves like a careful visitor, but a test account means nothing it sees or touches is a real customer's.

Your credentials

Logins are encrypted when saved and never displayed again. A bearer token is sent only to your site's own host, never to a CDN, analytics or any other third party the page loads. Basic credentials are bound to the site's origin.

Personal data in reports

A signed-in crawl sees real-looking data: names, emails, order numbers. Before anything leaves the scanner, email addresses, phone numbers, long numbers (such as account and order numbers), the values of form fields and sensitive URL parameters are masked in the markup, selectors, page titles and addresses the report shows. You will see them as [email], [number] and [redacted].

Identifying the scanner

The scanner identifies itself honestly. Its User-Agent is a normal Chrome User-Agent followed by:

CodityAccessibilityScanner/1.0 (+https://codity.ai)

If your staging site sits behind bot protection (Cloudflare, Akamai, DataDome and similar), allow requests whose User-Agent contains CodityAccessibilityScanner for the duration of the scan. The scanner never tries to get past a challenge: a page that serves one is reported as blocked, not checked, and Check site tells you before you pay in most cases.

Load on your site

The scanner opens one page at a time and waits for each page to settle before moving on, so its load is that of a single visitor clicking through quickly. One scan runs at a time per organization.

Isolation

Each scan runs in its own short-lived, locked-down container with no access to other customers' scans, and is removed when the scan ends.