A client asked me to build a "quick security check" tool for their agency's lead generation funnel, the kind where a visitor types in a domain and gets a security score back. Simple enough in concept. Then I actually sat down to build it and ran straight into a legal wall I hadn't fully thought through.
Here's the problem. The obvious way to build something like this is to run an active scan: port scan the target, maybe throw a few known exploit checks at it, see what comes back. That's how most security scanning tools work, and it's also, depending on jurisdiction, potentially illegal if you don't own the system you're scanning. Where I operate, unauthorized access to a computer system, even a read-only probe, falls under the same statute as actually breaking in. A visitor typing a random competitor's domain into my tool and getting me to port-scan it on their behalf was not a liability I wanted to hold.
So the tool had to be entirely passive. No packet gets sent to the target system, full stop. Everything comes from third-party services that have already scanned the internet and cached the results, meaning I'm querying a database, not the target.
Four sources ended up covering most of what a basic security posture check needs.
