How Riskcovery reads a site

• A site under review gets one run every UTC day, on the hosts its review agreement names. The run starts at 00:00 UTC, or when the site is set up, and its agent works on the site until that day ends, so its requests come throughout the day.
• Each run starts a fresh Linux machine of its own and gives an AI agent on it the goal of the review. The agent decides how to read the site, with the tools installed on that machine, and is told to only read it: never to sign up, log in, buy, post, or submit a form. The agent keeps reading the site until the run’s UTC day ends and keeps its report current as it goes; when the day ends, Riskcovery stops the agent and deletes the machine.
• Riskcovery staff also evaluate a small number of public websites that no team has put under review, to measure how the review works on real sites. A staff evaluation is a single fast run that staff start by hand, with no verification proof and no review agreement. It reads only the site’s own host, is labeled as staff work, mails no one, and its results go to no customer.
• When a team verifies a site, and again before every run but a staff evaluation, Riskcovery reads the proof the team chose: the DNS TXT record, or the meta tag on the home page or the verification file, which it reads through Firecrawl with the user agent Riskcovery/1 (+https://riskcovery.com/crawler).
• Every hour Riskcovery downloads the CVE Program’s public CVE List from GitHub for its vulnerability pages. That download reads no website.

The agent’s requests come from the cloud machine its run started, with the user agent of whichever tool it reads the site with there, such as curl or a browser.

Riskcovery runs each machine on boat, so the agent’s requests come from boat’s servers, and Riskcovery publishes no IP ranges for them.

A robots.txt line does not stop a review, since Riskcovery does not apply robots.txt for the agent. These do:

• A team reviewing its own site revokes the review agreement on the site’s page in Riskcovery. Revoking cancels a queued or running run, and the run’s machine is deleted.
• Removing the site’s verification proof stops its runs until the proof is back.
• Anyone can write to us about a run, naming the host it read. We leave a site out of staff evaluations when its owner asks.