Verify your domain for active security scans

Passive security checks are safe to run against any site. Active scans are different: they send crafted, attack-style requests to probe for injection and other weaknesses. Pointing that at a site you don’t own would be a problem, so CodeReviewer only runs active scans against verified domains.

You only need to verify each domain once. After that, active scans against it are available to every project in your workspace.

Before you start

• You need to be a workspace admin.
• You need to be able to add a DNS record for the domain, or publish a file on the website.
• Verify the exact host you’ll scan, for example staging.yourapp.com.

Step 1: add the domain

1. Go to Settings → Verified domains.
2. Enter the host name, such as staging.yourapp.com, without https:// or a path.
3. Choose a method: DNS TXT record or Well-known file.
4. Click Add. CodeReviewer generates a unique verification token for the domain.

Step 2, option A: DNS TXT record

Add a TXT record to the domain itself (the host you entered, not only its parent domain), with this value:

lonewolf-domain-verification=<your token>

The exact value, token included, is shown next to the domain in Settings, ready to copy. In most DNS providers:

• Type: TXT
• Name / host: the host you’re verifying (for a subdomain, often just staging)
• Value: the full lonewolf-domain-verification=… string

DNS changes can take a few minutes to propagate, and occasionally longer.

Use this method when you control DNS and want verification that doesn’t depend on the app being deployed.

Step 2, option B: well-known file

Publish a plain-text file at this path on the domain:

https://staging.yourapp.com/.well-known/lonewolf-verification.txt

The file should contain your verification token, shown next to the domain in Settings. It must be served over HTTPS and publicly readable, with no login in front of it.

Use this method when changing DNS is slow or handled by another team, and you can deploy a static file.

Step 3: verify

Click Verify now next to the domain. CodeReviewer looks for your proof and marks the domain Verified. If it can’t find it, you’ll see exactly what it checked. For example, it reports which TXT records it found, so a typo or an unpropagated record is easy to spot.

If verification can’t complete straight away, CodeReviewer keeps retrying in the background, so a record that propagates later will still be picked up.

Keep the proof in place

Ownership isn’t checked only once. CodeReviewer re-confirms verified domains every few hours. If the TXT record or file disappears, the domain moves to Failed and active scans against it stop until the proof is back. This way, a domain you no longer control can’t remain scannable.

Leave the record or file in place for as long as you want active scanning.

Troubleshooting

• “No TXT record found.” Check that the record is on the exact host you added (staging.yourapp.com, not just yourapp.com), and give DNS a little longer.
• The file isn’t found. Check the path (/.well-known/lonewolf-verification.txt) and that it’s served over HTTPS with a direct 200 response. Redirects aren’t followed, so a redirect to a login page or another host counts as a failure. Also make sure your framework isn’t routing .well-known elsewhere.
• IPv6-only hosts. The file method needs a public IPv4 address. Hosts reachable only over IPv6 should use the DNS TXT method.
• Private addresses. Only public host names can be verified. Internal-only hosts and IP addresses aren’t supported.

What verification gets you

Once a domain is verified, you can run active DAST scans against it from any security target or test suite that points at it. Findings arrive with severity and remediation, and like every finding they can become issues, be located in your code and be fixed.