Skip to main content

PyMaster

PyMaster security scanner

If you found this user agent in your server logs, this page explains what it is:

PyMasterSecurityScan/1.0

What it is

PyMasterSecurityScan is the automated web-security monitoring tool run by PyMaster. It checks websites for common security weaknesses (missing security headers, certificate problems, exposed files) and reports them to the site’s owner.

Who gets scanned

We only scan domains whose owners have engaged PyMaster for security monitoring. We do not scan the internet at large, or any site we have no agreement with.

Engaged domains are usually scanned about once a week, plus occasional on-demand scans the owner asks for.

What it checks

  1. Basic checks, for every engaged domain:

    loading the home page once to review its security headers, a TLS (HTTPS) handshake to check the certificate, and look-ups in public certificate-transparency logs and search-engine indexes. The last two don’t touch your server at all.

  2. Authorised checks, only after the owner signs written rules of engagement:

    reviewing the site’s own JavaScript files for leaked keys and publicly exposed source maps.

  3. Path and endpoint checks, only after the owner signs the rules of engagement AND proves control of the domain (a DNS record or a file on the site):

    requesting a fixed list of commonly exposed paths (such as /.env or backup files), and checking WordPress and API endpoints that commonly leak information. For exposed files the scanner reads only the response status and never downloads their contents.

What it never does

It does not exploit vulnerabilities, attempt logins, guess passwords, or send high-volume traffic. Requests use low concurrency and strict timeouts, and it refuses to connect to private or internal network addresses.

Report a problem or opt out

If you see this scanner on a site you own and you did not engage PyMaster, or you want it to stop, contact us with the domain name and the approximate time. We will investigate and stop scanning that domain.