Script Scanning
Scripts are scanned on create and when the body or runtime changes, when scanning is enabled.
When we scan
On create and when the body or runtime changes, if scanning is enabled for the site. Private and unlisted scripts are scanned too.
A clean result is not a guarantee. The client still executes whatever bytes it downloads.
Hold and quarantine
- ScanningHTTP 200,
X-Runny-Status: scanning, stub body. - QuarantinedHTTP 200,
X-Runny-Status: quarantined, stub body. Original withheld.
Operators can quarantine from abuse review. We do not execute the script on our hosts to inspect it.