Can I add an IP address as a target?

Yes, as long as it is a public IPv4 address. Private ranges (10.x, 172.16–31.x, 192.168.x), loopback, and link-local addresses are rejected.

Why can't I delete a target?

A target that still has scans attached cannot be deleted. Archive or delete those scans first, then remove the target. This keeps scan history consistent.

Do I need to prove I own the domain?

There is no DNS or meta-tag verification step. Instead, every scan is gated by a safety filter for non-public and restricted hosts, and accounts found scanning systems they do not own are suspended. Only test what you own or have written permission for.

Targets: Adding URLs & Scope Rules

What counts as a target

A target is a single origin — https://app.example.com — registered in your organization. Scans, findings, badges, and monitoring all hang off it. You can hold up to 50 targets on Pro and Lifetime and an unlimited number on Enterprise.

Adding a target

Targets → Add target: paste the URL and press Enter. https:// is prepended if you leave the scheme out.

New Scan → Target step: type the URL there instead. The target is created automatically when you launch the scan, so you never have to visit the Targets page first.

Client-side checks before the request is sent:

Check	Error you will see
Empty input	Enter a URL to scan
Not parseable	Not a valid URL
Scheme other than http/https	Only http:// and https:// are supported
Bare hostname with no TLD (other than localhost / an IP)	Domain must include a TLD (e.g. example.com)
Illegal characters in the host	Domain contains invalid characters

The host is lower-cased and trailing slashes are stripped, so https://Example.com/ and https://example.com are the same target.

Scope

In the New Scan wizard, Scan Scope controls how far the crawler roams:

Single URL only — test the entered page and what it links to on the same path.
Entire domain — crawl the full origin (*.example.com shown as a hint; the crawl stays on the registered host).
Include subdomains — also follow links onto subdomains of the registered host.

You can hand the crawler a Sitemap URL so no page is missed, and an OpenAPI/Swagger URL so the API profile knows every endpoint and parameter shape.

Which URLs are refused

The backend applies a safety filter to every target before a scan is queued. Refused:

Loopback, private, and link-local addresses, including the cloud metadata IP 169.254.169.254.
localhost and hosts ending in .local, .internal, .test, .example, .invalid.
Government and military domains (.gov, .mil, .gov.uk, .gov.au, .govt.nz).
A short denylist of well-known placeholder and third-party domains.

If you need to test a pre-production build, deploy it to a public preview URL and scan that.

Authorization

VibeEval is meant only for systems you own or have explicit written permission to test. The product does not ask for a DNS record or verification file; it relies on the rules above and on abuse review. If an account is flagged for scanning third-party systems it is suspended, the dashboard is replaced with a notice, and you are asked to email support to clarify intent.

The Targets page

For each target you see: total findings, last scan time, date added, a type badge, and per-severity risk counters at the top of the page. The row menu offers:

Scan Now — starts a browser scan of that target with default options.
Remove — deletes the target. Fails with a clear message if scans are still attached.

Monitoring

On a completed scan, Set up monitoring registers the target for weekly re-checks and change alerts. It is opt-in per target and can be switched off from Targets at any time. Monitoring is an early-access capability; treat one-off re-runs as the reliable path today and see Running scans.

TARGETS