Scout · Self-hosted

Security policy

Self-hosted Scout is not wide open — you configure private networks and allow/block lists. Domain verify is never required.

Defaults (self_hosted)

requireDomainVerification — always false. Env and JSON cannot turn it on. You do not need DNS TXT or a well-known file.
allowPrivateNetworks — false until you enable staging/VPN targets
Allow/block domain lists — empty (no extra restriction beyond blocklist)

JSON policy

json

{
  "requireDomainVerification": false,
  "allowPrivateNetworks": true,
  "allowedDomains": ["*.example.com", "staging.internal"],
  "blockedDomains": ["*.bank.example"]
}

Environment variables

SCOUT_SECURITY_POLICY — JSON for private networks and allow/block lists. requireDomainVerification is ignored (always off).
SCOUT_REQUIRE_DOMAIN_VERIFY — ignored in self_hosted (always off)
SCOUT_ALLOW_PRIVATE_NETWORKS=true|false
SCOUT_ALLOWED_DOMAINS — comma-separated, *.example.com wildcards
SCOUT_BLOCKED_DOMAINS — comma-separated blocklist
SCOUT_STEALTH_RUNTIME_ENABLED=true|false — opt in/out of the dedicated stealth runtime

Stealth runtime on self-hosted

stealth: true is allowed without DNS verify in self_hosted. The runtime uses profile chromium-stealth-init-v2 (full Chromium, automation flags stripped, fingerprint init script). Pair with solve_captcha: true so Cloudflare JS / Turnstile checkbox on your own site can complete. Check GET /health → stealth_runtime before enabling in production. If you disable the runtime via SCOUT_STEALTH_RUNTIME_ENABLED=false, Scout returns a clear infrastructure error instead of silently downgrading.

Abuse protection

Even with relaxed domain rules, the annual license is required and heartbeats are tied to your Macrocontent account. Revoke compromised keys from the console.