Scout · Self-hosted

Security policy

Self-hosted Scout is not wide open — you configure domain verification, private networks, and allow/block lists.

Defaults (self_hosted)

requireDomainVerification — false (unlike cloud)
allowPrivateNetworks — false until you enable staging/VPN targets
Allow/block domain lists — empty (no extra restriction beyond blocklist)

JSON policy

json

{
  "requireDomainVerification": false,
  "allowPrivateNetworks": true,
  "allowedDomains": ["*.example.com", "staging.internal"],
  "blockedDomains": ["*.bank.example"]
}

Environment variables

SCOUT_SECURITY_POLICY — full JSON object
SCOUT_REQUIRE_DOMAIN_VERIFY=true|false
SCOUT_ALLOW_PRIVATE_NETWORKS=true|false
SCOUT_ALLOWED_DOMAINS — comma-separated, *.example.com wildcards
SCOUT_BLOCKED_DOMAINS — comma-separated blocklist

Abuse protection

Even with relaxed domain rules, the annual license is required and heartbeats are tied to your Macrocontent account. Revoke compromised keys from the console.