scope-sentinel: stay inside scope, provably
A small, offline tool that confirms a URL, host or IP is in scope before you touch it — wildcards, CIDR, URL-prefix rules, deny-beats-allow, JSON output and CI exit codes.
The fastest way to lose a bug bounty payout — or worse, cross a legal line — is to test something that turns out to be out of scope. Program scope mixes wildcards, CIDR ranges, URL prefixes and explicit exclusions, and eyeballing all of that under time pressure is exactly how mistakes happen.
scope-sentinel makes the in-scope/out-of-scope call a check you run, not a judgement you make. You feed it the program's rules and a target, and it answers yes or no — with deny rules always beating allow rules.
What it does
- Matches wildcards (*.example.com), CIDR blocks and URL-prefix rules.
- Treats an explicit exclusion as final: deny beats allow, always.
- Emits machine-readable JSON so it drops into the rest of your tooling.
- Returns CI-style exit codes so it can gate an automated pipeline.
Because it is deny-first and fully offline, it fails safe: if a target is not clearly allowed, it is not tested. That is the behaviour you want a scope check to have.