Proposal: Security Review
As far as I can tell, this proposal essentially amounts to asking StackExchange citizens to perform a penetration test on live sites.
I can see several serious issues with this:
- It may be difficult to verify that the OP is:
- The actual owner or representative of the site.
- Authorised to request a penetration test on behalf of whatever company runs the site.
- Authorised by the hosting company to perform a penetration test on the system(s).
- I can see scopes being poorly defined, or ignored by less scrupulous users. Where's the line drawn on a web app test that results in code execution? What if shared hosting is being used?
- Malicious persons may well use a request on the proposed site as an excuse to perform attacks, which would lead to sticky legal situations for both StackExchange and users.
- Differing legal jurisdictions would cause a quagmire of potential issues. How can you ensure that people are staying above the law?
All in all, I don't think it's suitable for StackExchange.