The finding is solid. The screenshot in the appendix shows your home ISP in the IP widget and a clock that does not match the region you claimed to test. The client did not ask for a portrait of your apartment network. They got one anyway.
OPSEC here is not "become invisible". It is hygiene for authorized work: the tester's household should not become an artefact.
What leaks without a payload
You do not need a clever trick. A page that prints fetch diagnostics, a status panel, a CDN error, a payment sandbox — they all echo the client address. HAR files and proxy logs do the same. So do "contact us" forms you opened to test rate limits.
The clock leaks next to the address. We wrote that out in timezone leaks in security tests: Intl does not care about your DevTools locale.
Browser extensions you use for shopping sit in the same profile as the test. That is a second fixture problem: the site under test sees your daily browser, not the clean account in the statement of work.
A small, boring kit
We keep the kit small on purpose.
Address. Noname VPN issues a key in Telegram — @unlocknoname_bot — no email, a free day at full speed, then pay per day in the same chat when you still need the route. One key in the iOS and Android apps. A kill switch is the minimum; if the tunnel dies, the test stops, it does not silently fall back to home.
Clock. Timezone Spoofer overrides page-context time so the tab matches the exit (or a pinned IANA zone). Auto-detect from IP is the default for this job.
Profile. A dedicated browser profile for the engagement. No shopping extensions. Cookies from last year's travel stay out of this HAR.
None of that replaces a written scope. It stops the report from documenting the tester.
What this is not
It is not a method for hiding from anyone. It is not a list of scanner flags. It is not permission to touch a host that is not in the contract.
If you still need the vocabulary — assessment vs pentest vs scan — start with the opening piece. If the work is a web review inside the editor, that is Forge IDE.
One checklist we reuse
Before the first request of the day: tunnel up, kill switch on, spoofed (or auto) zone, clean profile, scope file open. After the last request: tunnel down, profile closed, HAR named with the ticket id — not dump(1).har on the desktop. The finding should describe the system, not the tester's weekend Wi-Fi.
What you can order from us
Zero Day Labs takes authorized security work — we use the same products described in this series, not a rented scanner PDF.
You can write to [email protected] or the contact form and ask for:
- a security assessment (map of assets, controls, residual risk);
- an authorized pentest on a written scope;
- a web application review (from the editor: DOM, network, evidence);
- a review of agent and tool isolation (what the agent is allowed to call);
- help making test fixtures honest (locale, timezone, exit address) so the report describes your system, not the tester's laptop.
Say which job you want, the scope, and what "done" looks like. We reply with a concrete proposal — same rule as the rest of the site.