Who is hitting your site, and why.

Identity

Every request we make carries this user-agent, and it does not change:

User-Agent: RevorbiBot/1.0 (+https://revorbi.com/bot)

A user-agent proves nothing on its own — anyone can send that string. Use one of the three checks below instead.

1. Reverse DNS

Our crawler IPs resolve to *.crawl.revorbi.com, and forward-resolving that hostname returns the same IP. Check both directions: a one-way PTR lookup is spoofable, because anyone can point their own reverse zone wherever they like.

2. Published address ranges

Versioned JSON at https://revorbi.com/.well-known/revorbi-ips.json, for allowlisting programmatically. Changes are announced with lead time.

3. HTTP Message Signatures

Outbound requests are signed with a key published at a well-known location on this domain. The strongest of the three, and the same check we ask visiting agents to support.

What it does, and why

Verifies a domain you enrolled

One fetch of your homepage, looking for the tag you pasted. This is how we confirm you control the domain before collecting anything about it — the alternative is letting anyone enrol a competitor.

Builds a page inventory

Reads robots.txt and your sitemap, then a small sample of pages, to work out which questions suit which page type.

Generates first-run samples

Runs our own agent against a few of your pages so your dashboard has something real in it on day one instead of an empty state. Those are labelled as ours, excluded from every metric, and you can delete them.

Crawl behaviour

• No more than one request per second per host. We never parallelise across your site.
• The whole scan is time-boxed. A slow or enormous site gets a partial inventory rather than sustained traffic.
• We respect robots.txt for the sitemap crawl.
• We do not respect robots.txt for verifying a domain the customer explicitly enrolled. That single fetch is performed at the customer's request against their own property, and treating it as crawling would break onboarding for anyone with a restrictive robots file. We would rather state that plainly here than have you find it.

Opting out

This stops everything except the verification fetch described above, which only happens for a domain someone enrolled:

User-agent: RevorbiBot
Disallow: /

For anything else — a range that looks wrong, traffic you cannot account for, a request to stop entirely — email [email protected]. A person answers it.

What we never collect

The feedback format asks a visiting agent about page content. It does not ask for, and will not store, an end user's prompt, their personal information, or anything that identifies them. That is declared machine-readably on every question document we serve (collects_user_data: false), and it is stated in the format specification rather than only in prose here.