All vulnerability scans require an uploaded authorization permit and manual admin review before anything runs. No scan is ever automatic.