docs: add safety considerations to internal scanning

cloud/scanning/internal-scan.mdx

@@ -5,19 +5,19 @@
 
 Internal network security is critical yet often overlooked. Once attackers gain initial access through configuration drift, phishing, or compromised credentials, they can rapidly expand their foothold by exploiting internal vulnerabilities. This lateral movement can lead to devastating breaches, making internal vulnerability scanning as crucial as external assessments.
 
 ProjectDiscovery offers two distinct approaches for internal network vulnerability scanning, each designed to fit different organizational needs while maintaining our core focus on exploitability and accurate detection.
 
 <CardGroup cols={2}>
   <Card title="Agent based Scanning" icon="cloud" color="blue">
     Use pd-agent for seamless internal scanning through our platform. Perfect for large networks and centralized security management.
   </Card>
   <Card title="Local Scanning & Upload" icon="upload">
     Run Nuclei locally and upload results to PD's platform. Ideal for teams with existing scanning workflows or specific network restrictions.
   </Card>
 </CardGroup>
 
 <Note>
   Internal scanning helps identify misconfigurations, unpatched systems, and security gaps that could be exploited for lateral movement before attackers can leverage them.
 </Note>
 
 ## Method 1: Agent based Scanning (Recommended)
@@ -26,14 +26,14 @@
 
 ### What is pd-agent?
 
 pd-agent is a lightweight agent that you deploy within your internal network to execute scans and enumerations remotely. It establishes a secure outbound connection to ProjectDiscovery's platform, receives scan configurations, and runs them locally. Nuclei, httpx, naabu, dnsx, and tlsx are all built into the agent — there's nothing else to install on the host, and nothing in your network needs to be exposed publicly.
 
 **Key Capabilities:**
 
 - **Multi-Tool Scanning**: Runs Nuclei, httpx, naabu, dnsx, and tlsx — vulnerability scanning, port discovery, HTTP probing, DNS enumeration, and TLS inspection, all from a single agent
 - **Network Discovery**: Automatically discovers the host's subnets on registration. Inside Kubernetes it discovers node IPs, pod CIDRs, and service CIDRs and reports them to the platform
 - **Vulnerability Scanning**: Execute Nuclei-based scans using templates from the ProjectDiscovery platform
 - **Network Routing**: Assign each agent a network name (`-agent-network`) to route scans to specific sites, data centers, or VPCs
 - **Parallel Execution**: Splits each scan into chunks and runs them concurrently, auto-tuning parallelism to the host's available CPU for faster completion
 
 <Note>
@@ -54,7 +54,7 @@
 </Note>
 
 <Warning>
   **Distribute large scans and discoveries across multiple agents.** For large networks, deploy **several agents with the same `-agent-network` name** instead of one big agent. Agents sharing a network name automatically fan in on the same scans and discoveries — work is split across them with no leader and no manual sharding, so two agents finish in roughly half the time. This is the recommended setup for any sizeable internal environment. See the [scaling guide](https://github.com/projectdiscovery/pd-agent/blob/main/docs/scaling.md) for autoscaling.
 </Warning>
 
 ### Step 1: Create a Network
@@ -119,7 +119,7 @@
 
   <CardGroup cols={2}>
     <Card title="Install guide" icon="github" href="https://github.com/projectdiscovery/pd-agent/blob/main/docs/install.md">
       Docker, Kubernetes, systemd, launchd, and Windows (NSSM) service installs.
     </Card>
     <Card title="Configuration" icon="sliders" href="https://github.com/projectdiscovery/pd-agent/blob/main/docs/configuration.md">
       Every environment variable and CLI flag the agent accepts.
@@ -127,7 +127,7 @@
   </CardGroup>
 </Tip>
 
 Once the agent runs successfully, it appears in your network dashboard along with the subnets it discovered on the host, indicating that it's ready to execute scans.
 
 <Frame>
   <img src="/images/internal_scan_setup_demo.gif" alt="Complete pd-agent Setup: Create Network, Install Agent, and Verify Connection" />
@@ -155,9 +155,9 @@
 Once your pd-agent is connected and assets are discovered (optional), you can trigger vulnerability scans. The workflow is identical to external scanning - configure scans through the same interface and view results in the same dashboard.
 
 1. Click on the **Scan** button for the network you want to scan, or go to the **Scans** menu (https://cloud.projectdiscovery.io/scans) and click **Create New Scan**, choose **Internal** followed by the network
 2. Select the Asset Group created from the previous discovery operation, or manually enter your targets (internal IPs, hostnames, or CIDR ranges like `192.168.1.0/24`, `internal-server.local`)
-3. Select Nuclei templates (CVEs, misconfigurations, vulnerabilities, etc.) and configure scan settings (rate limits, headers, parameters)
+3. Select Nuclei templates (CVEs, misconfigurations, vulnerabilities, etc.) and configure scan settings (rate limits, headers, parameters). If the network contains printers, OT controllers, or other embedded devices, review [Safety Considerations](#safety-considerations) first
 4. Click **Create Scan** to start - the agent runs the scan locally using its embedded toolset (nuclei, httpx, naabu, dnsx, tlsx) and streams results back to your dashboard
 
 <Frame>
   <img src="/images/internal_scan_vuln_scan_demo.gif" alt="Creating and Running an Internal Scan in PDCP" />
@@ -227,6 +227,29 @@
 nuclei -u http://internal-target -t misconfiguration/ -cloud-upload
 ```
 
+Before pointing Nuclei at an internal range, review [Safety Considerations](#safety-considerations).
+
 <Note>
   This method is ideal when you want to maintain complete control over scan execution or integrate with existing automation scripts.
-</Note>
+</Note>
+
+## Safety Considerations
+
+Internal ranges include hardware that public-facing scans never touch: printers, badge readers, PLCs, VoIP phones, and other embedded devices. Most run minimal firmware, and some do not fail safely when probed.
+
+<Warning>
+  **Printer templates can have physical side effects.** Nuclei ships checks that reach printers and MFPs over raw print protocols (port `9100` / JetDirect), IPP, and SNMP. On live hardware they can print pages, change the control-panel display, use up toner, or hang the print controller until someone power-cycles it.
+</Warning>
+
+Decide for each category below whether it is in scope with those side effects accepted, or excluded.
+
+- **Printers and MFPs**: Prefer banner grabs, SNMP reads, and version fingerprinting over templates that submit print jobs. If they stay in scope, run the scan when IT or facilities is expecting it.
+- **OT/ICS and building systems**: PLCs, HVAC controllers, badge readers, and fire panels can fail unsafely under scanning. Keep these to read-only discovery, with sign-off from the team that owns the physical systems.
+- **VoIP phones and end-of-life hardware**: Desk phones and unpatched appliances break more easily than the rest of your inventory, and recovery often means someone walking to the device.
+- **Directory services**: Credential checks against Active Directory can lock out real user and service accounts. Settle lockout thresholds with your identity team first.
+- **Network appliances**: Firewalls, load balancers, and older switches have finite connection tables. A fast port sweep across a segment can fill one and disrupt traffic unrelated to the scan.
+
+### Excluding devices from a scan
+
+- **Agent based scanning**: Add printer, OT, and appliance ranges to [Scan Exclusions](/cloud/scanning/exclusions) under **Settings → Scan Exclusions**. Exclusions are global, so one entry also covers scheduled and automated scans. Template exclusions work the same way when the range should be scanned but a specific check should not run.
+- **Local scanning and upload**: Nuclei tags its most disruptive templates and leaves them out of default scans; they run only when you request them with `-itags`. Narrow the rest with `-exclude-templates`, or point `-t` at specific template directories.