diff --git a/capabilities/web-security/capability.yaml b/capabilities/web-security/capability.yaml
index f32d38b..db92478 100644
--- a/capabilities/web-security/capability.yaml
+++ b/capabilities/web-security/capability.yaml
@@ -1,6 +1,6 @@
 schema: 1
 name: web-security
-version: "1.15.0"
+version: "1.15.1"
 description: >
   Web application penetration testing with 83 attack technique playbooks
   covering HTTP desync/request smuggling, cache poisoning, SSRF, SSTI, DOM
diff --git a/capabilities/web-security/docker/Dockerfile.runtime b/capabilities/web-security/docker/Dockerfile.runtime
index d3004a6..cac65b7 100644
--- a/capabilities/web-security/docker/Dockerfile.runtime
+++ b/capabilities/web-security/docker/Dockerfile.runtime
@@ -20,7 +20,6 @@
 #   - 2fa                 (TOTP code generation)
 #   - agent-browser       (headless Chromium for DOM interaction)
 #   - kiterunner          (API-aware content discovery)
-#   - surf                (SSRF target identification)
 #   - wrangler            (Cloudflare Workers CLI for custom OAST endpoints)
 #   - pacu                (AWS exploitation framework)
 #   - ast-grep            (AST-based code pattern search via tree-sitter)
@@ -108,8 +107,7 @@ RUN git clone --depth 1 https://github.com/assetnote/kiterunner /tmp/kiterunner
  && rm -rf /tmp/kiterunner \
  || echo "WARN: kiterunner build failed, skipping"
 
-# ── surf (SSRF target identification) ────────────────────────────
-RUN go install github.com/assetnote/surf/cmd/surf@latest
+# surf is not installed: upstream grants no licence (ADM-447).
 
 # ── protoscope ──────────────────────────────────────────────────────
 RUN go install github.com/protocolbuffers/protoscope/cmd/protoscope@latest
diff --git a/capabilities/web-security/scripts/install_tools.sh b/capabilities/web-security/scripts/install_tools.sh
index 4a01d31..05ce566 100755
--- a/capabilities/web-security/scripts/install_tools.sh
+++ b/capabilities/web-security/scripts/install_tools.sh
@@ -62,13 +62,12 @@ GO_TOOL_VERSIONS_pdtm="v0.1.5"
 GO_TOOL_VERSIONS_protoscope="v0.0.0-20221109213918-8e7a6aafa2c9"
 GO_TOOL_VERSIONS_interactsh="v1.3.1"
 GO_TOOL_VERSIONS_2fa="v1.2.0"
-GO_TOOL_VERSIONS_surf="v0.0.5"
 
 PD_TOOLS="nuclei httpx subfinder naabu dnsx uncover alterx tlsx asnmap"
 
 # What is actually missing, before anything is fetched.
 missing_go_tools=""
-for tool in protoscope interactsh-client 2fa surf; do
+for tool in protoscope interactsh-client 2fa; do
   have "$tool" || missing_go_tools="$missing_go_tools $tool"
 done
 missing_pd_tools=""
@@ -127,8 +126,8 @@ have interactsh-client || \
 # -- 2fa (TOTP generator) --------------------------------------------------
 have 2fa || go install "rsc.io/2fa@${GO_TOOL_VERSIONS_2fa}"
 
-# -- surf (SSRF target identification) ------------------------------------
-have surf || go install "github.com/assetnote/surf/cmd/surf@${GO_TOOL_VERSIONS_surf}"
+# surf is not installed: upstream grants no licence, so we have no right to use
+# or redistribute it (ADM-447).
 
 # -- kiterunner (API content discovery) ------------------------------------
 if ! have kr; then
diff --git a/capabilities/web-security/skills/timing-attack-recon/SKILL.md b/capabilities/web-security/skills/timing-attack-recon/SKILL.md
index 01a608b..ced1802 100644
--- a/capabilities/web-security/skills/timing-attack-recon/SKILL.md
+++ b/capabilities/web-security/skills/timing-attack-recon/SKILL.md
@@ -74,7 +74,7 @@ Highest-value technique. Detect proxy endpoints routing to internal services --
 Once scoped proxy is confirmed via timing:
 1. Feed it your subdomain list -- timing reveals which resolve internally
 2. Test RFC1918 ranges on common ports (80, 443, 8080, 8443)
-3. Pre-filter candidates: `surf -l hosts.txt`
+3. Pre-filter candidates: probe the range with `naabu`/`httpx` for live hosts
 
 ### Front-End Impersonation
 If the proxy respects forwarded headers: