ScanBastion Join Early Access

Changelog

Changelog

Last updated

What has changed on this website and, once there is something to show, in the product. ScanBastion is in development with no launch date set; the early-access list is told first when that changes. Entries are also published as an RSS feed.

Cookieless visit counting with Ahrefs Web Analytics

  • Every page now loads the Ahrefs Web Analytics script to count visits. It sets no cookies and uses no local storage; confirmation and unsubscribe links are reported without their token.
  • The Content-Security-Policy allows scripts from, and connections to, analytics.ahrefs.com and nothing else outside our origin.
  • The Privacy Policy has a new section on what the script sends and why, and About no longer says the site runs no analytics.

Fonts served from our own domain; this changelog

  • Manrope and JetBrains Mono are now served from scanbastion.com as variable WOFF2 files (latin and latin-ext subsets, 83 KB in total) instead of from Google Fonts. Pages no longer make any request to a third party.
  • The Content-Security-Policy now allows styles and fonts from our own origin only.
  • The Privacy Policy no longer needs a section on Google Fonts, and says so.
  • This changelog, with its own RSS feed at /changelog/feed.xml.

Sample report and proposed pricing

  • A Reports page with the complete eight-page sample assessment report as PDF, built from fictional data to show every section, including a partial stage and a verification log.
  • A Pricing page with proposed plans per verified target, what every plan shares, and a dated comparison with HostedScan. Prices are proposed and will be confirmed before launch.
  • The home page FAQ answers "How much will it cost?".

Scan engine pages and the first six guides

  • One page per scan engine: HTTP security headers, TLS and certificate analysis, passive OWASP ZAP, curated Nuclei. Each says what the check sends, how findings are graded, what it cannot tell you.
  • Learn: six guides on reading scanner findings, DNS TXT verification, false positives, security headers for agency developers, what a scan covers, and passive versus active scanning. RSS at /learn/feed.xml.
  • About names the founder. Breadcrumbs on every content page.

Policies, company pages, structured data and a share image

  • About, Responsible Scanning Policy, Privacy Policy, Website Terms and Contact replace the placeholder pages. The operator is named with a postal address.
  • security.txt per RFC 9116, a generated sitemap, favicon set and web manifest, and a share image for links.
  • Structured data for the organisation, the website, the product and the FAQ.

Website launched with early-access sign-up

  • The home page: what ScanBastion is planned to do, for whom, with illustrative previews clearly labelled as sample data.
  • Early-access sign-up with double opt-in, one-click unsubscribe, a honeypot and rate limiting. No cookies, no analytics.
  • Strict Content-Security-Policy and the usual security headers from day one.

Design brief and technical specification

  • The website design brief, a revision brief sharpening the positioning for agencies and consultants, and the implementation specification for the scanning service were written and committed. They set the scope that everything since has followed.