About
One line: one person in North Carolina runs this scanner, gives the outside check away for good, and does the inside work, SOC 2 readiness, for a fee. No audit has been done on that work, and this site certifies nothing.
Who runs it
I am Adam Ridley. I run Human Compute LLC from Winston-Salem, North Carolina. I have spent about thirty years building and running systems, and the last few of them keeping companies' cloud accounts clean enough to pass the questions a big customer asks before they sign.
securityscanner.org is mine. There is no team, no investor and no data partner behind it. It runs in my own AWS account, the emails come from my own mail setup, and the abuse address lands in my inbox.
Why it is free
The outside of a website is cheap to check and most small businesses never check it. A bot will, within hours of the site going live. So the outside check is free, for any US business, every month, for as long as the site is signed up. Free forever, no paid tier: there is nothing to upgrade to and nothing to buy.
What I get out of it is the paragraph at the bottom of each report that says what I do for a living. That is the whole business model. There are no ads. The list is never sold, rented or shared. If a sponsor ever appears in the monthly email it will be marked Sponsored and it will see only how many people are on the list, never who.
The inside is the paid work
The scanner sees what an attacker sees from the street. It cannot see inside the building: your AWS or other cloud accounts, who has access to what, old keys left live, backups, logging, and the written policies that say how the company handles all of it. That is the work I do for clients.
The goal is a company aligned with SOC 2 controls and checked against them weekly, so the day a big customer asks for a SOC 2 report there is no scramble. The holes are already fixed and the habits are already in place.
Plain statement, every time: this is readiness work, aligned with SOC 2 controls. No audit has been done on it. Only a CPA firm's examination produces a SOC 2 report, and nobody can be SOC 2 certified, because no such certificate exists. The scan on this site is not part of SOC 2, and a clean scan does not mean SOC 2 readiness. I will never say otherwise, and I will never put the AICPA logo on anything.
If you want to talk about the inside: humancompute.com.
What this site is not
- Not a penetration test. It is a read-only, outside-only check of common weaknesses. The owner-verified crawl is still read-only.
- Not a guarantee. A clean report means the doors a bot tries first are shut, not that a site cannot be broken into.
- Not a compliance badge. It issues no certificate, seal or attestation, and the grades are mine, not any standards body's.
Abuse and security contact
If the scanner has touched a domain it should not have, or you host a site and want to know what the traffic was, write to abuse@securityscanner.org. Every scan is logged against the proof the owner gave (the confirmed email, the DNS record or the file, with timestamps), and that evidence is in the reply. The domain is paused the same day. The page about the scans has the User-Agent, where the requests come from, what is sent and how to opt out.
A security problem in this site or the scanner itself: security@securityscanner.org. The details are also in /.well-known/security.txt, in the standard format (RFC 9116) that security researchers look for.
Human Compute LLC
Human Compute LLC, Winston-Salem, North Carolina. Phone +1 336 777 7237. Business email through humancompute.com.