Validate the target
Domain normalisation, public DNS checks, private network rejection, and restriction to ports 80 and 443.
ENGINE / MODULES Modular architecture
How Scanapse turns signals into evidence
Legacy collectors measure a precise scope. In V2, their outputs become observations and evidence before any claim or synthesis.
- Active collectors
- 12
- Profile dimensions
- 6
- Allowed ports
- 280 / 443
- JavaScript executed
- 0on the target
INDEX / 12 modules_page.index_label
modules_page.index_label
01 / PIPELINE Processing chain
A short collection phase, then explainable qualification
The engine separates retrieval, observation, attribution, and restitution so a detection rule cannot silently become a conclusion.
Collect signals
Limited reading of HTTP responses, certificates, DNS, and accessible HTML without executing remote code.
Build knowledge
Observations become evidence, claims, and relations with an explicit knowledge state and versioned rules.
Expose limitations
The report separates observed quality, knowledge coverage, material signals, unknowns, and changes over time.
02 / CATALOG Active catalogue
The engine, module by module
The twelve modules are independent. A local failure must reduce coverage, not interrupt the entire report.
ENGINE 2.4.8 / PATTERNS 2026.09.4
A
Public surface
Access, DNS, transport, and policies served to the browser.
01
Active
ReachabilityModule
Network reachability
Checks that a public destination responds and describes the chain that was actually reached.
Observed signals
- HTTP status and final destination
- Redirects and HTTPS upgrade
- Response time and HTML volume
- Normal, limited, or unavailable page
Output
Access status, HTTP coverage, and collection timeline.
02
Active
DnsModule
DNS and infrastructure
Observes public addressing and published services without extrapolating private architecture.
Observed signals
- Public A and AAAA records
- NS, SOA, and CAA
- MX and visible redundancy
- Observable DNSSEC signal
Output
DNS inventory, apparent redundancy, and infrastructure dependencies.
03
Active
TlsModule
TLS transport
Qualifies the TLS session negotiated by Scanapse and the certificate presented.
Observed signals
- Hostname validation
- Negotiated protocol and cipher
- Certificate issuer and dates
- Expiry and validation errors
Output
Transport status, validity window, and negotiation evidence.
04
Active
HeadersModule
Security headers
Reads policies actually served to the browser on the observed response.
Observed signals
- Content-Security-Policy
- HSTS and anti-framing
- Cross-origin policies
- Permissions-Policy and referrer
Output
Presence, consistency, and priority of protection policies.
B
Dependency chain
Third-party resources, providers, visible data, and technical footprint.
05
Active
DependenciesModule
Visible dependencies
Groups third-party hosts by provider, role, and observable criticality.
Observed signals
- Scripts, styles, images, and iframes
- Headers and infrastructure markers
- Known providers and unknown hosts
- Concentration of critical functions
Output
Map of actors, roles, attributed jurisdictions, and concentration points.
06
Active
SupplyChainModule
Loading chain control
Evaluates how external resources are loaded and isolated.
Observed signals
- Third-party scripts and SRI
- Mixed HTTP content on HTTPS
- External forms and iframes
- New-tab links and inline code
Output
Third-party surface, visible protections, and dependencies to secure.
07
Active
PrivacyModule
Observable privacy
Looks for attributable trackers and qualifies response cookie attributes.
Observed signals
- Known measurement services
- Secure and HttpOnly cookies
- SameSite policy
- Third-party cookies and visible scope
Output
Minimised tracker inventory and quality of observed cookies.
08
Active
TechnologyModule
Technology footprint
Detects only sufficiently structural technical markers to limit false positives.
Observed signals
- Generator and resource paths
- Framework root attributes
- Exposed server headers
- Runtime markers actually present
Output
Likely technologies, evidence level, and version exposure.
C
Trust and continuity
Dependencies and control, observable resilience, transparency, and email trust.
09
Active
SovereigntyModule
Visible dependencies and jurisdictions
Keeps legacy concentration and jurisdiction signals as inputs to qualify, without producing a V2 sovereignty verdict.
Observed signals
- Known provider jurisdictions
- Number of attributed countries
- External structural actors
- Share of unattributed hosts
Output
Dependency and jurisdiction evidence to correlate with other observations. Data location remains unknown without dedicated evidence.
10
Active
ResilienceModule
Visible resilience
Looks for single dependency points in critical public functions.
Observed signals
- DNS and hosting concentration
- Unique critical providers
- MX and NS redundancy
- Apparent degraded-mode capability
Output
Concentration risks and continuity priorities to verify.
11
Active
TransparencyModule
Public transparency
Checks the contact points and policies that the organisation actually makes accessible.
Observed signals
- security.txt
- Privacy policy
- Legal notice
- Contact and structured data
Output
Transparency level, resources found, and missing elements.
12
Active
MailTrustModule
Email trust
Qualifies public mechanisms intended to reduce impersonation and strengthen email transport.
Observed signals
- SPF and final qualifier
- DMARC and published policy
- TLS-RPT and MTA-STS
- BIMI and MX relay consistency
Output
Observed mail policies, associated evidence, and quality usable by the Trust Profile.
03 / BOUNDARIES Measurement boundaries
What Scanapse refuses to turn into certainty
A public observation can be useful without becoming an intrusive audit, legal evidence, or a compliance promise.
No extended port scan
Only standard web access on ports 80 and 443 is allowed by the engine.
No remote JavaScript execution
The report describes the received document, not a full automated browser.
No protection bypass
CAPTCHAs, WAFs, and authentication are neither crossed nor simulated.
No access to private networks
Local, reserved, link-local, and non-public addresses are rejected at every redirect.
No certain data location
A provider jurisdiction is an attribution, not proof of the storage location.
No automatic certification
Scores guide analysis and must remain linked to their coverage and evidence.
04 / PLUGIN CONTRACT PHP 8.2+
Add a module without rewriting the core
A module implements a stable contract, receives an already secured scan context, and returns a normalised result. The router, storage, and other analysers remain independent.
interface ScanModuleInterface
{
public function id(): string;
public function analyze(ScanContext $context): array;
}05 / LIVE TEST Live measurement
Observe all twelve modules in a real report
Run a public measurement, then open each module, its evidence, and its limitations.
Read this domain