StatusScout

StatusScout watches the parts of a website that quietly break: an expiring certificate, a security header someone removed, a config file left readable, a subdomain pointing at nothing. It runs the checks on a schedule and sends an alert when something changes, so the discovery does not happen through a customer.

The repository is a workspace monorepo. A Fastify REST API serves the React dashboard and the public scan page, a cron package triggers periodic checks, a background worker executes them, and shared utilities handle notifications and issue history. MongoDB and Redis sit behind it, and Docker Compose starts everything at once.

The checks cover more ground than uptime alone.

• Certificates: SSL and TLS validity is tracked and flagged before it lapses.
• Headers and cookies: security headers, cookie settings, mixed content and general page security are inspected.
• Exposure: sensitive files, hidden paths and exposed API documentation are hunted using bundled wordlists.
• DNS: subfinder discovers subdomains and subzy checks them for takeover.
• Browser flows: Playwright Chromium drives custom flow checks against real pages.
• Broken links: dead links are reported alongside the security findings.

The quick path needs only Docker and Docker Compose; development also wants Node.js 20 or newer, local MongoDB and Redis, and the Go tools and Chromium above, without which the DNS and flow checks fail gracefully. The license is source-available, free for personal and commercial self-hosted use, with reselling it as a hosted service restricted.