About
A small-business tool, built by someone who wanted the honest version.
Large organisations pay teams to watch their domains every day. A clinic, a workshop or a family business usually does not. SMB Scanner Lite exists so that the outside view — forged mail, weak transport, an office file share facing the internet — can be explained without theatre.
Purpose
Show a domain's public security posture with proof attached to every line. Help an owner, or the person who looks after their IT, know what to fix first. Teach the difference between a real finding and a guess.
The product is deliberately narrow. It assesses a defined catalog of externally observable controls, scores what it actually measured, and states the limits of the method in the same report that delivers the score.
Who it is for
- Small and medium businesses that need an outside view of their public exposure
- IT administrators and managed service providers who need a defensible baseline
- Cybersecurity consultants who want evidence rather than assertion
- Defensive learners and teachers who want a scanner that refuses to wander onto someone else's network
Who it is not for
Anyone hoping to probe arbitrary companies, break in, or print a frightening report with nothing behind it. The public edition will not do that, and the private engine is distributed only for authorised assessments.
Muhammad Atif
Cybersecurity learner based in Rawalpindi, Punjab, Pakistan. Self-taught, building tools that can be explained to a non-specialist.
Fortinet NSE 2 and Cisco's Introduction to Cybersecurity sit alongside school study; this project is the practice.
How it was built
Python 3. Checks follow published standards: SPF (RFC 7208), DMARC (RFC 7489), DNSSEC (RFC 4034), TLS guidance, and an unauthenticated SMB2 negotiate that reads only dialect and signing.
Scores use an evidence model with four statuses — pass, warning, fail and inconclusive. The full source, catalog and tests live in a private repository; this public repository ships the website, the documentation and a sandbox whose allowlist is five domains long.
Project status
Stated precisely, because vagueness would be misleading.
What is public
This website, the documentation, the recorded assessment, the privacy policy and a sandbox runtime hard-locked to five test domains, with its test suite.
What stays private
The complete engine with all 22 controls, the scoring model, the internal test suite and the development history. A public scanner that can be pointed at any host becomes a weapon.
What is not claimed
No customer base, no recurring revenue, no usage statistics and no testimonials are asserted on this site. Assessment capacity is arranged directly and reviewed manually.
The complete project is available for acquisition as a documented software project. Terms, deliverables and the price are set out separately, so the product message on this site is not mixed with the sale message.
Read the claims, then check them.
Everything asserted about this product is either reproducible from the public repository or stated as a limitation.