The complete private engine
All 22 controls, the scoring model, report renderers for HTML, JSON, CSV and TXT, the CLI and the desktop interface.
Project acquisition
Acquire a documented cybersecurity assessment platform.
This is a software project acquisition, not a subscription and not an established revenue-generating SaaS business. You are acquiring a complete, documented technical asset: the engine, the evidence model, the website and the history behind them.
Read this first: what is being sold
No customers, recurring revenue, traffic figures or commercial traction are claimed anywhere on this page. The project has been built as a documented product with a public website and a restricted public sandbox. The value on offer is the software, its documentation and its handover — not an income stream.
1 · Project overview
SMB Scanner Lite is an evidence-first external security posture assessment tool for small and medium businesses. It evaluates a catalog of 22 publicly observable security controls, produces a weighted 0–100 posture score and an A–F grade, and attaches the observation behind every conclusive finding.
The project ships as two artefacts: a private full engine (controls, scoring, reporting) and a public sandbox edition locked to five reserved testing domains, with a public website, documentation and test suite.
It was built by Muhammad Atif as a defensive security product with an explicit "no claim without evidence" standard. That standard shapes the scoring model, the four-status evidence system and the deliberately conservative wording on this site.
Asking price
$2,999 USD
Negotiable · serious enquiries only · consistent with the current marketplace listing.
2 · Technical architecture
A static public surface and a private assessment engine.
Deliberately simple to operate and to hand over.
Public surface
A dependency-free static website (HTML, CSS and one JavaScript file) generated by a small Python build script and deployed to GitHub Pages. No framework, no runtime, no database, no third-party analytics.
- Reusable design system and component layer
- Static site generator in tools/ (Python standard library only)
- Structured data, sitemap, robots and per-page metadata
- Recorded assessment data served as static JSON
Assessment engine
Python 3.10+ with modules per control group and a scoring model grounded in published RFCs and vendor guidance. Reports render to HTML, JSON, CSV and TXT.
- 22 controls across five categories with severity weights
- Four-status evidence model including inconclusive
- Hash-chained consent receipts with policy digests
- Sandbox runtime with a hard five-domain allowlist
- CLI and desktop interface
3 · Product capabilities
What the platform does today.
Documented in detail on the capability catalog, with coverage stated per control.
Scoring and grading
Weighted 0–100 score, A–F grade bands, per-category scores and severity on every finding.
Reporting
HTML, JSON, CSV and TXT. Executive summary, findings, technical evidence, recommendations and assessment metadata.
Consent evidence
Pre-scan receipts, hash chaining, policy versioning and embedded consent proof in every report.
Scan comparison
Compare two assessments of the same target to show what changed between runs.
Restricted public demo
A sandbox edition that cannot be aimed at arbitrary hosts, suitable for publishing and teaching.
Documentation
Methodology, control catalog, installation guide and privacy position written for technical and non-technical readers.
4 · The 22 controls
The catalog is part of what you acquire.
Each control is implemented, documented and weighted. The five categories carry published score weights of 20%, 25%, 20%, 15% and 20%.
Control catalog
- C01 — Address resolution and record presence (DNS)
- C02 — DNSSEC chain validation (DNS)
- C03 — CAA authorisation (DNS)
- C04 — Zone transfer exposure (DNS)
- C05 — Name record hygiene (DNS)
- C06 — SPF policy strength (Email)
- C07 — SPF record validity (Email)
- C08 — DMARC enforcement (Email)
- C09 — DKIM presence and key strength (Email)
- C10 — MX and null-MX posture (Email)
- C11 — TLS protocol versions (TLS)
- C12 — Certificate validity and hostname coverage (TLS)
- C13 — Cipher suites and forward secrecy (TLS)
- C14 — HTTPS redirect and downgrade path (TLS)
- C15 — Strict-Transport-Security (Headers)
- C16 — Content-Security-Policy (Headers)
- C17 — Clickjacking and MIME-sniffing protection (Headers)
- C18 — Referrer, permissions and version disclosure (Headers)
- C19 — High-risk port reachability (Exposure)
- C20 — SMB negotiate exposure (445) (Exposure)
- C21 — Remote Desktop reachability (3389) (Exposure)
- C22 — Database and admin interface exposure (Exposure)
5 · Testing documentation
The public repository contains a reproducible test suite covering the allowlist, consent enforcement, hash-chain integrity and CLI behaviour. Every test is named, and the validation page publishes the run metadata along with the objectives and expected results.
A larger internal validation register is maintained in the private repository. Its contents are not published, and no figures from it are claimed on this site — a buyer receives it as part of due diligence, not as marketing.
Published validation record6 · Installation and setup
Standard Python packaging with an editable install and a single console entry point. No services to provision, no database, no cloud dependencies. The website is a static bundle deployable to any static host.
Installation documentation7 · Included deliverables
What transfers, concretely.
Consent and sandbox system
Hash-chained consent receipts, policy versioning, the five-domain allowlist and the public sandbox runtime.
Source history and documentation
Full development history, development notes, methodology documentation and report templates.
Website and design assets
This website's source, design system, logo, structured data and the static site generator that builds it.
Test suite and validation record
The published sandbox test suite and the reproducible validation record described on this site.
Licensing and handover
MIT-licensed published code, private repository transfer, and full copyright assignment on completion of the sale as set out in the marketplace listing.
8 · Source code and handover
Handover covers the private repository transfer, the public repository, build instructions, a walkthrough of the scoring model and report pipeline, and a defined support window for questions after transfer. The exact window and transfer mechanics are agreed in writing before payment.
9 & 10
Licensing and intellectual property
Clear terms, stated before anyone pays anything.
- Published codeMIT licensed. That licence continues to apply to what has already been published.
- Private engineTransfers with the acquisition; it is not published anywhere at present.
- Copyright assignmentFull assignment of the project's copyright on completion of the sale, as set out in the marketplace listing.
- Third-party materialThe project relies on public standards (RFCs) and standard libraries. No third-party assets with incompatible licences are included.
- Authorisation, not capabilityNothing in the acquisition grants permission to assess third-party infrastructure. That remains a legal matter for the operator.
11
Price and terms
$2,999 USD
Negotiable. The price and terms here match the current official marketplace listing; if the two ever disagree, the listing governs.
- No subscription, no revenue share, no ongoing obligation
- No claim of existing customers, revenue or traction
- Due diligence access to the private repository on request, under NDA where appropriate
- Handover support included for an agreed period
12 · Acquisition enquiry
direct routeUse this form for acquisition questions, due diligence requests or an offer. It reaches the maintainer directly and is not mixed into the product support queue.
Marketplace listing
The project is also listed on SideProjectors. The listing is an alternative route, not the only one.
View the listingDue diligence
Repository walkthrough, scoring model review, test suite and documentation are available to serious buyers before commitment. Ask for it in the form and say what you need to see.
Direct email
Product questions belong on the product side.
If you want an assessment rather than the project itself, the assessment route is the right one.