Recorded assessment
The real thing, stored and labelled.
This page renders a genuine SMB Scanner Lite assessment that was run on 28 October 2026 against example.com. It is a recording, not a live scan: the timestamp, report ID, scanner version and consent receipt are all shown, and nothing you do here sends a network request to a target.
Choose an approved domain
5 permittedSelecting a domain loads its stored profile. The allowlist below is the same list enforced by the sandbox runtime — it is not possible to enter an arbitrary target here, because there is no field to type into.
Loading a recorded profile
What "recorded" means here
An SMB Scanner Lite run was executed against a reserved test domain with the operator's consent. Its output was stored as static data. This page replays that output. It does not contact example.com, it does not scan your domain, and it cannot be made to scan anything else.
- The score, grade, findings and evidence are the recorded values
- The timestamp is the moment the assessment ran
- Profiles without a dated capture are labelled as reference profiles
- Nothing is generated to look plausible
| Target | example.com |
|---|---|
| Assessed | 28 October 2026, 17:25 UTC |
| Report ID | SMB-SANDBOX-20261028-A91144E4 |
| Scanner | v5.2.0 · Public Sandbox Edition (5-Domain Locked) |
| Result | 86/100 · grade B |
| Controls | 8 completed · 0 inconclusive |
| Consent | CONSENT-20261028-A91144E4 |
Explore the controls
Open any control to see what it evaluates and what this run recorded.
All 22 controls are listed. The eight that ran are marked with their recorded status; the rest belong to the full engine and are labelled as not part of this run.
Select a control to see its definition and, where available, the evidence recorded in this run.
Loading the recorded data requires JavaScript. The full catalog is also published as static documentation on the capabilities page.
Downloads
Take the recorded assessment with you.
Four formats, sanitised. They contain no internal hostnames, credentials or private infrastructure detail.
Why the demo is restricted
A public scanner that can be aimed at anyone is a weapon.
The allowlist is enforced inside the runtime, not in this interface. A look-alike subdomain, a raw IP address, a trailing dot or a different port is rejected before a network request is made.
- Five names, nothing elseexample.com, example.org, example.net, scanme.nmap.org, badssl.com
- Rejection happens firstValidation precedes any lookup, so an unapproved target never generates traffic.
- No arbitrary inputThis page offers buttons, not a text field. Even the buttons are checked against the allowlist again before data is displayed.
- Consent before actionThe actual command-line sandbox requires an accepted policy and a signed receipt before it runs.
What you can learn from the demo
- How a posture score and grade are presented alongside the findings that produced them
- What an evidence string looks like, and how to verify one yourself
- How findings map to the 22-control catalog
- What a warning looks like next to a pass, and why inconclusive is separate
- What report metadata and consent proof look like in practice
What it cannot show you is your own domain. For that, request a private assessment — scope and authorisation are agreed first.
Seen enough? Request an assessment of your own domain.
Reviewed manually, authorised in writing, and reported with the same evidence standard.