We scanned our own website first

League Softwares

The challenge

A security company should be able to pass its own checks, and be honest when it does not. On 13 October 2026 we pointed our website scanner at leaguesoftwares.com. It crawled the public pages and scored the site 98 out of 100, with two informational findings.

The first was that robots.txt listed the address of our admin area. robots.txt is public, so listing a private path tells everyone where it is. The second was that the site published no security.txt file, so a researcher who found a problem had no stated way to report it.

Neither finding was an open door. The admin area already required sign-in and already told search engines not to index it. They were still worth fixing, and they are typical of what a first scan turns up.

The approach

We removed the admin path from robots.txt and relied on the sign-in requirement and the existing no-index headers instead. We published /.well-known/security.txt with a contact address and an expiry date that renews itself.

Running the scanner on real websites also exposed faults in the scanner itself, which we fixed and covered with tests. It failed on some websites because of how it addressed them, it could not read compressed responses, it gave up if the first network address did not answer, and it wrongly reported a canonical link as an insecure resource. A tool that reports false problems, or fails silently, is worse than no tool, so these mattered as much as the findings on our site.

The outcome

A second scan the same day crawled 15 pages and returned 100 out of 100 with no findings.

That score needs its caveat. It covers the automated checks that ran on the pages the scanner could reach: HTTPS, security headers, cookies, exposed files, public API descriptions and crawler controls. It does not cover sign-in, access control or business logic, and it is not a certification. Those need a person, which is why we offer a reviewed assessment separately.

Technology: Python, FastAPI, SQLite, Railway

Visit project

Questions about scope, costs, or getting started? Read our project FAQs.