The scanning engine is open source

Why this is open

Security tooling asks for a lot of trust. Before you point a scanner at your infrastructure, it is reasonable to want to know what it actually does — which hosts it contacts, what it does with the results, and whether it quietly reports your attack surface back to a vendor. That is not a question a marketing page can answer credibly. It is a question source code answers.

So the engine is open. You can read every network call. You can confirm there is no telemetry, because you can grep for it. You can run it in an air-gapped environment, in CI, or against a host you would never let a SaaS product near.

The licence is AGPL-3.0, chosen deliberately. You can use it, modify it and self-host it freely, including commercially. What you cannot do is take the engine, close it, and resell it as a competing hosted service without publishing your changes. That is the trade that lets the scanners stay open permanently rather than until it becomes commercially inconvenient.

14 checks, all of them real

Every check uses Node built-ins or free, keyless public services — RDAP registries, Cloudflare DNS-over-HTTPS, Certificate Transparency logs, public DNSBL zones. Nothing here is a demo, a simulation, or a teaser for the paid tier.

Stateless — run anywhere, no history needed

Stateful — compared against your last run

These keep a baseline in a plain JSON file under ~/.certnotify/state. No database, no account, nothing leaves your machine.

Four ways to run it

npx certnotify scan example.com

import { scan } from 'certnotify'

docker run --rm certnotify scan example.com

uses: siddhantmallah/certnotify-community@main

What is open, and what is not

The scanners are open and stay open. What the hosted product sells is running them continuously, remembering the results, correlating them across your estate, and telling the right person when something changes.

One nuance the table flattens: the Community edition does have monitoring, in the sense that dns-monitor and defacement compare against your previous run. The difference is who runs it. Self-hosted, you schedule it and store the baselines. On Cloud, it runs whether or not you remember to.