StatusScout is a self-hosted, source-available website health and security monitor that schedules checks on security headers, SSL/TLS certificates, DNS records, exposed files and related weaknesses and alerts when something breaks, built for developers, operators and small teams who want that coverage without handing scan data to a hosted service.

What it is

StatusScout is a JavaScript application that monitors security headers, SSL certificates, DNS records, exposed files and more, and raises an alert the moment something goes wrong. The repository is organised as a workspace: packages/api/ holds the Fastify REST API server, packages/cron/ is the cron scheduler that triggers periodic checks, packages/frontend/ is the React dashboard used after login, packages/landing/ is the public marketing and scan page, packages/shared/ carries shared utilities for notifications and issue history, packages/worker/ is the background worker that executes all checks, and assets/ stores static assets including the wordlists used by the checks. It sits in the Infrastructure and Operations category, under Monitoring and Observability, and is tagged monitoring, monitoring-tool and security.

The concrete problem is that the routine health and security checks a site needs — header configuration, certificate validity, DNS health, hidden or sensitive paths, cookie flags, mixed content, exposed API documentation, broken links — are normally run by hand or through someone else's hosted scan page, with no kept history and no alerting attached. StatusScout turns that routine into scheduled background work with notifications and a record of issues, running on infrastructure the operator controls. The README states the shape plainly: the tool is self-hosted, open source and free to run, with a free scan at statusscout.dev available for a one-off look with no signup.

Key capabilities

• Checks security headers on monitored sites.
• Validates SSL/TLS certificate validity.
• Detects exposed sensitive files and hidden paths, using wordlists shipped in assets/.
• Runs DNS health checks, including subdomain discovery through subfinder and subdomain takeover detection through subzy.
• Inspects cookie security and mixed content.
• Reports exposed API documentation and broken links.
• Records issue history and sends notifications through packages/shared/, with checks scheduled by packages/cron/, executed by packages/worker/, and surfaced through the Fastify API in packages/api/ and the React dashboard in packages/frontend/.

Who uses it and how

• Self-hosters who want the whole stack on their own machine or server, started with a single docker compose up -d and reached at http://localhost:3000.
• Individuals and companies running it for personal or commercial self-hosted use, which the licence permits, as long as it is not resold as a hosted service.
• Teams that need scheduled checks plus a dashboard and notification history, rather than a one-off scan whose results disappear.
• Developers extending the check modules, who need Node.js v20+, local MongoDB and Redis instances, the Go toolchain for subfinder and subzy, and Playwright Chromium for custom flow checks.
• Anyone wanting a quick first look without deploying anything, using the free scan on the public landing page.

Getting started

Clone the repository, copy .env.dist to .env and fill in the secrets, then run docker compose up -d; Docker and docker-compose are the only prerequisites. Development mode instead uses yarn and yarn dev per package, with MongoDB and Redis supplied by docker-compose.dev.yml.

How it compares

No competing products are named in the facts provided for this entry, and no similar tools are named either, so StatusScout stands alone in this registry on the axis it does state: source-available code that is free to run on your own infrastructure. The licence restricts reselling it as a hosted service, and GitHub reports the licence field as NOASSERTION, so the terms are not an OSI-approved standard licence.

When to use it — and when not to

A self-hoster must operate Docker, MongoDB and Redis, and anyone working on the DNS or custom flow check modules also needs a Go toolchain with subfinder and subzy plus Playwright Chromium; those checks fail gracefully without them. It is a poor fit for anyone who needs an OSI-approved licence, or who intends to offer it as a hosted service, since the licence forbids resale on that basis. Adoption is modest — 15 stars, 2 forks and 3 open issues — so treat it as an early-stage project rather than a widely proven one.

packages/api/        # Fastify REST API server
packages/cron/       # Cron scheduler — triggers periodic checks
packages/frontend/   # React dashboard (post-login app)
packages/landing/    # Public marketing & scan page
packages/shared/     # Shared utilities (notifications, issue history)
packages/worker/     # Background worker — executes all checks
assets/              # Static assets (logo, wordlists)

docker compose -f docker-compose.dev.yml up -d

go install -v github.com/projectdiscovery/subfinder/v2/cmd/subfinder@latest

go install github.com/PentestPad/subzy@latest

npx playwright install chromium   # run after yarn install

yarn          # install all workspace dependencies
yarn dev      # start all packages in dev mode