Version and lifecycle
Which release is running, whether it still receives security fixes, and whether any published advisory matches it. A release past its end of life is an F, whatever else is right.
The method
How the scan works
The scanner connects directly to the address you enter and evaluates the responses itself. It checks information available without an account and uses its release and advisory data to assess the installed version.
What gets tested
Transport and headers
HTTPS reachability, the certificate and its remaining life, the TLS versions on offer, and the security headers a browser is actually sent - HSTS, CSP, frame and content-type protection.
Hardening and exposure
Basic authentication, public link password and expiry policy, password rules, directory listing, exposed endpoints and anything announcing the version to the world.
The pipeline
What happens when you press the button
Each scan goes through these four stages.
- Your address is checked. Private, loopback and cloud metadata addresses are refused before anything connects.
- The scan receives a random identifier. This identifier grants access to the result. There is no public list of scans.
- The scan joins the queue. A fixed number of scans can run at once. When all workers are busy, your scan waits and the page shows its position in the queue.
- The result expires. After 60 minutes, it can no longer be retrieved using its identifier.
Questions
Frequently asked
Is this official OpenCloud software?
No. This is an independent community project, not affiliated with OpenCloud GmbH and neither recommended nor supported by that company. "OpenCloud" and its logo are trademarks of their respective owners, used here solely to name the software this tool checks.
Does a good grade mean an instance is secure?
No. The scan checks the reported version, matching advisories and settings visible from outside, with a limited test of the published demo credentials. It does not assess private files, the operating system, backups or account permissions. The report supports your security work; it does not replace an audit or penetration test.
How long do you keep a scan's result?
In memory only, for 60 minutes, and then it is gone. No accounts, no analytics, no trackers - see what this server keeps for the rest.
Is there a rate limit?
Yes, per visitor and per scanned target, so one busy visitor cannot crowd out another and the same instance is not scanned back to back. The exact numbers for this deployment are on the API page.
Can I scan without a rate limit?
Yes - the scanner is open source. Run it yourself with one Docker command on your own machine, with no limit and no third party in the middle.
Does a scan tell me about a pending OpenCloud update?
Yes. The reported version is assessed against the available release data, including its support status and release track. See the update check for how the recommendation is calculated.