How ShakerScan is built, shipped and run.
What you can verify about the open-source engine and client, the self-hosted Enterprise gateway and the free posture check: how releases are signed and gated, where your data goes, and how to report a vulnerability.
Open-source engine images
The engine ships as multi-arch images (linux/amd64 and linux/arm64) on Docker Hub, each release recorded by git commit and sha256 digest in RELEASES.md.
- Release candidates must pass a Trivy gate on the final manifests: fixed high and critical vulnerabilities fail the release.
- The final multi-arch digests carry GitHub build attestations signed with Sigstore; stable releases are promoted by digest, without a rebuild.
- CodeQL runs on the repository; release receipts and the image lock are attached to each GitHub release.
SBOMs with a signed index
Every image ships SPDX 2.3 and CycloneDX 1.6 SBOMs per architecture. Coverage is explicitly partial, and an SBOM is a contents inventory, not a vulnerability scan.
- sbom-index.json is signed with a Sigstore attestation and verifiable with gh attestation verify against the release workflow.
- Checksums (sbom-SHA256SUMS) and coverage reports are attached to the release.
The shakerscan client
The command-line client and MCP server are published to PyPI with trusted publishing, so no long-lived upload token exists.
- Wheel and source-distribution SBOMs are published with a signed index.
- Installed with pipx install shakerscan or brew install andriyze/shakerscan/shakerscan.
Enterprise gateway image
The self-hosted Enterprise gateway is built from a version tag, start-tested, signed by digest with Sigstore keyless signing and shipped with an SPDX SBOM attestation.
- Publication fails before anything is pushed or signed if the image has a fixed high or critical vulnerability (Trivy).
- verify.sh in the delivery kit checks the gateway signature, its SBOM attestation and the build attestations of the engine images in one command; the installer runs it before deploying.
- Customers deploy by digest; the engine images are pulled by digest from the public release lock.
Self-hosted data stays on your host
Targets, credentials, findings and evidence live in the engine’s database and results directory on the customer’s host. The Enterprise gateway sends no telemetry and has no licence check-in.
- The Enterprise licence is a signed file verified offline against a key embedded in the gateway; renewal uses a usage summary the customer exports.
- Identities, sessions, token digests, audit records and sealed authenticator secrets stay in the gateway’s state volume on the same host.
- The only outbound fetches are listed under data handling below; none carries scan data.
The free posture check
The check at /check/ and shakerscan check send the target you type to pub.shakerscan.com, which returns facts about its DNS, email, HTTP and TLS configuration, without pass or fail judgments.
- Only public DNS names and global IP addresses are accepted; government and military targets are refused.
- Rate limits apply per source IP: 30 requests a minute, 25 uncached checks an hour and 100 a day, with results cached for ten minutes.
- A self-hosted instance runs the same check locally; instance checks are not sent to the public service.
Where your data goes
The engine and the Enterprise edition run on infrastructure you operate, so scan data stays there. These are the connections each part makes, for an egress allowlist.
Runs as a Docker stack on your machine, localhost-only on a fresh install; no telemetry or phone-home. Outbound traffic is the image pulls from Docker Hub, your scan targets, and what you turn on: an AI provider you configure (sent redacted content), public DNS-over-HTTPS fallback for public names, and optional threat-intelligence lookups.
Everything runs on one Linux host you operate. Outbound: Docker Hub and ghcr.io for image pulls; the public engine release catalog and installer on GitHub (api.github.com, raw.githubusercontent.com) at install time and when an administrator opens or requests an engine update; install.shakerscan.com on the manual install path; GitHub and the Sigstore services when cosign and gh verify signatures; Let’s Encrypt unless you bring a certificate; your identity provider; your scan targets.
The target you type, and a DKIM selector if you give one, go to pub.shakerscan.com. The check page sets no cookies and loads nothing from other sites.
In the open-source engine, credential secrets are encrypted at rest and new writes fail closed without a key; scan requests carry only opaque credential-profile ids. The Enterprise gateway stores passwords as Argon2id hashes and tokens as SHA-256 digests.
No certifications are claimed.
ShakerScan holds no SOC 2 report or other certification, and the Enterprise gateway has not had a third-party penetration test. What is on this page is what you can check yourself: signatures, SBOMs, build attestations and the source.
Found something? Tell us first.
Reports about the engine, the client, the Enterprise gateway, the free check or this site go to one address. The disclosure policy sets the research boundaries.
Email security@shakerscan.com with a description, the affected surface, reproduction steps, impact and any safe proof of concept.
Test ShakerScan-owned surfaces and accounts created for research only. Do not scan or access third-party targets or anyone else’s data; if you encounter it, stop and report it.
Reports are triaged on reproducibility, impact, exploitability and credential exposure. There is no paid bug bounty; public acknowledgement needs your consent.
Last updated: September 26, 2026
Legal, security and disclosure documents.