Something on your server just talked to SEB-Assessment/1.0. Here's exactly what it did.

What happened

SEB does lightweight, public-web research to find companies that plausibly have an AI/LLM product, as the first step toward offering a free security assessment. For each candidate, our process does exactly one thing to your server:

1. Fetch /robots.txt and check whether it disallows the path we're about to request. If it does, we stop — nothing further happens.
2. If allowed, issue a single GET request to your homepage, identifying ourselves with the SEB-Assessment/1.0 User-Agent shown above so it's unambiguous in your logs.
3. Parse the HTML we already received — entirely offline, no further requests — for publicly-observable signals: things like a reachable MCP endpoint, an agent-card.json or llms.txt file, a chat widget, or a public OpenAPI surface.

What did not happen

No login attempts. No fuzzing, no injected payloads, no probing of non-public paths. No account creation, no form submissions, no attempts to exceed rate limits. Nothing beyond the single homepage request described above — the same kind of request an ordinary search-engine crawler makes, and no more.

Active testing is a different, later, opt-in step

If this passive look turns into an outreach email, that email offers a free report based only on what's described above — and separately offers a paid engagement. Anything beyond passive observation (adversarial prompt testing, jailbreak attempts, MCP tool-poisoning probes, and so on) only ever runs against your systems after you've signed a written authorization naming the exact scope and testing window. See our engagement terms for what that authorization covers.

User-agent: SEB-Assessment
Disallow: /

How SEB scores its own website, in public

The home page can show a line such as SELF-SCAN yyyy-mm-dd · NN/100 · CSP ✓ HSTS ✓ · BUILD abc1234. It comes from the same kind of passive request described above, aimed at this website: one request for the home page, one for /.well-known/security.txt, one for the http:// address (to see where it redirects) and one TLS handshake. Nothing is logged in to and nothing is sent that a browser would not send. The home page is requested the way a browser requests a page, because the host adds its own analytics script (Cloudflare Web Analytics, described in the privacy policy) to pages served that way, and the check has to see what a visitor's browser is given. That script is third-party JavaScript, so the last check below scores zero for as long as it is on.

There are eleven measurements and 100 points. Each measurement is a real value from the live site (the TLS version actually negotiated, the HSTS lifetime actually sent, the origins the page actually references) and the points come from the fixed scale below, so you can repeat any check with curl -I or your browser's network tab and get the same result.

What the number is, and is not. It scores the public face of this website. It is not an audit of SEB's systems and says nothing about how an engagement would go. The weights are SEB's judgement of how much each control limits damage on a static site. They are published here so you can disagree with them; if they change, the rubric version (currently 2026-10) changes with them.

How it reaches the page. After a deploy, a script runs the eleven checks against the live site and writes selfscan.json, which lists every check with its measured value and points. The home page shows the line only when that file is under 30 days old, names this site, and its points add up to the score. Otherwise there is no line at all.