How to run a scan, verify a workshop lab, use the member tools, and understand what we map your findings to.
Comptrusence is free to start. You can generate a QR code without an account at all. Everything else lives behind a free login, because the tools cost real compute and, in the case of the Lab Checker, real AWS API calls.
Go to Sign up. No card required.
You land on the dashboard overview, with every member tool in the left sidebar.
Enter a URL in the Website Scanner, or verify a workshop lab in the Lab Checker. Results appear in minutes.
Our scans are passive, which means they behave like an ordinary visitor. Even so, only scan sites you own or are authorised to test. That is a condition of using the tools.
There are two tiers, and no paid plan is required for either right now.
| Access | What you get |
|---|---|
| Public | The QR code generator, and all of the marketing, workshop and documentation pages. |
| Free account | The full webinar library, the AWS Lab Checker, the Website Scanner, the Diagram Studio, and the breach, SSL/TLS and DNS tools. |
Your account is protected by a password that is never stored in plain text. All data is held in Australian data centres.
The scanner inspects a URL and reports findings mapped to the frameworks your auditor already asks about. It runs two profiles.
| Profile | What runs | Safe to run on any site? |
|---|---|---|
| Passive | Security headers, TLS, CORS, JWT, outdated client libraries, technology fingerprinting | Yes. Visitor-level requests only. |
| Design | SEO, screenshots at five device sizes, responsive layout, accessibility (WCAG 2.1 A/AA via axe-core) | Yes. |
Each finding carries a severity, the tool that found it, a category, the affected target, and a plain-English fix. Use the AI executive summary button to turn the whole report into three business-language risks and a prioritised fix list, which is the version to send to a board.
Active workers such as SQL injection and fuzzing exist in the engine but are disabled. They only ever run with explicit, verified authorisation, and never through the self-service tool.
Finished a workshop lab? The Lab Checker inspects your real AWS resources and stamps each step pass or fail, with a hint pointing back to the step you missed. It covers the six sessions in the Sydney AWS Workshops.
Choose the session you completed. The input fields change to match that lab.
For example, your bucket name, instance ID, role name, or API URL. Also choose the region you built in.
Each step is stamped PASS or FAIL. Failures include a hint telling you which step to revisit.
| Session | Lab | You provide |
|---|---|---|
| 1 | Host a static website on S3 | Bucket name |
| 2 | Launch an EC2 web server | Instance ID |
| 3 | Build a least-privilege IAM role | Role name |
| 4 | Deploy a serverless REST API | Function name, table name, API URL |
| 5 | Provision a production-shaped RDS database | DB instance identifier |
| 6 | Capstone: full-stack app with monitoring | Frontend URL, API URL, alarm name |
It runs with credentials limited to read actions only, Head, Get, Describe and List. It never creates, changes or deletes anything in your account. This is why the tool sits behind a login: it makes real AWS API calls on our account's behalf.
Cloud bills come from resources you forgot to delete. After you clean up, run the checker again. A red FAIL on step 1 is your proof of a tidy account.
If you built in your own AWS account rather than a shared workshop account, the checker cannot see inside it, so resource checks will report access denied. Checks that fetch a public URL, such as the website or API endpoint, still work from anywhere.
| Tool | Input | What it tells you |
|---|---|---|
| Breach Checker | Email address | Whether the address appears in known public breaches, and what data was exposed. |
| SSL / TLS Checker | Hostname | Certificate issuer and expiry, protocol versions, weak ciphers, missing HSTS, and an overall grade. |
| DNS and Email Security | Domain | SPF, DKIM, DMARC, MX and DNSSEC posture, which is how easily someone can spoof your email. |
| Diagram Studio | Plain English, or Mermaid | Describe a system and AI drafts the UML or Mermaid, rendered live. |
| QR Generator | Any link or text | A downloadable PNG. Runs entirely in your browser, nothing is uploaded. No login needed. |
We query breach datasets using a hashed prefix of the address, so the full address never leaves our infrastructure. Only check addresses you own or are authorised to check.
Raw findings are not much use to an auditor. Every finding we report is mapped to the frameworks Australian regulators and customers expect.
An automated scan is evidence, not certification. It does not replace an audit, a manual penetration test, or professional advice. Accessibility results are indicative and are not a legal conformance statement.
The portal is backed by a JSON API. A documented public API with tokens is on the roadmap. The shape below is what the portal itself uses.
# Start a passive scan POST /api/webscan { "url": "https://example.com.au", "profile": "passive", "consent": true } -> { "scan_id": "a1b2c3d4e5f6" } # Poll until state is done, then read the report GET /api/webscan/status/{scan_id} -> { "state": "running|done|error", "progress": { "done": 4, "total": 6, "current": "tls" }, "report": { ... } } # Lab checker GET /api/labs -> [ { "id": "s3-static-site", "session": 1, "inputs": [...], "checks": [...] } ] POST /api/check/{labId} { "region": "ap-southeast-2", "bucket": "my-workshop-site" } -> { "passed": 3, "total": 5, "results": [ { "pass": true, "detail": "...", "hint": "..." } ] }
Scheduled recurring scans, PDF report export, team accounts, and API tokens. If one of these is blocking you, tell us and we will prioritise it.
Check the URL is reachable from the public internet, including the scheme. A site behind a VPN, an IP allow-list, or a login page will not be visible to a passive scan.
Bucket names are exact and region specific. Confirm the spelling, and that you created it in the region you selected.
Automated tools produce false positives. Every finding includes the evidence we based it on, so you can judge it. If we got it wrong, tell us, because that feedback improves the engine.
Email admin@comptrusence.com or use the contact form.