Transparency

Why am I being scanned?

You've probably seen one of our scanners in your logs: ADL-SafetyGradeBot or ContextScoreBot. Here's exactly what they are.

What they are

Either someone asked one of our free tools to look at a URL on your domain, or your domain is part of a small research panel we scan for aggregate industry statistics. In both cases the scanner made ordinary, unauthenticated web requests, the same kind any visitor's browser makes, to read your public response headers and the content you already serve. Safety Grade and the AI Crawler Check make a handful; ContextScore reads up to a few hundred pages of a help center or docs site, one at a time and at least 0.6 seconds apart. None of them logs in, tries exploits, or sends anything designed to alter or break your site. Safety Grade does request a handful of well-known paths (like .env or .git) to check whether they are publicly exposed. For those it records only that the path answered (its status, type and size), never its contents.

How they behave

• They identify themselves with a clear User-Agent linking to this page.
• ContextScoreBot honors robots.txt. Before it requests anything from a host, it reads that host's robots.txt: if it can't read it, or it disallows the page you submitted (or a page a redirect leads to), the scan stops there. It never requests a page your robots.txt disallows, even by following a redirect. The AI Crawler Check reads your robots.txt first and, only where it allows them, your llms.txt and sitemap.xml. The Safety Grade check reads only your already-public surface and isn't gated by robots.txt (a site can't robots.txt away an exposed secret), but it stays identifiable, rate-limited, and honors the opt-out below.
• While one visitor's scan of a site is running, another visitor is normally asked to come back later. A finished result is reused rather than re-scanning your site: for a day (for ContextScore, per help-center URL), or 15 minutes for an AI Crawler Check of a homepage (a check of any other page always runs fresh). Visitors normally have a daily scan limit, and the service has an overall daily cap.
• If a scan finds a secret exposed in your public code, we record its type, where it was found (the site's address, never a page path), a one-way fingerprint, and a masked preview showing at most the first and last 4 characters. Never the full value.
• Research-panel scans produce no public page about your site. The statistics we publish are built from a store that keeps only a one-way hash of the domain, not its name. The scanner itself keeps its own record of each scan (the site's address and what it found) to grade it.

Opt out

If you'd rather we didn't scan your domain, tell us here. It covers the exact host you enter (with or without www.); a subdomain such as help.example.com is separate, so send each one you want excluded. It takes effect as soon as you send it: we stop our research scans of it, take down its public result cards, and leave it out of any statistics we publish from then on. A card someone already loaded can stay in browser and network caches for up to 5 minutes, and its share image for up to a day. Someone can still run one of our free tools on it themselves. That result gets no public card. It goes to whoever asked, and for a day to anyone else who submits the same site; a private report link someone already has keeps working. To block those scans too, email hello@anchordatalabs.com from an address at that domain.

Prefer email? hello@anchordatalabs.com works too. You can also block the User-Agents above at your server or firewall; ContextScoreBot also honors a robots.txt block, the Safety Grade scanner doesn't (see above).

We take the traffic our scanners generate seriously. If something we did looked abusive, tell us; we want to know. These scanners are products of Anchor Data Labs.