SaaSalystBot

SaaSalystBot is the web scanner behind saasalyst.com. It performs business-readiness scanning of SaaS websites to produce SaaSalyst reports and anonymized benchmarks — checking things like security headers, structured data, accessibility, and compliance signals on publicly accessible pages.

Per scan, SaaSalystBot fetches the homepage (rendered in a browser), robots.txt, and up to three secondary pages (pattern-matched /pricing, /privacy, /terms), plus page subresources loaded during rendering. It never accesses login areas and never submits forms.

At most about one full page-load per site per rescan cycle, and rescan cycles are weeks apart. SaaSalystBot does not crawl link graphs — it only visits the small, fixed set of pages above.

Direct fetches from SaaSalystBot carry this User-Agent:

Mozilla/5.0 (compatible; SaaSalystBot/1.0; +https://saasalyst.com/bot)

Browser-rendered fetches carry a truthful headless UA with the same bot token (the version segment matches the actual Chromium in use):

Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/<version> Safari/537.36 (compatible; SaaSalystBot/1.0; +https://saasalyst.com/bot)

• Egress IP: 178.156.168.232
• Reverse DNS: bot.saasalyst.com (forward-confirmed)
• Web Bot Auth key directory: /.well-known/http-message-signatures-directory — our Ed25519 public key for HTTP Message Signatures (RFC 9421) verification.
• Request signing: SaaSalystBot signs its requests (RFC 9421, tag web-bot-auth) with Signature, Signature-Input and Signature-Agent headers verifiable against the key directory above.

Add this to your robots.txt and SaaSalystBot will not scan your site:

User-agent: SaaSalystBot
Disallow: /

SaaSalystBot follows RFC 9309: the SaaSalystBot token (the legacy saasalyst token is also honored), path-level Disallow/Allow rules with * and $, and Crawl-delay between its fetches. A disallowed page is never fetched.

If your WAF or bot-management product challenges automated traffic, add SaaSalystBot to your bot allowlist so your SaaSalyst scans reflect what real visitors see.

Questions, abuse reports, or verification help: security@saasalyst.com.