SaaSalystBot

SaaSalystBot is the web scanner behind saasalyst.com. It performs business-readiness scanning of SaaS websites to produce SaaSalyst reports and anonymized benchmarks — checking things like security headers, structured data, accessibility, and compliance signals on publicly accessible pages.

Per scan, SaaSalystBot fetches the homepage (rendered in a browser), robots.txt, and up to three secondary pages (pattern-matched /pricing, /privacy, /terms), plus page subresources loaded during rendering. It never accesses login areas and never submits forms.

At most about one full page-load per site per rescan cycle, and rescan cycles are weeks apart. SaaSalystBot does not crawl link graphs — it only visits the small, fixed set of pages above.

Requests from SaaSalystBot carry this User-Agent:

Mozilla/5.0 (compatible; SaaSalystBot/1.0; +https://saasalyst.com/bot)

• Egress IP: 178.156.168.232
• Reverse DNS: bot.saasalyst.com (forward-confirmed)
• Web Bot Auth key directory: /.well-known/http-message-signatures-directory — our Ed25519 public key for HTTP Message Signatures (RFC 9421) verification.

Add this to your robots.txt and SaaSalystBot will not scan your site:

User-agent: saasalyst
Disallow: /

A site-wide Disallow: / under User-agent: saasalyst or User-agent: * is honored today. Support for the SaaSalystBot token and path-level/crawl-delay directives ships in the next crawler politeness update.

If your WAF or bot-management product challenges automated traffic, add SaaSalystBot to your bot allowlist so your SaaSalyst scans reflect what real visitors see.

Questions, abuse reports, or verification help: security@saasalyst.com.