Trust infrastructure for developers

Scan, score, audit, and secure the systems your software depends on.

ScortonJS is an open-source security and compliance framework for developers building modern applications and infrastructure. Run security checks, calculate CyberScores, inspect compliance requirements, generate evidence, and integrate security reviews directly into your development workflows.

Get Started View on GitHub

bash

pip install scortonjs

scorton score example.com

Understand your security posture in one command

Security assessments should not require stitching together ten different tools. ScortonJS gives developers a single interface for inspecting an application, domain, service, or infrastructure target.

bash

scorton audit example.com

ScortonJS can inspect

Structured findings for developers, security teams, auditors, and automated workflows.

DNS and subdomains
Open ports and services
SSL/TLS configuration
HTTP security headers
Cookies
URLs
Common vulnerabilities
Infrastructure configuration

Turn findings into a CyberScore

A list of vulnerabilities is useful. A measurable security posture is better. ScortonJS transforms security observations into a CyberScore that makes posture easier to understand, compare, monitor, and communicate.

bash

scorton score example.com

SCORTON SECURITY REVIEW

Target        example.com
CyberScore    82 / 100
Risk          Moderate

SSL/TLS       ✓
Headers       ✓
DNS           ✓
Cookies       !
Ports         !
Vulnerabilities ✓

Use the score to

Establish a security baseline

Compare environments

Detect regressions

Prioritize remediation

Generate evidence for reviews

Track improvement over time

Audit more than vulnerabilities

Modern software operates inside regulatory and operational constraints. ScortonJS combines technical security analysis with compliance-oriented checks.

bash

scorton compliance dora example.com

scorton compliance nis2 example.com

Security becomes something your software can evaluate continuously rather than something teams inspect only before an annual audit.

Frameworks

Start with built-in compliance modules and extend through the plugin architecture.

DORANIS2+ Your plugins

Use ScortonJS from the tools you already use

ScortonJS is designed as a multi-language framework. One trust layer. Multiple interfaces.

TypeScript / Node.js

javascript

import { ScortonClient } from '@scorton/cli';

const scorton = new ScortonClient({
  apiKey: process.env.SCORTON_API_KEY
});

const result = await scorton.scan('example.com');

Python

python

from scorton import ScortonClient

client = ScortonClient(
    api_base="https://api.scorton.tech",
    token="your-token"
)

result = client.call_api("dns_enum", "example.com")

CLI

bash

scorton scan ssl_scan https://example.com
scorton scan headers_check https://example.com
scorton score example.com
scorton audit example.com

Fast where it matters

ScortonJS uses different technologies for different jobs. Python makes the framework flexible. TypeScript makes it natural for modern developer workflows. Rust handles performance-sensitive security operations. You don't need to think about the underlying stack — you call Scorton.

ScortonJS
│
├── TypeScript / Node.js
│   └── Developer interface + CLI
│
├── Python
│   └── Orchestration + business logic
│
└── Rust
    ├── Security engine
    ├── Compliance engine
    └── High-performance execution

Build your own security workflows

Security requirements differ between organizations. ScortonJS is designed to be extended. Instead of creating another isolated security script, extend the same trust framework.

Your Application
      ↓
ScortonJS
      ↓
┌──────────────────────┐
│ Security Scanners    │
│ Compliance Checks    │
│ CyberScore           │
│ Custom Plugins       │
│ Evidence             │
└──────────────────────┘
      ↓
Decision / Report / API

Add your own

scannerscontrolscompliance requirementsrisk rulesinternal policiesreporting logicintegrations

Security that can become programmable

Today's ScortonJS helps developers inspect and score systems. The larger idea is simple: trust should be programmable. As applications evolve toward AI agents and autonomous workflows, developers will increasingly need infrastructure that can answer critical questions about every action.

Trust should be programmable.

What is acting?

What can it access?

What is it trying to do?

What evidence supports the action?

Does the action satisfy our controls?

Should it proceed?

Application / Agent
        ↓
ScortonJS
        ↓
Security + Policy + Evidence
        ↓
Trust Evaluation
        ↓
Approve / Escalate / Block

Build. Test. Scort. Run.

Open source by default

ScortonJS is MIT licensed and built in the open. Inspect it. Fork it. Extend it. Build with it. Help define how developers secure the next generation of software.

Star ScortonJS on GitHub

bash

git clone https://github.com/scorton/scortonjs.git

Start with one command

bash

pip install scortonjs

scorton audit example.com

Build software you can trust.

Quick Start Documentation GitHub