Support

Run it with Docker: clone the repository and run docker compose up, then open http://localhost:8080 and create the first account. Without Docker you need .NET 10 and a Postgres database; the README has the command. Database migrations are applied automatically when the app starts.

Ask an administrator of your organization to open the Users page and choose Reset passkey next to your name. You get a single-use link, valid for 24 hours, to set up a new passkey; doing so removes your old passkeys. If you are the only administrator, see the next question.

Whoever runs the server can create a recovery link from the command line. With Docker: docker compose exec app dotnet FullyQualified.Web.dll recover alice@example.com --url https://fq.example.com. Use your email address or your name. The link works once, for 24 hours, and replaces your old passkeys.

No. Accounts use passkeys, so there are no passwords to leak, reuse or reset. Add a passkey for each device you use, and keep at least two. Single sign-on through OpenID Connect is available if your organization runs an identity provider.

Administrators open the Users page, enter an email address (optional) and choose a role. A viewer reads results and reports, a member also adds and removes assets and starts scans, and an admin also manages people and alarms. The invitation is a single-use link that is valid for 7 days, and it is emailed when the server has an SMTP host configured.

Register FullyQualified as an application in your identity provider with the redirect URI https://your-host/auth/sso/signin-oidc, then set Sso:Authority, Sso:ClientId and Sso:ClientSecret on the server. Set Sso:AllowedDomains to the email domains that may sign in. People still need an invitation, unless you enable Sso:AutoProvision. The first account is always created with a passkey.

Open the Alarms page as an administrator. Paste a Slack incoming webhook or a generic webhook URL (for PagerDuty or Opsgenie), enter a Telegram bot token and chat ID, add email recipients, choose the lowest status that should raise an alarm, and press Send a test alarm. Email also needs an SMTP host on the server. Every delivery attempt, including failures, is listed on the Log page.

Check that alarms are enabled, that the minimum status is not higher than the problem, and that a channel is configured. A first result is only reported when it is worse than OK. Then open the Log page: it shows each check result and whether the alarm was delivered or failed, and why.

A tenant is one organization: its users, domains, results and alarm settings. Tenants cannot see each other's data. The first tenant ever created becomes the management tenant, and only its administrators can see all tenants, create new ones and help users in other tenants. A self-hosted installation for one company simply has one tenant.

That depends on your plan: bigger plans are checked more often. A plan without an interval of its own uses the server setting Scanning:IntervalHours, which is six hours by default, and the platform owner can set another interval for one tenant. A failed check is retried after fifteen minutes. The Organization page shows the interval that applies to you.

Members and admins press Check everything now on the dashboard. Every check of every asset is queued at once, whatever the interval, and the results appear within a minute on the Log page. How soon it can be used again depends on your plan, and the Organization page shows it. For a single asset, use Scan now on its page.

Admins open the Organization page and press Test settings. It checks your plan and limits, whether results are fresh, whether alarms are set up, and sends a test alarm through every channel; it also warns when there is only one administrator or when administrators have a single passkey. The platform owner gets checks of the server too: the secure connection, the database, the mail server, single sign-on and name resolution. Nothing is changed.

FullyQualified guesses how a certificate is renewed: certificates from ACME authorities, or with a very short lifetime, are almost always automated, the rest are marked manual. It is a hint to help you find certificates that need a person, not a fact about your setup.

A self-hosted installation can, as long as the server can reach them. The planned hosted version cannot reach private networks, so it only checks public endpoints. Run your own installation for internal systems.

It sends nothing to the project. To find certificates it asks the Certificate Transparency log search at crt.sh about your domain names, and it connects to the endpoints and DNS servers you tell it to check. Alarms go only to the channels you configure.

Adding another domain or endpoint, or inviting another person, is refused with a message that names the limit; open invitations count towards the user limit. Existing data keeps working. Ask the platform owner for a bigger plan, or remove something. The Organization page shows your plan and what you use.

As long as your plan says, for example one month on Free and twelve months on Starter. Older results, changes and alarm entries are removed automatically, except the newest result of every check, so an asset never goes blank. A plan or an agreement can keep everything. The Organization page shows your period.

An administrator opens the Organization page, types the exact name of the organization and confirms. Everything is removed at once: domains, results, history, alarms and all user accounts, and everyone is signed out. This cannot be undone. The management tenant of an installation cannot be deleted.

You type a public domain name on the website and the checker looks at its TLS certificate on port 443 and at public DNS records. Nothing is stored. Your address is only held in memory for up to an hour to limit how often one address can check. If you run FullyQualified yourself, the public checker is off unless you set PublicScan:Enabled.

Pull the new version and restart the container. Migrations are applied when the app starts, so back up the Postgres database first, as you would for any upgrade.