The Nobody Is Clean Challenge
Nobody is clean.
Scan your domain. If we report it clean and you can show us something we missed, you get EchelonGraph free.
Entries open 20 August 2026 and run for 60 days, closing 19 October 2026.
Checking whether entries are open…
Why we are doing this
Every scanner vendor says they find more. It is an unfalsifiable claim, and the industry is full of it. This is the version with a cost attached: if our scanner tells you your domain is clean and it is wrong, that mistake is worth something to you.
We are not betting that our scanner is perfect. We are betting that it is honest about what it checked — which is why a scan that could not complete a check does not report that check as clean, and cannot be claimed against as though it did.
How it works
A silent, step-by-step walkthrough — no audio needed. It scans our own site, and the report’s grade, scores and findings are removed from the recording.
- Scan your domain. Free, no account, and repeatable — start here.
- If it comes back clean, open a claim against that scan, within 30 days of it completing.
- Prove you control the domain — a DNS TXT record, a file on the site, or an HTTP response header. Whichever you prefer.
- Show us what we missed. A person reads every claim that gets this far and writes a reason either way. Dispute the reason and an independent adjudicator — outside EchelonGraph — decides it. Their name is available on request from [email protected], and you can ask before you decide whether to dispute.
What you get
EchelonGraph free for the tenant you nominate — the tiers and features generally available on 20 August 2026, at the capacity limits published for those tiers on that date.
The grant runs to the legal entity that proved control of the scanned domain, and covers only that entity’s estate — not parents, subsidiaries, affiliates, other domains you did not scan, other brands, or anything you acquire afterwards. It is non-transferable and does not survive a change of control.
Eligibility
- The domain resolves publicly, serves HTTPS, and returns a real application — not a parked page, a registrar holding page or a bare redirect.
- It is your organisation’s primary domain, not a throwaway subdomain.
- You prove control of it, by any of the three methods we accept.
- The scan completed every check it reports on. A check that errored or timed out is reported as not assessed, and a scan carrying one is not claimable as clean.
- One grant per domain. Where two people claim the same domain, the first verified ownership proof takes precedence.
What counts as a miss
You win by showing us a genuine security exposure on the domain we called clean — one we did not report — in a check our scan actually completed. So it is worth being precise about what qualifies, because this is the only basis on which we will ever decline a claim:
- It qualifies if it is a real security weakness on the scanned entity’s own estate, of a kind our scan is meant to catch, that we did not already report, in a check the scan completed in full.
- A check the site refused, in whole or in part, does not count. The report names every such check and states how much of it ran — a check reported as not assessed was never claimed clean, so it cannot be a miss.
- Informational notes and best-practice suggestions that are not themselves a security exposure do not count, nor does anything we already flagged in that same scan.
- Findings outside the scanned entity’s estate, or reachable only by authenticating, exploiting, or otherwise going beyond what a public unauthenticated scan does, are out of scope — we tell you up front we do not authenticate and do not exploit.
These criteria are fixed for the window and published here before you enter, precisely so that a decision either way can be checked against a rule rather than a mood.
What we reserve, and what we do not
We do not reserve a right to withdraw a grant once it is made. An offer hedged that broadly is not a bet, and we would rather publish one that means something.
What we do reserve is narrower, and it is the whole of it:
- The grant covers the tiers and features generally available and documented on the start date, at the capacity limits published then. Products, add-ons, separately priced modules and roadmap features not yet generally available are not included — the tier appendix is the record of what those were.
- The entry window is 60 days — 20 August 2026 to 19 October 2026 — and we never bring the closing date forward. The only direction it can move is later: if a scanner pause materially eats into the window, we extend it so no entrant is worse off.
- Entry acceptance pauses automatically if our own scanner stops discriminating — the banner above says so when it happens. This is a safety stop, not an early close: it stops a broken scanner minting clean verdicts, the closing date does not move earlier, and claims from scans that ran while the canary was healthy stand on their stored record. A super-admin can trigger the same safety stop during an incident; it pauses acceptance, it does not end the challenge.
- A genuinely independent entity, with its own security organisation and infrastructure, may be granted a separate attempt at our discretion.
If no entry qualifies before the window closes, no grant is made and the challenge simply ends on 19 October 2026 — there is no held-over prize and no rollover. And if EchelonGraph ever ceases to operate the product, no plan continues — that applies to paying customers and challenge winners alike, and we would rather state it than let it be discovered.
Questions
What do I get if I win?
EchelonGraph free for the tenant you nominate, covering the tiers and features generally available on 20 August 2026, at the capacity limits published for those tiers on that date. The exact tier and feature matrix is published as the tier appendix at /challenge/appendix when entries open. Products, add-ons and separately priced modules built after that date are not included.
Who does the grant cover?
The legal entity that proved control of the scanned domain, and only that entity's estate. It does not extend to parent companies, subsidiaries, affiliates or sister companies however wholly owned, to other domains you own that were not scanned, to other brands or trading names, or to entities acquired after the grant is made. The grant is also non-transferable and does not survive an acquisition or change of control.
How many times can I enter?
One grant per domain. The domain must be your organisation's primary domain, resolve publicly, serve HTTPS and return a real application — a parked page, registrar holding page or bare redirect is not an eligible target. Where the first verified ownership proof arrives first, that claim takes precedence.
How long do I have to claim after a scan?
30 days from the completion of the scan you are claiming against. Scans are free and instantly repeatable, so if you miss the window you can run a new scan and claim against that one instead.
Can you withdraw a grant after you have made it?
No. We do not reserve a general right to withdraw a grant already made. What we reserve is narrower and stated plainly: the grant covers what existed on the start date rather than everything we build later. The entry window itself is fixed — it opens 20 August 2026 and closes 19 October 2026, a full 60 days — and we do not close it early.
How long does the challenge run, and can you end it early?
60 days: entries open 20 August 2026 and close 19 October 2026. We never bring that closing date forward. The only direction it can move is later — if our scanner has to pause during the window (see below) and that pause is long enough to materially eat into the 60 days, we extend the closing date so no entrant is worse off.
What happens if nobody qualifies?
Then no grant is made and the challenge simply closes on 19 October 2026 having made its point. There is no held-over prize and no rollover — the offer is that if we call your domain clean and you show us we were wrong, you win; if nobody does, nobody was owed anything.
What happens if your scanner breaks during the challenge?
Entry acceptance pauses automatically — the closing date never does. A scanner that reported everything clean because it was broken would turn every scan into a payout claim, so we stop taking new entries if our own canary stops discriminating, and this page says so rather than looking like an outage. Scans are free and instantly repeatable, so a brief pause costs you nothing — you re-scan once it clears, with time before 19 October 2026. The close date is only ever moved later: if a pause is long enough to materially reduce the window, we extend it. Claims made against scans that ran while the canary was verified healthy are honoured on the stored record of that scan.
Who decides whether I have won?
A person, every time, with a written reason — nothing is auto-rejected. Claims are adjudicated against a durable, content-hashed record of the scan as it stood, not against a re-run, so what you claimed on is what gets read. If you dispute our decision, the claim goes to a demonstrably independent adjudicator — someone outside EchelonGraph, competent to judge it — whose name we make available on request — email [email protected] and we will send it, before you decide whether to dispute.
What do you do with my scan data?
Scan and finding data are retained for 90 days on the free tier, which is what our privacy policy already commits to and three times the 30-day claim window. We need a contact email so we have a way to tell you the outcome.
Start with a scan.
It is free, it needs no account, and you can run it as many times as you like. If it comes back clean, the claim form is one click from the result.
Scan a domainThis page states the terms of the challenge. Where it describes what our scanner checks or how a claim is decided, those statements describe the system as built — see our privacy policy for how scan data is retained, and terms of service for everything else.