Weekly security re-check for every vendor site in your sheet

On a cron trigger, every Monday at 6am, re-check every vendor and partner website on my watchlist and write the results back into the same spreadsheet.

Start by reading the watchlist with Google Sheets Get Values against the vendor watchlist tab. Each row holds a vendor name and their website URL. Skip any row where the URL is blank or malformed, meaning it has no usable scheme or host, and count it as skipped rather than letting it break the run.

Before submitting anything, call urlscan Get Quotas to see how many private scans the account has left in the current minute, hour and day windows, and use that to decide how many rows can safely be processed in this run.

For each remaining row, submit the URL with urlscan Submit URL Scan using visibility set to private. Vendor portal URLs can contain identifying paths and a public submission would publish them, so private is required here and must not be switched to public or unlisted. Submit URL Scan returns a uuid immediately and the scan itself runs for roughly 10 to 30 seconds.

Wait for the scan to finish, then read it with urlscan Get Scan Result using that uuid. A 404 from Get Scan Result means the scan is not ready yet, so keep waiting and retry instead of treating it as a failure. A 410 means the scan was deleted, so treat that row as failed. Give each scan a sensible ceiling of about two minutes before marking it failed. From a successful result, pull the overall verdict, the malicious score, and the scan permalink.

Write the results straight back into the same row using Google Sheets Batch Update Values, filling a verdict column, a score column, a last checked date column, and a link column, so the sheet always shows the current state of every vendor. Batch the writes into a single request rather than updating one cell at a time.

Because this walks a whole list in one go, pace the submissions so the run does not blow through the scan quota. urlscan tracks quotas per minute, per hour and per day, separately per action type, and only successful requests count against them. Space the submissions out, and if a request comes back 429, back off for the number of seconds given in the X-Rate-Limit-Reset-After header before continuing. If the quota is exhausted, stop submitting and record how many rows were left unchecked.

Finish by posting one summary to our operations channel with Slack Send a Message. Include how many sites were checked, how many came back clean, an explicit list of any vendor whose site is now flagged with its score and permalink, any vendor whose scan failed outright, how many rows were skipped for a blank or malformed URL, and how many rows were left unchecked because the scan limit was reached.