# Weekly security re-check for every vendor site in your sheet

> Every Monday at 6am, every vendor and partner website on your watchlist gets re-scanned, with the verdict written straight back into the same row.

- Workflow type: code
- Services: urlscan.io, Google Sheets, Slack
- Categories: Operations
- Published: 2026-08-10

## What it does

- Reads your vendor watchlist tab and picks up the website address from every row
- Runs each site through a private security scan, so vendor portal links are never published anywhere public
- Writes the verdict, the risk score, the date it was checked, and a link to the full report back into the same row
- Posts one Slack summary covering how many sites were checked, how many came back clean, and every vendor that is now flagged or failed to scan

## What you'll need

- A Google account with access to your vendor watchlist spreadsheet
- A urlscan.io account for the website scanning (the free plan works, it just allows fewer scans per day)
- A Slack workspace and a channel for the weekly summary
- A watchlist tab with a vendor name column and a website address column, plus four spare columns for verdict, score, date checked, and report link

## Prompt

On a cron trigger, every Monday at 6am, re-check every vendor and partner website on my watchlist and write the results back into the same spreadsheet.

Start by reading the watchlist with Google Sheets Get Values against the vendor watchlist tab. Each row holds a vendor name and their website URL. Skip any row where the URL is blank or malformed, meaning it has no usable scheme or host, and count it as skipped rather than letting it break the run.

Before submitting anything, call urlscan Get Quotas to see how many private scans the account has left in the current minute, hour and day windows, and use that to decide how many rows can safely be processed in this run.

For each remaining row, submit the URL with urlscan Submit URL Scan using visibility set to private. Vendor portal URLs can contain identifying paths and a public submission would publish them, so private is required here and must not be switched to public or unlisted. Submit URL Scan returns a uuid immediately and the scan itself runs for roughly 10 to 30 seconds.

Wait for the scan to finish, then read it with urlscan Get Scan Result using that uuid. A 404 from Get Scan Result means the scan is not ready yet, so keep waiting and retry instead of treating it as a failure. A 410 means the scan was deleted, so treat that row as failed. Give each scan a sensible ceiling of about two minutes before marking it failed. From a successful result, pull the overall verdict, the malicious score, and the scan permalink.

Write the results straight back into the same row using Google Sheets Batch Update Values, filling a verdict column, a score column, a last checked date column, and a link column, so the sheet always shows the current state of every vendor. Batch the writes into a single request rather than updating one cell at a time.

Because this walks a whole list in one go, pace the submissions so the run does not blow through the scan quota. urlscan tracks quotas per minute, per hour and per day, separately per action type, and only successful requests count against them. Space the submissions out, and if a request comes back 429, back off for the number of seconds given in the X-Rate-Limit-Reset-After header before continuing. If the quota is exhausted, stop submitting and record how many rows were left unchecked.

Finish by posting one summary to our operations channel with Slack Send a Message. Include how many sites were checked, how many came back clean, an explicit list of any vendor whose site is now flagged with its score and permalink, any vendor whose scan failed outright, how many rows were skipped for a blank or malformed URL, and how many rows were left unchecked because the scan limit was reached.

## How to customize

- Change the schedule, for example daily for a short list or the first of the month for a long one
- Point the summary at a different channel, or send it as a direct message instead
- Adjust what counts as flagged, so only sites above a risk score you choose get called out
- Cap how many vendors get checked in a single run if you want to spread a long list across the week

## Example output

Vendor site check, Monday 9 Feb

Checked: 42 of 47 sites
Clean: 39

Flagged (2):
  Northwind Supply, northwindsupply.com, score 78, view report
  Acme Billing Portal, billing.acme-corp.com, score 65, view report

Failed to scan (1):
  Redline Logistics, redlinelogistics.io, scan did not finish in time

Skipped, no valid website address (3)
Not checked, scan limit reached (2)

## FAQ

### Will my vendors know I scanned their site?

Every scan is submitted privately, so the result is visible only to your account. This matters because vendor and partner portal addresses often contain identifying paths, and a public scan would publish that address where anyone can search it. The workflow never submits a site publicly.

### What happens if I have more vendors than my plan allows me to scan?

The workflow checks how much scanning allowance is left before it starts, then paces itself as it works down the list. If it does run out partway through, it stops cleanly and tells you in the Slack summary exactly how many rows were left unchecked, so you know what to pick up next time.

### What if a row has a blank or misspelled website address?

That row gets skipped rather than breaking the run, and it is counted in the summary as skipped. The rest of the list still gets checked, so one bad cell never costs you the whole week's report.

### Does this work on the free urlscan.io plan?

Yes. The free plan allows fewer scans per day, so a long watchlist may take more than one run to get through. The summary always tells you how many rows were left over, and you can lower the schedule to daily so the list turns over faster.

### Do I need a new spreadsheet, or can I use the one I already have?

Use the one you already have. It just needs a tab with a vendor name column and a website address column, plus four empty columns for the results. Everything gets written back into the same row as the vendor, so the sheet stays readable as a single current view.

Use this prompt in General Input: https://www.generalinput.com/prompts/weekly-security-re-check-for-every-vendor-site-in-your-sheet