Some cookies are necessary for SecondDoor to work. Others are optional, and tell us how the site and the product are used. Accept all, or decline all optional ones. Without a selection, nothing optional is set. More in our cookie policy.
Basic scanSoftware business · Marketing site/Scanned 8 Sept 2026, 19:32 UTC/1 browser pass
Lemlist publishes prices and allows browser access, but API keys require a sales conversation and there is no machine-readable specification for integration.
Older scan
This report was produced by an earlier version of the scanner. Some findings may not match how the site is measured now.
Ordered by what the evidence says is costing most. Written for whoever owns the site, not whoever builds it.
3 pieces of evidence and the recommended fix are recorded for this issue, with /.well-known/security.txt written from your own pages.
This is a basic scan, so it raises the three issues the deterministic evidence supports. A deep scan sends two agents over the site and raises up to ten, each with cited evidence and the screens to prove it.
A deep scan walks the site with two agents, records cited evidence and screenshots, and keeps a mission timeline. It comes with the paid plans. Making an account costs nothing and gives you one basic scan a month.
The score and the audit trail stay public. The evidence and the files open with an account.
The audit trail. Not measured is not zero.
Machine discoverability
No AI crawler is blocked by robots.txt or user agent rules. The site serves a real browser normally, publishes a sitemap with 1153 URLs, and renders key pages without JavaScript. Comparison pages are listed and readable.
4 observations recorded.
Programmatic onboarding
Authentication is documented in prose at developer.lemlist.com, and endpoint examples are shown. No OpenAPI spec exists at any standard path, no code samples are provided, and API key issuance is not self-serve.
2 observations recorded.
Pricing legibility
10 prices are readable without JavaScript on the pricing page, stated in USD per seat. No tier is gated behind a sales contact. The Enterprise plan is named but not priced, which is standard practice for custom deals and does not obscure.
1 observation recorded.
Agent-aware instrumentation
An MCP manifest is published at https://developer.lemlist.com/.well-known/mcp.json, enabling Claude and other MCP-aware agents to discover and call the API.
4 observations recorded.
Machine-fetchable trust
No security.txt file is published at /.well-known/security.txt. The homepage responds to automated requests with HTTP 200 and serves content normally. No Web Bot Auth signals are present.
2 observations recorded.
Commercial rails
Prices are published in raw HTML.
1 observation recorded.
Steps to first value
Could not verify: this scan did not reach the pages that would show it.
Required fields
Could not verify: this scan did not reach the pages that would show it.
Verification walls
Could not verify: this scan did not reach the pages that would show it.
Error recovery
Could not verify: this scan did not reach the pages that would show it.
It got through 8 of 14.
The agent got through 8 of 14 requests, but could not read the site's own guide for language models. It came up empty on 5 other checks too.