exposure_check

app.openkrill/site-check · Verify this server

Checks what a site or app you own leaks publicly. Use it when the user asks what an attacker could find on a domain, host or app they own, for example "is anything on my domain example.com exposed?", "does my app leak a .env file or API keys in its JavaScript?", "check my server app.example.com for leaked admin or debug pages" or "run a leak check on my own site". Pass the domain, host or app page address; a bare IP address is refused. The first call returns ownership_not_proven with the DNS TXT record or the file to publish. Once that is live it returns exposed or clean, the top three risks with a fix for each, and the evidence: subdomains from certificate transparency that point at a missing target, leaked files such as a git folder or .env (never their contents), API keys in the page's own scripts (type, place and a six-character prefix only), public source maps, admin paths by status, development servers, default install pages and the https redirect. Every answer carries an ownership note. It sends GET requests only, to a fixed list of paths and at most 30 per run, does not crawl, does not try to sign in and does not scan ports. Do not use it on a target the user does not own, to look up a person, user name or email address, or for private or local addresses.