Expose hidden vulnerabilitieswithin your infrastructure
Unauthenticated surface first, then everything behind the login. One pass over every asset you own, ranked by what an attacker reaches first.
Ranked by what an attacker reaches first.
Severity here is reachability times impact, not a score copied out of a feed. A critical flaw behind a path nothing can reach is not critical.
| ID | Finding | Severity | Asset | Age |
|---|---|---|---|---|
| RL-4471 | Unauthenticated admin console reachable from the public interface | Critical | edge-gw-03 | 2h |
| RL-4470 | Service account token committed to a build artefact | Critical | ci/runner-images | 5h |
| RL-4462 | Session cookie issued without Secure on a redirect path | High | auth.internal | 1d |
| RL-4458 | Dependency with a known deserialisation flaw, reachable in a request path | High | orders-api | 2d |
| RL-4433 | CORS policy reflects arbitrary origins for credentialed requests | Medium | reports-api | 6d |
| RL-4419 | Verbose stack traces returned on 500 responses | Medium | checkout-web | 9d |
Map, probe, rank — in that order.
The inventory comes first because the finding nobody expects is usually an asset nobody remembers. Then the same pass twice: once without credentials, once with.
Map
Every domain, subdomain, port, and certificate you own — including the ones nobody remembers provisioning. The inventory is the finding you get for free.
Probe
Unauthenticated surface first, in the order an attacker would try it. Then the same pass with credentials, so the two reports can be compared.
Rank
Severity is reachability times impact, not a CVE score copied out of a feed. A critical flaw behind an unreachable path is not critical here.
External surface
- Subdomain and port discovery
- TLS configuration and expiry
- Exposed admin and debug paths
- Default credentials
Application
- Injection and template evaluation
- Authentication and session handling
- Access control between tenants
- File upload and deserialisation
Supply chain
- Dependency advisories, reachability-filtered
- Secrets in artefacts and images
- Container base image drift
- Build pipeline permissions
Cloud posture
- Public storage and snapshot exposure
- Over-broad IAM roles
- Network paths to data stores
- Logging and retention gaps
One pass over everything you own.
Continuous or on merge, authenticated or not, with output your issue tracker already understands.
- Authenticated scans
- Session, OAuth, or mTLS
- Schedule
- Continuous, or on merge
- Output
- SARIF · JSON · signed PDF
- Integrations
- Issue trackers, chat, SIEM
- Retention
- 13 months of scan history
- Isolation
- Per-tenant scanner pool
Start with the unauthenticated surface. It is what the internet sees.
- Last run
- 2 Sep 2026, 04:20 UTC
- Duration
- 6m 12s