Read the public surface.
Check transport, response headers, cookie settings and visible technology signals with bounded requests.
Attackers can automate.
Your response should too.
Paste your URL. See what is exposed.
Leave with a fix plan.
··
Passive checks · Up to 6 page requests · No login or exploit attempts
Scan websites you own or have permission to assess.
READING THE PUBLIC SURFACE
Queuing your scan…
Public surface assessment
THE OBSERVED PUBLIC SURFACE
A CONCRETE NEXT MOVE
Give your agent a useful brief.
Observed evidence, scoped fixes and the checks needed after deployment.
CLOSE THE LOOP
Deploy. Then check again.
Compare new observations with this report. Unknown or missing findings stay unresolved.
Runs a new passive scan of the same target.
A fresh scan gives you a comparison grounded in new responses.
See the signals.
Keep the uncertainty.
A public URL reveals part of your security posture.
We show what the response supports, and what needs deeper access.
A fix, with its reason.
Inspect the response evidence. Take a focused fix prompt to your developer or coding agent.
Check what changed.
Run a fresh scan after deployment. A missing response or hidden runtime never counts as a fix.
No authentication, exploit payloads, port scans or claims of complete security.
THE SECURITY BRIEFPublic signals.
CURATED SNAPSHOTPublic signals.
Advisory context.
22 OCTOBER 2026
A CDN or hidden runtime can prevent a reliable CVE match. A disclosed version is a signal to verify, not proof of exploitability. Source-code audits require repository access; the Cloudflare audit skill informs methodology only.