Website exposure check

A website hands every visitor its page source and resolves through public DNS. Both carry more than the page you see. This check fetches the page once, the way any browser would, and reads two things out of it.

First, secrets: keys and tokens that were meant for a server but ended up in the HTML or an inline script. A Stripe secret key, an AWS key, a private key, a SendGrid or OpenAI token in client code is readable by anyone who views source, and it grants whatever the key grants. We report each one masked, so the finding is safe to share. If we find one, rotate it and move it server-side.

Second, shared ownership: the account ids a site exposes on purpose. An analytics property, a Stripe publishable key, a Sentry organisation, a SendGrid account, a founder’s handle or the domain registrant. On their own most are harmless. But when another site exposes the same specific id, that usually means the same owner is behind both. We match the ids this site exposes against the companies in our index and name the ones that share one, along with the founders we already hold for them.

It is read-only. One ordinary GET, no login attempt, no fuzzing, no enumeration. It never tries a private or internal address. A shared analytics tag or favicon on its own is not treated as a link, because an agency or a template can carry it across unrelated sites; it takes an account- or person-specific id, or two independent shared ids, to surface an owner.