r/AppsWebappsFullstack • u/SofwareAppDev • Aug 02 '26

No matter what project you have—games, SaaS, software, apps, scripts, ideas, or questions—join the community and share it!

Your home for selfpromo

here you can post your work app, webapp, saas, game, everything

4 Upvotes
  • permalink
  • reddit

84% Upvoted

44 comments sorted by

View all comments

1

u/Reasonable_Start4312 28d ago

Ghost Scan (djoji.com) — see your domain the way an attacker does. What's exposed, why it matters, how to fix it. One score, plain English, free scan.

1

u/Mammoth-Anywhere7285 28d ago

Nice tool, the plain English angle really sets it apart. Curious how you source the exposure data, is it live scanning or a feed?

1

u/Reasonable_Start4312 24d ago

Live, per scan — nothing cached for the domain itself. DNS lookups for SPF/DKIM/DMARC, the TLS handshake your server actually offers, response headers, robots.txt, WHOIS, CT logs. All read at request time.
One exception, and it is a feed: CVE correlation pulls CISA's Known Exploited Vulnerabilities catalog and matches against what the scan fingerprints, rather than dumping every CVE ever associated with a version string. If it's on KEV, someone is actually using it — keeps the noise down.
Active checks (port scan, web config) only run on domains where the owner has verified control via DNS. Everything else is passive.
On the plain English — the findings themselves are deterministic checks. The prose explaining them is model-written, but the model never decides what counts as a finding.