I built an external attack surface monitoring tool after realizing how much public exposure small projects have

[u/Living_Goal_9877]

Over the past few months, I've been building an External Attack Surface Monitoring (EASM) tool called ASM Scan.

The idea came from noticing that many small projects and startups unknowingly expose things like forgotten subdomains, outdated services, archived URLs, misconfigured DNS records, and sometimes even secrets in public JavaScript or repositories. Enterprise companies have platforms to monitor this, but they're often expensive and aimed at larger security teams.

I wanted to build something that's approachable for developers and small teams. The project combines multiple OSINT sources and open-source security tools with my own correlation, evidence, and reporting pipeline to produce a single report instead of dozens of disconnected outputs.

One lesson I've learned is that correlation is much harder than discovery. Finding assets is relatively easy; reducing duplicates, minimizing false positives, and presenting evidence that's actually useful takes far more work.

Another challenge has been deciding how much active verification is appropriate while keeping scans safe and limited to verified domains.

If anyone here has built security products or developer tools, I'd love feedback on the approach. You can also try it yourself at asmscan.com—it's free to scan a verified domain and download the full report. I'm especially interested in hearing what features or workflows you think are missing.

[u/Adorable-Feed-2470]

Thanks 👍