External Exposure Security
Public secrets, API keys, open paths, and misconfigurations. The engine finds them and ranks the findings.
AI assists with classifying and prioritizing findings.
ReconSec Security Assessment
demo-company.de
Attack surface
Recent findings
Tell us the website whose publicly reachable surface you want reviewed.
Confirm that you own or operate the site, or that you have the authority to request the security check.
Our analysis engine works through the agreed scope layer by layer. You then receive the first findings and their context by email.
Not just the visible page. Keys, source maps, admin paths, weak headers, and mail records can sit in public too.
Depending on scope, the engine looks for:
The engine fetches public source maps, bundles, and paths, then looks for keys, secrets, and other exposures. AI classifies: what it is, why it matters, what to do next.
Found by ReconSec
Public source map on demo-company.de
/static/js/main.8f2a.js.map Secrets and PII redacted
STRIPE_SECRET_KEY = sk_live_••••••••••••••••OPENAI_API_KEY = sk-••••••••••••••••••••AWS_ACCESS_KEY_ID = AKIA••••••••••••Name = M•••••• S••••••Email = m••••••@example.de Context
A public source map can expose build secrets and personal data with no login. That is the same path stolen credentials and keys take onto the open web.
Stop serving the map. Rotate the exposed keys. Ship bundles without sourcesContent.
Each finding should say what, where, why it matters, what priority, and what to do next.
Executive summary
61 / 100
Demo with no real customer data. Findings ordered by severity, surface, and next step.
Categories
Why it matters
Source maps can expose internal paths, comments, and secret-shaped strings from the build, with no login required.
Next step
Stop serving the map publicly and ship bundles without sourcesContent.
Why it matters
A publicly reachable specification shows endpoints and data models that were often not meant for anonymous users.
Next step
Put the docs behind authentication, or limit them to what is intentionally public.
The requested website or domain is recorded as part of the assessment request.
You must confirm that you own or operate the system, or that you are expressly authorized to request the security check.
ReconSec examines the external surface covered by the agreed assessment. The standard assessment is not designed to modify systems, interrupt services, or manipulate data.
Details are in Scan Scope, Security Testing Terms, and the privacy notice. Scan Scope · Security Testing Terms · Privacy
12,195
Confirmed data breaches in Verizon’s 2025 DBIR, from 22,052 incidents.
Source: Verizon DBIR 2025
$4.44M
Global average cost of a data breach, IBM 2025.
88%
Basic web application attacks that used stolen credentials.
Source: Verizon DBIR 2025
44%
Breaches where ransomware was present, up from 32%.
Source: Verizon DBIR 2025
30%
Breaches with third-party involvement, doubled from 15%.
Source: Verizon DBIR 2025
The public part you authorize: secrets and API keys, source maps, open paths and API docs, security headers, TLS, DNS, and mail. The frame is in the Scan Scope.
No. The standard check stays on the public surface. No DDoS, no intentional interruption, no destructive change. A deeper assessment can be agreed separately.
No. You must own or operate it, or be expressly authorized to request the check.
So we can attribute the request. The address must belong to the website’s domain, for example max@example.de for shop.example.de. Results go to that address.
We document the exposure, not the people. Personal details in findings are masked where possible.
Not as a permanent archive. Results only as long as delivery requires. Request and authorization records stay separate.
By email after we review the request. The public request is without charge.
Yes. Scope, window, and deliverables are then agreed separately.
Let the engine check which secrets, open paths, and misconfigurations are publicly reachable. You get a prioritized overview.