I built an external attack surface scanner for developers. Here is what I keep finding.
Every domain I scan has something exposed that the owner does not know about.
Open ports that should be behind a firewall. API keys sitting in frontend JavaScript bundles. CNAMEs pointing to services that were cancelled months ago. Response headers announcing the exact framework and version running in production.
None of this requires a sophisticated attack. It is basic recon that takes minutes with the right tools. Attackers run this automatically at scale.
I kept doing this manually across projects and got tired of it so I built ThreatLocator to automate it. You put in a domain and get back exactly what an attacker would see in the first pass.
Still in waitlist phase but taking early users now. Would love feedback from anyone who has dealt with this kind of thing.
