Monitor public Certificate Transparency (CT) logs to identify unauthorized or unexpected certificates issued for your domain.
Queries public CT logs (crt.sh, Google) for wildcards, unapproved Certificate Authorities (CAs), and suspicious recent issuances.
Canonical test payload dispatched during security surface audits.
Certificate issued by unrecognized CA without CAA authorizationWatch the probe engine test this signature in an isolated sandbox.
DNS CAA Record Enforcement
; No CAA record present
example.com. IN CAA 0 issue "letsencrypt.org" example.com. IN CAA 0 iodef "mailto:security@example.com"
Publish CAA records specifying exactly which Certificate Authorities are authorized to issue certificates for your domain.
Copy and paste into your editor to refactor this issue automatically.
Test your public domain specifically for Certificate Transparency & Rogue CA Scanner.
Checks commonly evaluated alongside Certificate Transparency & Rogue CA Scanner during surface discovery.
Verify anti-CSRF tokens, SameSite cookie policies, and origin validation on sensitive state-changing routes.
Detect sensitive tokens, passwords, or PII stored in unencrypted localStorage or sessionStorage.
Detect web cache poisoning, password reset link poisoning, and server-side routing hijack via spoofed Host headers.
Audit your site across all 41 vectors automatically on every deploy.