Passive · Read-only · No exploitation
Your app has
security blind spots.
Talon runs five passive security checks against your domain and sends you the findings. No login, no setup, no exploitation.
How it works
No setup. No access required.
01
Submit your domain
Enter your domain and email. No credit card, no setup.
02
Five passive scanners run
Security headers, certificate transparency, GitHub credential scanning, indexed file exposure, and debug endpoint probing. All read-only. No login attempts, no fuzzing.
03
You get a report link
Findings are organised by severity with evidence excerpts. Your report is hosted at a PIN-protected URL and emailed to you directly.
Surface scan
Five passive check categories
| Check | What it finds |
|---|---|
| Security headers | HSTS, CSP, X-Frame-Options, Referrer-Policy, Permissions-Policy |
| Certificate transparency | Subdomain enumeration, wildcard certificate scope, expiry |
| GitHub credential scan | API keys, tokens, and secrets in public repositories |
| Indexed file exposure | Publicly indexed .env files, DB dumps, and config files |
| Debug endpoint probing | /.git/HEAD, /.env, /actuator/env, phpinfo, adminer, stack traces |
Need more? The deep scan adds active endpoint probing, JS bundle analysis, CORS checks, and optional static repo analysis. See deep scan →
Common findings
What founders typically find
AWS access key committed to a public GitHub repository
Stripe live key found in commit history
Spring Boot /actuator/env accessible without authentication
.git/config exposed (reveals private repository URL)
Content-Security-Policy header absent on all routes
Subdomain pointing to deprovisioned Heroku deployment
Surface scan (Free)
Five passive checks, automated
Security headers, certificate transparency, GitHub credentials, indexed file exposure, debug endpoints. Read-only. Delivered to your inbox automatically.
Get surface scan →Deep scan ($39 / $29 per month)
Active probing + static analysis
Auth endpoint testing, API exposure, JS bundle secrets, CORS misconfiguration, Firebase/Supabase rules. Optionally: private repo analysis with GitHub App authorisation.
Run deep scan →No setup · Free
Submit your domain.
Enter your domain and email. We run the surface scan and send you a PIN-protected report link. The whole thing is automated.
Get your free surface scan →Passive scans only. Read the FAQ →