PhishGuard: public status page, retention and backup commitments
The things a customer's reviewer asks for before signing off. A probe runs the real scan path every ten minutes and publishes the result; a retention page states what is kept, for how long, and what happens when something goes wrong; restore drills are recorded in the repository.
- Public status page at /phishguard/status: current state, 90-day history, 24-hour uptime and median scan latency. Aggregate only; no organization data.
- Retention and backup commitments at /phishguard/retention: email content is never stored, the verdict cache lives 24 hours, audit and feedback rows 90 days, daily database backups with 7 retained, a 4-business-hour recovery objective and 24-hour incident notice.
- Restore drills: the service exports every organization table through its own credentials and verifies each export by content hash. Each drill is recorded under docs/security.
- Claude Code plugin 0.1.7: quoted email text can no longer forge a PhishGuard header in the second-opinion panel.
Live access by invitation
The demos stay the front door for everyone. Running a tool against your own domain, file or endpoint is now by invitation: an approved email address, verified with a link, unlocks the same pages live for 30 days. No account, no password.
- The owner approves addresses, or whole domains, and only those can request a link. An address that is not on the list is told so plainly and pointed at a way to ask.
- The list is checked again on every live request, not only at sign-in, so removing someone takes effect at once rather than when their cookie happens to expire. An empty list admits nobody.
- Verification proves control of the address; a signed cookie remembers it. Nothing is stored server-side.
- Each approved address has a daily budget, with a smaller one for the tools that spend a paid model.
- Two tools stay demo-only even for invited visitors: the GraphQL pentester and its AI analysis send attack-shaped traffic at whatever target they are given. Ask about running them on your own infrastructure instead.
- The domain now publishes a strict sender policy, so mail claiming to come from it is rejected unless the domain signed it. The verification link is the only mail the site sends.
- PhishGuard's public pages are open again. The console, admin page and vendor registry stay behind the operator sign-in.
PhishGuard: pentest fixes, extension 2.37.0, add-in 1.27.0
A focused review of PhishGuard, the one surface that runs live for everyone, found no script injection and no attacker-driven navigation. What it found was subtler: ways to make the scanner look at the wrong text, and ways to make the server work too hard. All fixed.
- A very long unbroken token in an email could freeze the Gmail tab or Outlook pane for minutes (a quadratic pattern in the masker). Input is now bounded before masking on every client and on the server, where a crafted request went from an estimated ten minutes of CPU to under a second.
- Gmail: a sender could hide a phishing body inside a signature block that Gmail shows the reader but the scanner stripped. Only quoted reply history is stripped now.
- Outlook on the web: two emails with the same sender and subject shared a cached verdict. The cache key now includes the body.
- Outlook on the web: the sender address could be read from the body instead of the header. Sender and subject now come only from the header region, and a missing address is said out loud instead of scanned as if fine.
- The verdict cache on the server did not key on the display name, so a benign result cached with the name blanked could be served to the reader who saw the real one. Fixed.
- The auto-scan toggle now also stops the inbox row scanner; with it off, nothing leaves the browser until you ask.
- Master admin now requires a second factor to act; a plain-comparison password path with no rate limit is gone; the admin page no longer keeps the password on disk.
- Cached verdicts are masked server-side before storage, not only at the AI boundary. Two internal routes that spent a model key for anyone now sit behind the operator sign-in.
- The endpoint agent's upload can no longer move another session's machine into yours.
The tools are now demonstrated rather than run
This site exists to show what I have built. Running a free scanning service for anonymous visitors is a different thing with a much larger attack surface, and it was never the point. So the tools now show real results captured from sample targets, and the server does no work on your behalf.
- PhishGuard is unchanged and still live. It has people using it through the Chrome extension and the Outlook add-in, and it is the surface that was built with authentication and rate limiting from the start.
- Every other tool endpoint is closed. The refusal happens in one place rather than in each handler, so a tool is shut by default and has to be named on a live list on purpose to be reachable.
- Demo results are genuine output, captured by running each tool against a public target such as example.com, on a stated date. Nothing is hand-written and nothing is adjusted to look better.
- Every demo names the target it was actually computed against and says your input was not scanned. A security tool that mislabels where its evidence came from is worse than one with no demo at all.
- Where a tool needs a paid model and there is no honest result to show, the page shows the interface and the scoring criteria and says live analysis is not enabled, rather than inventing a verdict.
- The downloadable endpoint agent still works, because it runs on your machine and is the genuinely useful thing to hand out.
- Each tool has a request-access link if you want it pointed at your own systems.
Two tools withdrawn after a security review
A review of every endpoint found several that were reachable without a credential and did more than they should. Rather than put a login in front of them, the ones that could not be made safe have been removed. A gate is something that can later fail open; a deleted route cannot.
- WorkSecure is withdrawn. Its API served and accepted changes to employee records without any credential, and its mail relay skipped its own authentication check when the secret was missing instead of refusing.
- Exec Threat Monitor is withdrawn. It ran batches of model calls for anonymous callers and read from a table the public key could write to.
- Security Monitor keeps scanning and reporting, but no longer runs commands on your machine from the browser. Verification and fix commands are now shown for you to copy and run yourself, which is also the only way the result means anything.
- The CIS benchmark page no longer executes checks on the server. It shows the command to run on the machine you are actually auditing.
- Agent download links now reject malformed parameters, closing a path where a crafted link on this domain could have carried someone else's command into the installer.
- The local-model endpoints now talk only to a model on your own machine, and the remaining scanners are unchanged.
New home: hodan.ai
The site now lives at hodan.ai. The old address keeps working and keeps serving the API, so nothing you have installed needs attention today.
- hodan.ai is the canonical address; www redirects to it
- cybersecrepo.vercel.app still serves the site and the API, and is not redirected — every extension and Outlook add-in already installed has that host built in, and a redirect would not carry their cross-origin checks
- Chrome extension 2.36.0 points at the new host for fresh scans, and keeps the old one reachable so an upgrade cannot interrupt scanning
- Outlook add-in 1.26.0 published with the new URLs; existing tenant installs keep working on the old ones until you re-deploy the manifest
PhishGuard security hardening — pentest rounds 1–3
Three rounds of adversarial testing against the PhishGuard API and its clients, and the fixes for everything they turned up. Admin access is now per-organization with optional TOTP, the verdict cache can no longer be poisoned across readers, and every dependency with a published advisory has been patched.
- Per-organization admin keys with optional TOTP, replacing the single shared admin password; tokens are compared in constant time and one-time codes cannot be replayed
- Verdict-cache poisoning fixed: reader flags now partition the cache, so one caller's context can no longer change the verdict another caller receives
- Rate limits on every public endpoint — per organization, per install and per IP — plus a per-organization daily AI budget so a single tenant cannot drain shared model spend
- Security headers across the site: X-Content-Type-Options, Referrer-Policy, Permissions-Policy, and a frame-ancestors policy that admits Office origins only on the add-in path
- Row-level security locked down in the database, unused columns holding personal data dropped, and a scheduled retention job that deletes stored scans on a fixed window
- Registry integrity guards and an organization change log, so a change to trusted-vendor data is attributable after the fact
- Patched Next.js, sharp and nanoid; the image optimizer is no longer an open fetch proxy
Vendor fraud detection — payment-change signals and a trusted vendor registry
PhishGuard now reasons about the thing invoice fraud actually depends on: a message that changes where money goes. Organizations can register the vendors they pay, and a request to change payment details from anywhere else is treated as a high signal on its own.
- A payment-instruction change is a HIGH signal that clean sender domains can no longer dampen — the classic 'our bank details have changed' email
- Per-organization vendor registry at /phishguard/vendors: register the domains you actually pay, and look-alikes of them convict instead of passing
- Reply-To divergence: a reply address on a different domain than the sender is now scored
- Known-name / new-domain signal — a contact you know writing from a domain you have never seen
- Escalating-pretext memory: a thread that ratchets up urgency across messages is scored on the pattern, not just the latest email
- Receiver authentication results (SPF, DKIM, DMARC as your own mail server evaluated them) feed the verdict
- Unverifiable-recruiter signal for fake-recruiter openers, and 'verified safe' now requires a sender the system actually knows
- Benign verdicts carry an explicit 'report this email as phishing' path, so a false negative is one click from feedback
PhishGuard Gate — a Claude Code plugin
The same detection engine, applied to what an AI coding agent reads and writes. PhishGuard Gate installs into Claude Code as a plugin and scans the content arriving through the agent's delivery channels before it is acted on.
- One-command install from the public plugin marketplace (hodanmillion/phishguard-plugin), currently 0.1.6
- Gmail quiet mode: anything email-shaped that you paste is scanned automatically after masking, and a panel appears only for a non-benign verdict
- Second opinion over the agent's own input and output, so a poisoned page or document is flagged where it enters
- Skill scan with per-project pins: a context or skill file that changes under you is surfaced instead of loaded silently
- Setup audit that reports which hooks are actually installed, and folded-TLD look-alike and pickle-model warnings
- Gate logs are redacted; releases are protected and licensed
Outlook add-in, and a self-diagnosing engine
PhishGuard now ships as a native Outlook add-in alongside the Chrome extension, and the engine keeps a running account of its own accuracy rather than waiting for someone to notice it drifting.
- Outlook add-in 1.25.0 with a task pane in Outlook on the web and desktop, installable from a manifest
- Versioned add-in asset paths (/outlook-addin/v/<version>/…) so Outlook's cache cannot serve a stale build after a release
- Self-diagnosis: a precision ledger, anomaly detection, a corpus self-test and per-install suppression of rules that keep misfiring
- Weekly triage report that reads as a pasteable worklist, and a scheduled self-test that stores its result
- Health and diagnostics endpoints for monitoring the deployment
- Console moved off the root and onto /phishguard/console; a deployment guide for IT lives at /phishguard/deploy
Privacy — more of the email never leaves the browser
Masking now happens before anything is sent, and it covers the fields that matter most in payment fraud. What reaches the server is a redacted shape of the email, not its contents.
- Account numbers, IBANs and in-text links are masked in the browser before the scan request is made
- No recipient identifiers in generated links, and the auth header is masked in transport logs
- The sender's display name is no longer sent to the AI model
- Signature lines no longer feed keyword rules, which was a steady source of false positives
- Unicode obfuscation handled through NFKC normalization, closing full-width and folded-TLD typosquat bypasses
- A trusted domain's own label paired with a credential slug now reads as impersonation rather than as itself
PhishGuard Extension v2 — Auto-scan & OAuth Consent Phishing Detector
The PhishGuard Chrome extension now auto-scans emails the moment they're opened — no manual click required. A new OAuth consent phishing detector identifies Microsoft OAuth URLs in email links and scores each requested permission scope. A silent background inbox scanner adds colored risk dots to inbox rows without opening any emails.
- Auto-scan: email is scanned automatically on open — 'Scan with PhishGuard' button removed in favour of instant passive scanning
- Background inbox scanner: adds red/amber/blue dots next to inbox rows for emails with risk score ≥ 30, using sender + subject only — no email opened
- OAuth consent phishing detector: identifies login.microsoftonline.com/*/oauth2/* consent URLs in email links and scores all requested scopes
- 12 critical scope rules: Mail.Read, Mail.Send, MailboxSettings.ReadWrite (inbox forwarding rules), Files.Read.All, Directory.ReadWrite.All, RoleManagement.ReadWrite.Directory, Policy.ReadWrite.All, and more
- Suspicious redirect_uri detection: flags non-Microsoft redirect domains in OAuth consent links as non-Microsoft domain
- 'Email links analysis in progress' scanning badge — reassures user that no browser tabs are opened for link checking
- Gemini → Claude migration: stored aiProvider='gemini' automatically rewritten to 'server' (Claude default) on popup open
- Auto-corrects server URL typo: 'cybersecepo.vercel.app' → 'hodan.ai' on popup open
PhishGuard Scan Engine — URL enrichment disabled, government domains whitelisted, AI cap refined
URL enrichment (following URL shortener redirects + fetching OneDrive/SharePoint/GDrive documents server-side) has been disabled after it caused Microsoft and Google sign-in pages to open in the user's browser. Government domains are now permanently whitelisted. The AI hallucination safety cap is now bypassed by concrete high/critical AI signals.
- URL enrichment disabled: server no longer follows redirect chains or fetches cloud documents — analysis is done on URLs as-is via domain checks, RDAP, CyberSense, and AI
- Government domains whitelisted in all skip lists: *.gc.ca, *.canada.ca, *.gouv.qc.ca — never flagged as newly registered or suspicious
- AI cap refinement: high/critical AI signals (display_name_impersonation, urgent_pressure, etc.) now bypass the 45-point AI safety cap — only AI medium/low signals are capped
- Evidence format: suspicious domain findings now include [domain] prefix for clearer identification in the badge
- Legacy 'gemini' and 'server' provider values normalized to server-side Claude at the scan route — old extension installs work without reconfiguration
Security Monitor Windows Agent — Unicode crash + silent exit fixes
The Windows Python agent was silently crashing with a UnicodeEncodeError when writing box-drawing characters (─, —) to Windows CMD stdout. The scan appeared to start (browser opened, init event received) but logged nothing and stayed at '0/~40 checks'. Three layered fixes make the agent reliable.
- PYTHONIOENCODING=utf-8 set in bat wrapper before python run — prevents Python from using CP1252/CP850 encoding for stdout
- _TeeOutput.write() now wraps stdout write in try/except — encoding failures no longer crash the scan; the SSE queue still receives all log events
- try/except around _do_scan(): any unhandled exception is now surfaced as a visible error message in the browser's scan log panel instead of silently dying in CMD
- _sse_delivered.wait(timeout=30): Python now stays alive until the browser receives the 'complete' SSE event — prevents premature Python exit killing the daemon HTTP server thread
- time.sleep(3) on Windows before scan starts: gives Edge/Chrome time to open and establish the SSE stream before the first log event is emitted
Subdomain Takeover Scanner
New tool at /subdomain-takeover. Scan 60+ common subdomains for dangling CNAME records pointing to unclaimed cloud services — with HTTP body fingerprint confirmation.
- Probes 60+ common subdomains (www, api, staging, dev, cdn, blog, admin, portal…) for CNAME records via DNS-over-HTTPS
- 28 service fingerprints: GitHub Pages, Heroku, Netlify, Vercel, Azure, Azure CDN, AWS S3, Shopify, Fastly, Tumblr, Ghost, Zendesk, HubSpot, Freshdesk, Surge.sh, Pantheon, WP Engine, Kinsta, and more
- HTTP body confirmation: fetches the subdomain and matches unclaimed service response strings
- Dangling CNAME detection: for unrecognised CNAME targets, checks if the target has a live A record — no A record = dangling pointer attackers could claim
- Three-tier results: Confirmed Vulnerable (HTTP-confirmed) / Likely Vulnerable (CNAME match) / Dangling CNAME
- Per-finding remediation: remove CNAME, claim the resource, or audit access logs if already exploited
Security Headers Analyzer
New tool at /headers-check. Fetch any site's HTTP response headers and get an A–F grade covering 10 security policies — with copy-ready recommended values for missing headers.
- Content-Security-Policy (25pts): parses directives, flags unsafe-inline, unsafe-eval, wildcard sources, missing object-src and base-uri
- HSTS (10pts): max-age threshold checks (30d / 180d / 1yr), includeSubDomains flag
- X-Frame-Options (5pts): clickjacking protection, flags deprecated ALLOW-FROM
- X-Content-Type-Options (5pts): enforces 'nosniff'
- Referrer-Policy (5pts): detects unsafe-url leakage, recommends strict-origin-when-cross-origin
- Permissions-Policy (5pts): camera/mic/geolocation restriction check
- COEP + COOP (5pts each): cross-origin isolation headers for Spectre mitigation
- Server header (5pts): version string disclosure detection
- X-XSS-Protection: deprecated header — flags insecure values, recommends disabling in favour of CSP
- Notable headers panel: x-powered-by, x-aspnet-version tagged as info leak
- Priority fixes section auto-generated with copy-ready header values
SSL/TLS Certificate Health Checker
New tool at /tls-check. Enter any domain for an instant A–F grade covering certificate expiry, TLS version, cipher suite strength, HSTS configuration, and CAA DNS records.
- Live TLS handshake performed server-side using Node.js tls.connect() — extracts cert validity, issuer, SANs, key size, fingerprint, serial number
- Protocol grading: TLS 1.3 (best), TLS 1.2 (acceptable), TLS 1.1/1.0 (deprecated — critical flag)
- Cipher suite analysis: flags weak ciphers below 128-bit; highlights AES-256/ChaCha20
- HSTS header check: max-age threshold (180d / 1yr), includeSubDomains, preload flag
- CAA record lookup via DNS-over-HTTPS — shows which CAs are authorised to issue certs, with example record if missing
- Expiry countdown bar: color-coded (green → yellow → orange → red as expiry approaches)
- Collapsible detail sections: Certificate, TLS Config, HSTS, CAA — with copy buttons on fingerprint/records
BEC Lookalike Domain Detector
New tool at /bec-scanner for MSSP triage. Enter any domain and instantly see which typosquatting lookalikes attackers have registered, with real-time DNS probing for active email capability.
- Generates 120+ variants: TLD swaps (.net/.org/.co/.io/.ai + 9 more), BEC keywords (login/secure/support/helpdesk/365/portal ± hyphen), typosquats (transpositions, missing chars, doubled chars), homoglyphs (0→o, 1→l, 3→e, etc.)
- Probes each variant for A records (live web server) and MX records (email capability) via DNS-over-HTTPS in parallel
- Risk tiers: CRITICAL (live + email), HIGH (live, no email), MEDIUM (registered, email only)
- MSSP action list auto-generated based on findings: mail gateway blocklist, registrar abuse reporting, defensive registration recommendations
- Collapsible panel showing unregistered high-value variants available to register defensively
Email Security Grader
New tool at /email-security. Enter any domain and get an instant A–F grade across SPF, DKIM, DMARC, BIMI, MTA-STS, and TLS-RPT. Built for MSSP client onboarding and domain audits.
- SPF analysis: parses mechanisms, detects +all (critical), missing -all, and excessive DNS lookups (RFC 7208 limit)
- DKIM: probes 20 common selectors simultaneously — google, selector1/2, default, mail, sendgrid, amazonses, zoho, and more
- DMARC: policy classification (none/quarantine/reject), pct enforcement %, rua aggregate report addresses
- BIMI: checks default._bimi — detects VMC (Verified Mark Certificate) presence for Gmail logo display
- MTA-STS + TLS-RPT: SMTP transport security enforcement and failure reporting
- All checks via DNS-over-HTTPS (Cloudflare) — browser never touches the target domain
- Priority remediation checklist auto-generated for any score below 75
Phishing Kit Fingerprinter — MSSP Tool
New tool at /phish-kit for detecting phishing infrastructure. Paste a suspicious URL and get a fingerprint verdict: Bluekit, Evilginx2/3, GoPhish, or Modlishka. Designed for MSSP triage workflows.
- Kit signatures: Bluekit (Telegram exfil, Express.js backend, session capture JS), Evilginx2/3 (AiTM lure path /o/{id}), GoPhish (?rid= tracking param), Modlishka (?pl= lure links)
- RDAP domain age check — newly registered domains flagged as high/critical risk
- DNS checks: SPF and DMARC presence via Cloudflare DoH
- Live threat feed lookup: URLhaus (malware URLs) + ThreatFox (IOC database)
- HTML/JS analysis: brand impersonation detection, Telegram Bot API references, credential capture JS patterns
- HTTP response header analysis: X-Powered-By, Server fingerprinting
- Scored 0–100 risk model with verdict: HIGH RISK / LIKELY PHISHING / SUSPICIOUS / CLEAN
- All URL probing happens server-side — browser never touches the suspicious URL
TapIn — iOS App Landing Page
TapIn is now listed as a tool on the platform. The /tapin route is an App Store landing page for the iOS app — proximity-based ephemeral chat within 300m.
- TapIn added to the tools grid on the homepage
- 300m GPS radius room discovery — only people physically nearby join
- Account required to use the app
- Server-backed messaging — messages are ephemeral and disappear when you leave
- Available on the App Store for iOS 16+
WorkSecure — Per-App Identity Segmentation for Employees & Contractors
New tool at /worksecure. Assign every worker a unique alias email per SaaS app — containing blast radius if any vendor is breached. Instant offboarding revokes all access in one click.
- Per-app alias assignment: each worker gets a unique email alias per SaaS platform — real identity never exposed to vendors
- If a vendor is breached, only that specific alias is exposed — not the worker's real email or access to other apps
- Browser isolation integration: route high-risk apps through Cloudflare, Zscaler, or Menlo cloud browser — no code executes on the worker's device
- On-prem email link rewriting: Postfix milter and Exchange transport rules rewrite http(s) links at delivery time so every click passes through your isolation proxy
- Instant offboarding: one click deactivates all aliases, logs the event, and generates an OAuth revocation checklist
- AI Offboarding Agent: describe the worker to the chat assistant — it handles the offboarding workflow end-to-end
- Full audit trail: every onboarding, alias assignment, and offboarding logged with timestamp
OAuth App Scanner — RAG breach KB + Entra ID tenant scan
New tool at /oauth-scanner for supply chain OAuth risk. Analyzes any authorized OAuth app using a three-layer engine: deterministic scope rules (primary, no AI), a Supabase RAG knowledge base of 18 known vendor breaches, and Claude as a fallback only when both layers return low confidence.
- 50+ scope risk rules covering Microsoft Graph, GitHub, Vercel, Slack, and Google Workspace
- RAG knowledge base: 18 vendor breach records with full-text search — no embeddings or LLM needed
- KB expanded with 6 new 2024–2025 incidents: Snowflake (165+ orgs, AT&T/Ticketmaster), Mintlify (GitHub token exposure), Polyfill.io (CDN supply chain, 100K+ sites), tj-actions/SpotBugs (GitHub Actions chain attack), Microsoft Storm-0558 (forged Azure AD tokens, US gov)
- Claude only fires when rule engine + KB are both low confidence — clearly labeled in UI
- Entra ID Tenant Scan: paste a Graph token → automatically scans ALL authorized OAuth apps in your tenant
- Entra scan runs entirely in the browser — token goes browser → graph.microsoft.com directly, never touches our server
- Supply Chain tab added to OAuth Consent Risk tool: Vercel/Context AI attack case study, per-platform audit guide, 60-min breach response playbook, 4 KQL detection queries
27 Linux CIS Checks
The security agent now runs 27 deterministic CIS checks on Linux machines — covering firewall, SSH, kernel parameters, auditd, mandatory access control (AppArmor/SELinux), file permissions, and more.
- UFW/iptables firewall status
- SSH PermitRootLogin, PasswordAuthentication, full sshd_config hardening
- Kernel parameters: ip_forward, ASLR, SYN cookies, redirect acceptance
- auditd and rsyslog/syslog running state
- PASS_MAX_DAYS ≤ 90, PASS_MIN_DAYS ≥ 1, empty password detection
- AppArmor and SELinux status
- /etc/passwd (644) and /etc/shadow (000) permissions
- LUKS disk encryption detection
- NTP/chrony/systemd-timesyncd time sync
- Login banner (/etc/issue.net)
AI Photo Detector
New tool at /ai-photo-detector. Upload any image to instantly detect whether it was generated by AI tools like Midjourney, DALL-E, Stable Diffusion, or Adobe Firefly — with detailed per-signal analysis.
- Accepts JPEG, PNG, and WebP images up to 20MB
- Detects AI generators: Midjourney, DALL-E, Stable Diffusion, Adobe Firefly, and generic AI synthesis
- Powered by Gemini Vision API — analyzes pixel-level artifacts, texture inconsistencies, and AI generation signatures
- 5 verdict levels: Likely AI-Generated / Possibly AI-Generated / Uncertain / Possibly Real / Likely Real
- Detailed signal breakdown shown per finding with confidence indicator
- Gemini does not store uploaded images — analysis is ephemeral
AI Video Detector
New tool at /video-ai-detector. Upload any video to detect AI-generated content from Sora, Runway, Kling, or deepfake tools — with frame-level artifact analysis and temporal coherence checks.
- Upload video files up to 100MB (MP4, MOV, WebM)
- Detects AI video generators: Sora, Runway, Kling, and deepfake face-swap tools
- Frame-level artifact analysis: temporal coherence, face-swap detection, synthetic motion patterns
- Powered by Gemini Vision API — multi-frame sampling with 8+ artifact checks
- Compression anomalies, edge artifacts, and unnatural motion flagged individually
- Video sent to Gemini only — not stored or indexed
Domain-grouped findings with filter pills
Security findings are now grouped into 9 security domains (OS & System, Encryption, Network & Firewall, SSH, Logging, Auth, File System, Privacy) with one-click domain filter pills.
- Filter by domain: show only SSH, Network, Auth findings at a time
- Section headers inserted between domain groups when browsing all
- Domain assignment via CIS ID prefix or category keyword matching
SSH hardening — copy-pasteable directives
The SSH check now generates a complete, copy-pasteable sshd_config hardening block instead of a vague 'add hardening directives' message.
- sudo tee -a block with all 8 recommended directives
- PermitRootLogin no, PasswordAuthentication no, X11Forwarding no, MaxAuthTries 3, PermitEmptyPasswords no, AllowTcpForwarding no, ClientAliveInterval 300, LoginGraceTime 60
- When an insecure directive is found: targeted sed -i fix command generated automatically
Audio Deepfake Detector
New tool at /audio-deepfake. Upload any audio file to detect AI-generated or cloned voices. Powered by Whisper transcription and GPT-4o acoustic analysis.
- Upload MP3, WAV, M4A, or OGG audio files up to 25MB
- Whisper API transcribes the audio — transcript analyzed for linguistic patterns and prosody irregularities
- GPT-4o acoustic analysis: prosody anomalies, unnatural pacing, compression artifacts, speaker consistency
- 6 indicators: prosody analysis, speaker consistency, linguistic patterns, compression artifacts, formant analysis, spectral features
- A–F risk grade with confidence score shown per indicator
- Designed for HR fraud detection, executive impersonation cases, and vishing investigation
Live Call Detector — Real-Time AI Voice Detection
New tool at /live-call-detector. Put your phone on speaker and detect AI-generated voices mid-call in real time — using acoustic heuristics with no data stored or sent externally.
- Real-time 5-second audio chunk analysis — risk indicator updates continuously as the call progresses
- 5 acoustic indicators: fundamental frequency variance, spectral flatness, MFCC patterns, harmonic distortion, temporal coherence
- Entirely client-side DSP — no audio leaves the browser, no external APIs called
- Works with any audio source: phone on speaker, video calls, or any microphone input
- Designed for detecting CEO fraud calls, tech support scams, and vishing attacks in real time
- Color-coded indicator: green (likely human) → yellow (uncertain) → red (likely AI voice)
NTP false positive on macOS 13+
systemsetup -getusingnetworktime requires admin on macOS Ventura and later. The agent now falls back to pgrep -x timed, correctly detecting whether the system time daemon is running without requiring elevated privileges.
- No more NTP false positives when Time Sync is enabled in System Settings
- pgrep -x timed used as fallback — binary result, no ambiguity
Re-analyze: copy command instead of download
The Re-Analyze button now copies the curl command to clipboard instead of downloading a .command file that macOS Gatekeeper blocks. The command panel is always visible.
- One click copies the curl | python3 command
- Command panel always shown inline (no hidden toggle)
App Scanner — Android APK, iOS IPA & Windows EXE/DLL Analysis
New tool at /apk-scanner. Deep static analysis for mobile and desktop binaries. Extracts metadata, maps permissions, detects CVEs, and generates an SBOM — all locally in the browser, no file upload to servers.
- Android APK: bytecode metadata, permissions, declared receivers, services, activities, and manifest security analysis
- iOS IPA: binary metadata, entitlements, embedded frameworks, and code signing analysis
- Windows PE (EXE/DLL): PE header, imported functions, entropy (packing detection), section analysis
- 32+ security rules across 9 analysis engines
- CVE lookup against live NVD and vendor threat intelligence feeds
- SBOM (Software Bill of Materials) generation for identified libraries and dependencies
- Dark web intel: file hash checked against threat intelligence feeds for known malware signatures
- All analysis runs locally in the browser — no file content is uploaded to a server
GraphQL Pentester — Automated API Security Testing
New tool at /graphql-pentest. Automated offensive security for GraphQL APIs — tests injection, auth bypass, IDOR, DoS, and business logic flaws with AI-powered attack generation.
- 16 automated attack tests covering SQL/NoSQL injection, auth bypass, IDOR, DoS, and SSRF
- AI-powered attack generation: Claude analyzes the schema and generates targeted attack queries
- GraphQL introspection: full schema extraction and type/resolver enumeration
- OWASP-mapped findings with CWE IDs for each vulnerability class
- 3 export formats: JSON report, HAR file, and markdown summary
- Authorization required — designed for use against endpoints you own or have written permission to test
- All requests go browser → target endpoint directly — no relay through our servers
Common Sense Cyber — Plain-English Security Guidance
New tool at /cyber-sense. Not sure if something is a scam? Find your situation and get a plain-English answer — designed for non-technical staff and SMBs.
- 8 scenario categories: recruiter scams, OTP fraud, phishing links, CEO fraud, fake tech support, package delivery scams, romance fraud, and investment scams
- Image upload: paste a suspicious screenshot and get an AI verdict via Gemini Vision
- Plain-English answers with zero security jargon — designed for employees with no technical background
- 40+ local detection rules run before any AI call — reduces API usage and improves speed
- PII scrubbing: raw images are never sent to Gemini — only sanitized OCR text is passed to the model
- Recommended actions and reporting contacts provided for each scenario
38 macOS CIS checks — deterministic agent
The security agent runs 38 deterministic CIS Level 1 & 2 checks on macOS covering all major security domains. Each check has a stable canonical fingerprint to prevent duplicate findings across re-scans.
- SIP, Gatekeeper, FileVault, firewall, SSH, screen lock, auto-login, guest account
- NTP, login banner, Safari, Bluetooth, AirDrop, Remote Desktop
- Immutable snapshots — re-scan diffs show new vs resolved findings
- Score ring with risk calculation
Stay up to date
New checks, features, and improvements ship weekly. Join the Pro waitlist to get release notes in your inbox.
Open Security Monitor