https://talonwatch.com : I kept seeing founders discover their Stripe keys were public or their database was wide open, usually after the damage was done. Built a passive security scanner for vibe-coded apps so that's easier to catch early. Free surface scan, no account needed.

https://thetracejournal.com : A small iOS journal that pairs a song with each entry. Music is tied to memory in a way nothing else is, and I wanted a place to capture that.

The free scan is fully passive so it never touches your app directly. It checks public GitHub repos associated with your domain for leaked credentials, looks at your security headers, checks certificate transparency logs, and probes a handful of common debug endpoints like /.git/HEAD and /actuator/env.

The deep scan goes further: active endpoint probing, JS bundle analysis for secrets, CORS checks, Firebase and Supabase rule testing, and optional static analysis of a private repo via GitHub OAuth.

Comments URL: https://news.ycombinator.com/item?id=47309478

Points: 1

# Comments: 1