Your attack surface is bigger than your codebase

Teams pour enormous effort into secure code — and then get compromised through something that never appears in a pull request. The certificate that quietly expired. The staging subdomain nobody decommissioned. The email domain with no DMARC record, wide open for spoofing.

That's your external attack surface: everything about you that's visible from the internet, whether or not it's in your repo.

What we look at (safely)

Our Attack Surface module runs non-intrusive checks only — the kind of passive reconnaissance an attacker does before they ever send a packet at your app. You give it a domain you're authorized to assess, and it looks at:

• DNS and resolvable subdomains, to map what's actually exposed.
• TLS/SSL — expiry, protocol versions, certificate validity.
• HTTP security headers and any version numbers you're leaking.
• Email security — SPF, DKIM and DMARC, because spoofing your domain is often easier than hacking it.
• A short, safe TCP connect check on a small set of well-known ports.

Nothing intrusive. No exploitation. Just a clear picture of what a stranger can learn about you in five minutes.

Then it does the same thing it does for code

Every external finding goes through the same AI pipeline as your scanner findings: risk scoring, plain-language explanation, and a concrete remediation. A "missing DMARC record" stops being a checkbox and becomes "here's why this lets someone impersonate your finance team, and here's the exact DNS record to add."

Secure code is necessary. It has never been sufficient. The internet sees more of you than your repo does.