Public exposure

Public exposure checks 100 common paths plus up to 50 paths selected from detected technology packs. It is an independent, unscored section on domain reports. Security scores, grades, rankings, and badges are unchanged.

An explicit Check website or Check again action starts the background job. Reading exposure results or polling progress never starts exposure probes. A fresh security report does not prevent a missing exposure scan from starting. CAPTCHA and fresh-work limits still apply.

Jobs are dispatched once per minute and progress updates every five seconds on the page. Checks continue after you leave. Jobs have five minutes to execute; queued jobs expire after ten minutes. Active jobs and results under five minutes old are reused. Results are retained for 24 hours.

Understanding results

• Exposed: recognizable sensitive content was returned without authentication. Remove or restrict it, purge cached copies, and rotate exposed credentials.
• Review: a recognizable public interface or deployment artifact. Confirm that public access is intentional. A public admin login alone is not a vulnerability.
• Restricted: path-specific access denial. Authentication security was not tested.
• Not found: a missing response or confidently matched fallback page.
• Inconclusive: the response, challenge, interruption, or scan limit prevented a reliable conclusion.

An incomplete scan is not a clean result. The scanner compares responses with the homepage and random nonexistent paths to identify SPA fallbacks, soft 404s, and blanket authentication responses.

Only bounded unauthenticated GET/HEAD requests are made. There are no credential attempts, exploit payloads, state-changing routes, subdomain enumeration, or heapdump downloads. Archives are checked through headers only. Bodies, cookies, and credential values never appear in stored reports or logs.

API and SDK

POST /v1/website-scans returns the existing security report with an optional public_exposure job reference. It does not wait for exposure checks to finish.

GET /v1/domain/{domain}/public-exposure returns the latest PublicExposureReport, including queued/running progress. It requires an active workspace API key and any Suite or Lookups plan, and consumes one shared lookup unit. See Authorization. The website uses the sanitized read-only /api/domain/{domain}/public-exposure/ endpoint.

const scan = await requestguard.websiteScan("example.com");
if (scan.public_exposure) {
  const exposure = await requestguard.publicExposure("example.com");
  console.log(exposure.status, exposure.checked, exposure.selected);
}

Older reports remain valid. No backfill, ownership claim, monitoring subscription, or deep scan is created.