The Decloak Journal
Security news &
platform updates.
Stories from around the web security world, plus release notes and changes to Decloak itself.
Compliance Mapping Now Covers NIST CSF 2.0 and the EU Cyber Resilience Act
Decloak now maps every finding to eight frameworks, adding NIST CSF 2.0 and the EU Cyber Resilience Act. NIST is mapped at the subcategory level questionnaires actually cite, and the CRA to Annex I of the regulation. Here's how it works, and what a web scan can and can't evidence.
Compliance Mapping Explained: Turning Security Findings Into Audit Evidence
Auditors don't ask for a list of bugs. They ask which controls you meet and how you know. Compliance mapping links each security finding to the framework requirement it relates to. This guide covers why it matters, who uses it and how Decloak does it.
Uncloaked: AI Code Security Has Barely Moved in a Year, and Veracode Has the Numbers
Veracode tracked more than 100 AI models and found the average security pass rate is 56%, up one point from 55%. Models write code that compiles almost every time. They still fail on security in nearly half of tasks. Here is what the report found, what it doesn't prove, and what to do about it.
AI Pentesting Now Confirms SSRF, XXE and Command Injection, and Tests Far More of Your Site
AI Pentesting now confirms seven tool-backed checks, including SSRF, XXE and OS command injection. It tests every parameterised URL and API call a scan observes, works on modern single-page apps, and confirmed exploits now count towards your overall Security Score.
AI Pentesting Explained: What It Is, Who It's For and What Decloak Offers
Scanners tell you what looks wrong. Penetration tests prove what is exploitable. This guide explains what AI pentesting is, who actually needs it, what it can and can't do today, and how Decloak's version works.
Microsoft and GitHub Sign-In Are Here, and Scans Are Now More Stable
You can now sign in to Decloak with Microsoft or GitHub. Under the hood, we contained a long-standing browser-automation bug that could take down other people's scans, made database writes and the live progress page survive brief outages, and fixed several accuracy problems reported by a customer.
Uncloaked: When the Company Selling Identity Protection Gets Phished Itself
Three recent stories: an identity-theft protection company breached via a voice phishing call to one employee, a hardware wallet maker whose own customers got targeted with fake security-alert emails after a vendor breach, and a telecom breach that exposed 14 million email addresses through a third-party software flaw.
Your SSL Certificate Being Valid Isn't the Same Thing as Your TLS Being Secure
A green padlock tells a visitor almost nothing about whether the connection behind it is actually well configured. Certificate expiry, issuer trust, protocol version, and cipher strength are four separate things that can each quietly go wrong while the padlock stays green.
Every Report Now Includes an Explicit OWASP Top 10:2025 Coverage Checklist
Ten rows, always present, on every report: Confirmed, Clean, or Not Tested, with an honest reason given for anything we genuinely can't assess from outside. And along the way, we found our own reference table was still citing the outdated 2021 standard.
PCI DSS Mapping Is Live, and It Fits What We Already Find Better Than Any Framework Yet
Compliance mapping now covers six frameworks. PCI DSS v4.0 added two requirements specifically to catch Magecart-style card skimming, and it turns out Decloak was already built to catch exactly that.
Your PDF Report Used to Be a Printed Webpage. Now It's an Actual Document.
Every Decloak PDF was a dark-themed HTML page forced into PDF form, raw markdown leaking through, text cut off at page edges, no table of contents, no page numbers. We rebuilt it from scratch as a real, print-safe document system, because for a lot of customers, this PDF is the actual deliverable.
How Decloak Scans Behind a Passkey Login (When There's No Credential to Script)
Most scanners test what's public. The moment a page sits behind a login, especially a passkey, they stop. Decloak's authenticated scan mode captures a real logged-in session through a browser extension instead of trying to script a login that, with WebAuthn, technically can't be scripted at all.
We Rebuilt the Scan Report From the Ground Up, and It's Not Just Paid Customers Who Benefit
Three views instead of one wall of data, confidence tiers on every finding, a real fix-it plan instead of just a grade, and full visibility into what actually got checked. The free scan grew up too, same report, same rigor, real evidence from your own site.
Your AI Coding Agent Can Now Trigger a Decloak Scan Itself, No Glue Code Required
Model Context Protocol has quietly become the standard way AI agents connect to real tools, with over 97 million monthly SDK downloads and adoption across every major AI lab. Decloak now ships an MCP server, so Claude, Cursor, or any MCP-compatible agent can trigger a scan and read the results directly.
Expert Mode Is Here: For When 'One Fixed Behavior for Every Scan' Isn't Enough
Built for the professionals who told us they wanted actual control, Expert Mode unlocks named, reusable Scan Profiles that tune the crawler, Active Testing, and AI Pentesting independently, and shows you exactly what effect each setting actually had.
1,706 Findings, 103 Groups: One Issue, One Card, Everywhere in Your Report
A missing header that's true of every page on your site used to show up as one finding card per page, ten cards for ten pages, eighty-three for eighty-three. Now it's one card, with every affected location listed underneath.
Uncloaked: Even an API Security Testing Company Got Breached by an Unprotected Database
Three recent stories, all API-shaped: a ServiceNow access-control gap that let unauthenticated queries pull customer instance data, a compromised third-party app that gave attackers a path into Salesforce customer connections, and an API security testing firm exposed by exactly the kind of unprotected database it tests for.
AI Pentesting Is Live: The Layer That Stops Flagging and Starts Proving
Every other layer in Decloak observes and flags things that look wrong. AI Pentesting is the one that actually attempts exploitation, inside a sandbox, with a fixed toolkit of five real, named tools, and only calls something confirmed once it's proven, not pattern-matched.
Introducing Scoreboards: A Real Dashboard for Every Domain You're Watching
Your account now opens to an actual command center instead of a list of scans, aggregate posture across every domain you monitor, plus a dedicated scoreboard for each one. Live for every account, free included.
What's Actually Inside an Evidence Package (And Why Auditors Ask for One)
An auditor doesn't want a login to your dashboard. They want a self-contained, timestamped bundle they can file as proof. Evidence Packages turn a date range of scan history into exactly that, one ZIP, ready for handoff.
SPF, DMARC, DNSSEC, CAA: The Four DNS Records Deciding Whether Anyone Can Impersonate Your Domain
Four DNS records determine whether someone can send email that looks like it came from you, hijack your domain's resolution, or issue a fraudulent SSL certificate in your name. Here's what each one actually does, and how Decloak checks all four automatically.
Uncloaked: A Weaponized Detection Tool, a Government Contact Leak, and Another Vendor Breach
Three recent stories, all misconfiguration rather than a hack: a data-extortion group hitting Microsoft Power Pages across roughly 15 organisations, a Salesforce campaign that turned a misconfiguration-detection tool into an attack tool, and a hardware wallet company breached through its shipping provider.
API Scanning Is Here: Decloak Now Finds and Tests Your REST, GraphQL, and SOAP Endpoints
Most of what a modern web app actually does happens through an API, and most API vulnerabilities never show up in a page-level scan. Decloak Enterprise now systematically discovers and lightly tests REST, GraphQL, and SOAP endpoints as part of Active Security Testing.
Scanning a Bare IP? We Now Check for Exposed Databases and Open Ports Too
When the scan target is a raw IP address rather than a domain, Decloak now passively checks around 18 commonly-abused ports, databases, remote access, file transfer, for anything open and reachable, plus a reverse DNS lookup. Connect-only, no probe data sent.
Subdomain Discovery Just Got a Lot More Complete, Thanks to Certificate Transparency
A wordlist can only ever find the subdomains someone thought to guess. Decloak now also queries certificate transparency logs, the public record of every hostname a certificate authority has ever issued an SSL cert for, so subdomains nobody guessed still get found.
Inside the Full-Site AI Agent: How Decloak Investigates an Entire Site (And Shows Its Work)
A single-page scan checks one URL. The full-site AI agent decides for itself which pages on your domain are worth investigating, runs all 8 layers on each one, and shows every step of its reasoning as it goes, not just the final report.
Subdomain Takeover Detection Is Live: We Check Every CNAME for Abandoned Targets
A subdomain pointing at a third-party service you stopped using isn't just clutter, it's claimable. Decloak now checks every discovered subdomain's CNAME record for exactly that, live on every Starter+ scan, no extra step required.
Uncloaked: 380,000 Exposed Apps and the Vibe-Coding Security Problem Nobody's Fixing
Five recent stories, all about the same underlying pattern: apps built by describing them in plain English, shipped fast, and left with security defaults nobody thought to check. A Base44 auth bypass, 380,000 publicly indexed AI-built apps, and a backdoor hiding inside AI coding rules themselves.
1,000 Findings, 7 Things to Fix First: Introducing the Priority Remediation Plan
A full scan can surface hundreds of findings, useful for coverage, useless for a Monday-morning to-do list. The new Priority Remediation Plan collapses that into a ranked top-25, with the ranking logic shown, not hidden.
Meet the Decloak AI Assistant: It Already Knows Which Scan You're Looking At
A chat widget lives in the bottom-right corner of every page now. For free accounts it's a curated FAQ router. For paid plans it's a scan-aware agent that can pull your actual findings, look up a real CVE, and explain a compliance control, without you leaving the report.
Uncloaked: A Misconfigured Cloud Server, a SharePoint Zero-Day, and 29 Million Leaked Secrets
Four stories from the last few weeks: a Nextcloud misconfiguration that exposed 367,000 files, a Salesforce webpage misconfiguration behind a 13.5-million-record breach, an actively exploited SharePoint zero-day, and the year's secrets sprawl numbers.
Access-Control-Allow-Origin: * Feels Like a Convenience. It's Usually a Vulnerability.
CORS errors are annoying enough during development that a lot of teams silence them permanently with a wildcard. That single header change quietly opens your API to any website on the internet that wants to make requests on a logged-in user's behalf.
Compliance Mapping Now Covers NIS2 and DORA, Not Just SOC 2 and ISO 27001
Every finding Decloak detects is now mapped to NIS2 and DORA controls alongside SOC 2 and ISO 27001. Same 36 finding categories, same underlying scan, two more frameworks to help you get ahead of this October's NIS2 deadline.
The Three Cookie Flags Standing Between a Normal Session and a Hijacked One
Secure, HttpOnly, and SameSite sound like minor cookie settings. Missing any one of them turns a routine session cookie into something an attacker can read, steal over an open WiFi network, or trigger from a page you never visited.
White-Label Reporting Is Here: Put Your Own Brand on Every Scan Report
Pro and above can now brand their Decloak PDF reports end to end: your logo, your accent color, your fonts, your footer. Built for agencies, consultants, and anyone using security scans as part of client work or lead generation.
Your API Keys Are Probably in Your JavaScript Bundle Right Now
GitGuardian tracked 28.65 million hardcoded secrets pushed to public GitHub in 2025, a 34% jump in a single year. Most never get revoked. Here's why hardcoded API keys keep happening, what they actually cost, and how to check your own site in minutes.
Uncloaked: The Software Supply Chain Had a Brutal Few Months (And It's Not Over)
Four npm supply chain compromises in four months, including a 100-million-download HTTP client, plus a subdomain takeover disclosed against Anthropic itself. What each incident shares, and what it means for a site you didn't think was affected.
The Staging Subdomain You Forgot About Is Still Online (And Still Logged In)
Every domain accumulates subdomains nobody remembers: old staging environments, abandoned marketing pages, test deployments. Most were never meant to be public, and almost nobody audits them.
Uncloaked: WordPress Takeovers, Supabase Leaks, and a Skimmer Hiding in Plain Sight
Five real security stories from the last few months, all touching attack surfaces Decloak scans for: a plugin flaw hitting 500,000 WordPress sites, a Supabase misconfiguration that exposed 1.5 million API keys, and a card skimmer hiding inside Google Tag Manager.
Your Production Site Might Be Shipping Its Own Source Code (And Not Telling You)
Source maps make debugging easier by linking minified code back to the original files. Left enabled in production, they hand an attacker your app's entire uncompiled source, comments and all.
The Security Header Almost Nobody Sets: What Content-Security-Policy Actually Does
Missing Content-Security-Policy headers show up in the vast majority of the sites we scan. Here's what CSP actually protects against, why it gets skipped, and how to add a working policy without breaking your site.
Why Your Supabase Database Might Be Publicly Readable (And How to Check in 30 Seconds)
Row Level Security is off by default in Supabase. That one setting is behind the most common security failure we see in AI-built apps - and it takes about 30 seconds to check whether yours is affected.