The Decloak Journal
Security news &
platform updates.
Stories from around the web security world, plus release notes and changes to Decloak itself.
Uncloaked: Even an API Security Testing Company Got Breached by an Unprotected Database
Three recent stories, all API-shaped: a ServiceNow access-control gap that let unauthenticated queries pull customer instance data, a compromised third-party app that gave attackers a path into Salesforce customer connections, and an API security testing firm exposed by exactly the kind of unprotected database it tests for.
AI Pentesting Is Live: The Layer That Stops Flagging and Starts Proving
Every other layer in Decloak observes and flags things that look wrong. AI Pentesting is the one that actually attempts exploitation, inside a sandbox, with a fixed toolkit of five real, named tools, and only calls something confirmed once it's proven, not pattern-matched.
Introducing Scoreboards: A Real Dashboard for Every Domain You're Watching
Your account now opens to an actual command center instead of a list of scans, aggregate posture across every domain you monitor, plus a dedicated scoreboard for each one. Live for every account, free included.
What's Actually Inside an Evidence Package (And Why Auditors Ask for One)
An auditor doesn't want a login to your dashboard. They want a self-contained, timestamped bundle they can file as proof. Evidence Packages turn a date range of scan history into exactly that, one ZIP, ready for handoff.
SPF, DMARC, DNSSEC, CAA: The Four DNS Records Deciding Whether Anyone Can Impersonate Your Domain
Four DNS records determine whether someone can send email that looks like it came from you, hijack your domain's resolution, or issue a fraudulent SSL certificate in your name. Here's what each one actually does, and how Decloak checks all four automatically.
Uncloaked: A Weaponized Detection Tool, a Government Contact Leak, and Another Vendor Breach
Three recent stories, all misconfiguration rather than a hack: a data-extortion group hitting Microsoft Power Pages across roughly 15 organisations, a Salesforce campaign that turned a misconfiguration-detection tool into an attack tool, and a hardware wallet company breached through its shipping provider.
API Scanning Is Here: Decloak Now Finds and Tests Your REST, GraphQL, and SOAP Endpoints
Most of what a modern web app actually does happens through an API, and most API vulnerabilities never show up in a page-level scan. Decloak Enterprise now systematically discovers and lightly tests REST, GraphQL, and SOAP endpoints as part of Active Security Testing.
Scanning a Bare IP? We Now Check for Exposed Databases and Open Ports Too
When the scan target is a raw IP address rather than a domain, Decloak now passively checks around 18 commonly-abused ports, databases, remote access, file transfer, for anything open and reachable, plus a reverse DNS lookup. Connect-only, no probe data sent.
Subdomain Discovery Just Got a Lot More Complete, Thanks to Certificate Transparency
A wordlist can only ever find the subdomains someone thought to guess. Decloak now also queries certificate transparency logs, the public record of every hostname a certificate authority has ever issued an SSL cert for, so subdomains nobody guessed still get found.
Inside the Full-Site AI Agent: How Decloak Investigates an Entire Site (And Shows Its Work)
A single-page scan checks one URL. The full-site AI agent decides for itself which pages on your domain are worth investigating, runs all 8 layers on each one, and shows every step of its reasoning as it goes, not just the final report.
Subdomain Takeover Detection Is Live: We Check Every CNAME for Abandoned Targets
A subdomain pointing at a third-party service you stopped using isn't just clutter, it's claimable. Decloak now checks every discovered subdomain's CNAME record for exactly that, live on every Starter+ scan, no extra step required.
Uncloaked: 380,000 Exposed Apps and the Vibe-Coding Security Problem Nobody's Fixing
Five recent stories, all about the same underlying pattern: apps built by describing them in plain English, shipped fast, and left with security defaults nobody thought to check. A Base44 auth bypass, 380,000 publicly indexed AI-built apps, and a backdoor hiding inside AI coding rules themselves.
1,000 Findings, 7 Things to Fix First: Introducing the Priority Remediation Plan
A full scan can surface hundreds of findings, useful for coverage, useless for a Monday-morning to-do list. The new Priority Remediation Plan collapses that into a ranked top-25, with the ranking logic shown, not hidden.
Meet the Decloak AI Assistant: It Already Knows Which Scan You're Looking At
A chat widget lives in the bottom-right corner of every page now. For free accounts it's a curated FAQ router. For paid plans it's a scan-aware agent that can pull your actual findings, look up a real CVE, and explain a compliance control, without you leaving the report.
Uncloaked: A Misconfigured Cloud Server, a SharePoint Zero-Day, and 29 Million Leaked Secrets
Four stories from the last few weeks: a Nextcloud misconfiguration that exposed 367,000 files, a Salesforce webpage misconfiguration behind a 13.5-million-record breach, an actively exploited SharePoint zero-day, and the year's secrets sprawl numbers.
Access-Control-Allow-Origin: * Feels Like a Convenience. It's Usually a Vulnerability.
CORS errors are annoying enough during development that a lot of teams silence them permanently with a wildcard. That single header change quietly opens your API to any website on the internet that wants to make requests on a logged-in user's behalf.
Compliance Mapping Now Covers NIS2 and DORA, Not Just SOC 2 and ISO 27001
Every finding Decloak detects is now mapped to NIS2 and DORA controls alongside SOC 2 and ISO 27001. Same 36 finding categories, same underlying scan, two more frameworks to help you get ahead of this October's NIS2 deadline.
The Three Cookie Flags Standing Between a Normal Session and a Hijacked One
Secure, HttpOnly, and SameSite sound like minor cookie settings. Missing any one of them turns a routine session cookie into something an attacker can read, steal over an open WiFi network, or trigger from a page you never visited.
White-Label Reporting Is Here: Put Your Own Brand on Every Scan Report
Pro and above can now brand their Decloak PDF reports end to end: your logo, your accent color, your fonts, your footer. Built for agencies, consultants, and anyone using security scans as part of client work or lead generation.
Your API Keys Are Probably in Your JavaScript Bundle Right Now
GitGuardian tracked 28.65 million hardcoded secrets pushed to public GitHub in 2025, a 34% jump in a single year. Most never get revoked. Here's why hardcoded API keys keep happening, what they actually cost, and how to check your own site in minutes.
Uncloaked: The Software Supply Chain Had a Brutal Few Months (And It's Not Over)
Four npm supply chain compromises in four months, including a 100-million-download HTTP client, plus a subdomain takeover disclosed against Anthropic itself. What each incident shares, and what it means for a site you didn't think was affected.
The Staging Subdomain You Forgot About Is Still Online (And Still Logged In)
Every domain accumulates subdomains nobody remembers: old staging environments, abandoned marketing pages, test deployments. Most were never meant to be public, and almost nobody audits them.
Uncloaked: WordPress Takeovers, Supabase Leaks, and a Skimmer Hiding in Plain Sight
Five real security stories from the last few months, all touching attack surfaces Decloak scans for: a plugin flaw hitting 500,000 WordPress sites, a Supabase misconfiguration that exposed 1.5 million API keys, and a card skimmer hiding inside Google Tag Manager.
Your Production Site Might Be Shipping Its Own Source Code (And Not Telling You)
Source maps make debugging easier by linking minified code back to the original files. Left enabled in production, they hand an attacker your app's entire uncompiled source, comments and all.
The Security Header Almost Nobody Sets: What Content-Security-Policy Actually Does
Missing Content-Security-Policy headers show up in the vast majority of the sites we scan. Here's what CSP actually protects against, why it gets skipped, and how to add a working policy without breaking your site.
Why Your Supabase Database Might Be Publicly Readable (And How to Check in 30 Seconds)
Row Level Security is off by default in Supabase. That one setting is behind the most common security failure we see in AI-built apps - and it takes about 30 seconds to check whether yours is affected.