The Decloak Journal
Security news &
platform updates.
Stories from around the web security world, plus release notes and changes to Decloak itself.
How Decloak Scans Behind a Passkey Login (When There's No Credential to Script)
Most scanners test what's public. The moment a page sits behind a login, especially a passkey, they stop. Decloak's authenticated scan mode captures a real logged-in session through a browser extension instead of trying to script a login that, with WebAuthn, technically can't be scripted at all.
Your AI Coding Agent Can Now Trigger a Decloak Scan Itself, No Glue Code Required
Model Context Protocol has quietly become the standard way AI agents connect to real tools, with over 97 million monthly SDK downloads and adoption across every major AI lab. Decloak now ships an MCP server, so Claude, Cursor, or any MCP-compatible agent can trigger a scan and read the results directly.
What's Actually Inside an Evidence Package (And Why Auditors Ask for One)
An auditor doesn't want a login to your dashboard. They want a self-contained, timestamped bundle they can file as proof. Evidence Packages turn a date range of scan history into exactly that, one ZIP, ready for handoff.
SPF, DMARC, DNSSEC, CAA: The Four DNS Records Deciding Whether Anyone Can Impersonate Your Domain
Four DNS records determine whether someone can send email that looks like it came from you, hijack your domain's resolution, or issue a fraudulent SSL certificate in your name. Here's what each one actually does, and how Decloak checks all four automatically.
Inside the Full-Site AI Agent: How Decloak Investigates an Entire Site (And Shows Its Work)
A single-page scan checks one URL. The full-site AI agent decides for itself which pages on your domain are worth investigating, runs all 8 layers on each one, and shows every step of its reasoning as it goes, not just the final report.
Access-Control-Allow-Origin: * Feels Like a Convenience. It's Usually a Vulnerability.
CORS errors are annoying enough during development that a lot of teams silence them permanently with a wildcard. That single header change quietly opens your API to any website on the internet that wants to make requests on a logged-in user's behalf.
The Three Cookie Flags Standing Between a Normal Session and a Hijacked One
Secure, HttpOnly, and SameSite sound like minor cookie settings. Missing any one of them turns a routine session cookie into something an attacker can read, steal over an open WiFi network, or trigger from a page you never visited.
Your API Keys Are Probably in Your JavaScript Bundle Right Now
GitGuardian tracked 28.65 million hardcoded secrets pushed to public GitHub in 2025, a 34% jump in a single year. Most never get revoked. Here's why hardcoded API keys keep happening, what they actually cost, and how to check your own site in minutes.
The Staging Subdomain You Forgot About Is Still Online (And Still Logged In)
Every domain accumulates subdomains nobody remembers: old staging environments, abandoned marketing pages, test deployments. Most were never meant to be public, and almost nobody audits them.
Your Production Site Might Be Shipping Its Own Source Code (And Not Telling You)
Source maps make debugging easier by linking minified code back to the original files. Left enabled in production, they hand an attacker your app's entire uncompiled source, comments and all.
The Security Header Almost Nobody Sets: What Content-Security-Policy Actually Does
Missing Content-Security-Policy headers show up in the vast majority of the sites we scan. Here's what CSP actually protects against, why it gets skipped, and how to add a working policy without breaking your site.
Why Your Supabase Database Might Be Publicly Readable (And How to Check in 30 Seconds)
Row Level Security is off by default in Supabase. That one setting is behind the most common security failure we see in AI-built apps - and it takes about 30 seconds to check whether yours is affected.