The Decloak Journal
Security news &
platform updates.
Stories from around the web security world, plus release notes and changes to Decloak itself.
Your SSL Certificate Being Valid Isn't the Same Thing as Your TLS Being Secure
A green padlock tells a visitor almost nothing about whether the connection behind it is actually well configured. Certificate expiry, issuer trust, protocol version, and cipher strength are four separate things that can each quietly go wrong while the padlock stays green.
Every Report Now Includes an Explicit OWASP Top 10:2025 Coverage Checklist
Ten rows, always present, on every report: Confirmed, Clean, or Not Tested, with an honest reason given for anything we genuinely can't assess from outside. And along the way, we found our own reference table was still citing the outdated 2021 standard.
PCI DSS Mapping Is Live, and It Fits What We Already Find Better Than Any Framework Yet
Compliance mapping now covers six frameworks. PCI DSS v4.0 added two requirements specifically to catch Magecart-style card skimming, and it turns out Decloak was already built to catch exactly that.
Your PDF Report Used to Be a Printed Webpage. Now It's an Actual Document.
Every Decloak PDF was a dark-themed HTML page forced into PDF form, raw markdown leaking through, text cut off at page edges, no table of contents, no page numbers. We rebuilt it from scratch as a real, print-safe document system, because for a lot of customers, this PDF is the actual deliverable.
We Rebuilt the Scan Report From the Ground Up, and It's Not Just Paid Customers Who Benefit
Three views instead of one wall of data, confidence tiers on every finding, a real fix-it plan instead of just a grade, and full visibility into what actually got checked. The free scan grew up too, same report, same rigor, real evidence from your own site.
Expert Mode Is Here: For When 'One Fixed Behavior for Every Scan' Isn't Enough
Built for the professionals who told us they wanted actual control, Expert Mode unlocks named, reusable Scan Profiles that tune the crawler, Active Testing, and AI Pentesting independently, and shows you exactly what effect each setting actually had.
1,706 Findings, 103 Groups: One Issue, One Card, Everywhere in Your Report
A missing header that's true of every page on your site used to show up as one finding card per page, ten cards for ten pages, eighty-three for eighty-three. Now it's one card, with every affected location listed underneath.
AI Pentesting Is Live: The Layer That Stops Flagging and Starts Proving
Every other layer in Decloak observes and flags things that look wrong. AI Pentesting is the one that actually attempts exploitation, inside a sandbox, with a fixed toolkit of five real, named tools, and only calls something confirmed once it's proven, not pattern-matched.
API Scanning Is Here: Decloak Now Finds and Tests Your REST, GraphQL, and SOAP Endpoints
Most of what a modern web app actually does happens through an API, and most API vulnerabilities never show up in a page-level scan. Decloak Enterprise now systematically discovers and lightly tests REST, GraphQL, and SOAP endpoints as part of Active Security Testing.
Scanning a Bare IP? We Now Check for Exposed Databases and Open Ports Too
When the scan target is a raw IP address rather than a domain, Decloak now passively checks around 18 commonly-abused ports, databases, remote access, file transfer, for anything open and reachable, plus a reverse DNS lookup. Connect-only, no probe data sent.
Subdomain Discovery Just Got a Lot More Complete, Thanks to Certificate Transparency
A wordlist can only ever find the subdomains someone thought to guess. Decloak now also queries certificate transparency logs, the public record of every hostname a certificate authority has ever issued an SSL cert for, so subdomains nobody guessed still get found.
Subdomain Takeover Detection Is Live: We Check Every CNAME for Abandoned Targets
A subdomain pointing at a third-party service you stopped using isn't just clutter, it's claimable. Decloak now checks every discovered subdomain's CNAME record for exactly that, live on every Starter+ scan, no extra step required.
1,000 Findings, 7 Things to Fix First: Introducing the Priority Remediation Plan
A full scan can surface hundreds of findings, useful for coverage, useless for a Monday-morning to-do list. The new Priority Remediation Plan collapses that into a ranked top-25, with the ranking logic shown, not hidden.
Meet the Decloak AI Assistant: It Already Knows Which Scan You're Looking At
A chat widget lives in the bottom-right corner of every page now. For free accounts it's a curated FAQ router. For paid plans it's a scan-aware agent that can pull your actual findings, look up a real CVE, and explain a compliance control, without you leaving the report.
Compliance Mapping Now Covers NIS2 and DORA, Not Just SOC 2 and ISO 27001
Every finding Decloak detects is now mapped to NIS2 and DORA controls alongside SOC 2 and ISO 27001. Same 36 finding categories, same underlying scan, two more frameworks to help you get ahead of this October's NIS2 deadline.
White-Label Reporting Is Here: Put Your Own Brand on Every Scan Report
Pro and above can now brand their Decloak PDF reports end to end: your logo, your accent color, your fonts, your footer. Built for agencies, consultants, and anyone using security scans as part of client work or lead generation.