About
I built DomainOptic because developers (including me) ship fast and miss things.
The core problem: repo scanners catch secrets in your code. But what about the secrets in your deployed bundle? The ones that survive your build process because you used NEXT_PUBLIC_ or VITE_ instead of server-only env vars?
What it does:
Scans your live site for exposed secrets in JS bundles (199+ patterns)
Checks SSL, DNS, security headers, reputation
Grades everything A+ to F so you know what to fix first
What I found scanning HN sites:
80% failing security headers
31% missing email authentication (SPF/DKIM/DMARC)
11% with potential exposed secrets in production JS
These aren't enterprise sites. They're indie projects. Side hustles. Show HN launches.
The build:
199 secret patterns (added xAI, Pinecone, vector DBs, crypto exchanges)
SSRF hardening so the scanner itself isn't the attack surface
Confidence scoring to reduce false positives
No signup required for basic scans.