We built https://teapawt.net/t.co/I98Pc28kjm as the web intelligence service for the modern era. Start for free with features for vibe coders all the way through to Enterprise!
London
Joined July 2026
- Tweets458
- Following331
- Followers266
- Likes286
Pinned Tweet
Decloak finished October as the #1 deal across all of AppSumo Radar 🏆
AI agents are making attacks faster and cheaper. Defenders need to see what attackers see, first.
Thank you to everyone who backed us 🙏
Lifetime deal: appsumo.com/pl/PPMtkEdMGS/
1/ The phishing site imitating your brand isn't on your domain.
It's on exarnple.com, on someone else's servers, and nothing in your logs will ever see it.
Most companies find out when a customer forwards the email.
4/ What it isn't: phishing detection.
"Live" means a page answered, not that it's malicious. Many lookalikes are parked or defensive registrations. It doesn't read page content yet, catch every variation or take anything down.
5/ How it works, and what to do when you find one: decloak.dev/journal/lookalik…
How did you find out about the last lookalike of your domain?
1/ Yesterday's clean scan can be wrong today without anyone touching your site.
A CVE lands against software you already run. A tag gets published. A plugin updates itself.
So stop relying on remembering to scan.
4/ The honest limit: scheduled isn't real-time.
A weekly scan can leave a problem unseen for up to six days. For payment pages, pair it with client-side protection like a strict CSP.
5/ The full setup guide, with suggested cadences by site type: decloak.dev/journal/set-it-o…
How often does your team actually rescan production today?
1/ Anyone who can publish in Google Tag Manager can put JavaScript on your checkout page.
No pull request. No review. No deploy. Nothing in your repo.
That's why card skimmers love hiding there.
4/ What it can't see:
A tag that only fires for some visitors may not fire during our scan. Server-side GTM never reaches the browser. And who has Publish access is only visible inside GTM.
A scan is a snapshot, so schedule it.
5/ The full guide, plus five things to do this week: decloak.dev/journal/your-tag…
When did anyone last read every Custom HTML tag in your container?
1/ A crawler only finds pages your site links to.
The backup file, the old admin panel and the debug page nobody linked to are exactly the ones it misses.
Here's what Decloak's Active Testing asks your site, and what it deliberately doesn't.
4/ What it doesn't do:
A raw canary reflection means XSS is likely, not proven. Forced browsing only finds paths it asks for. And it isn't a manual pentest: no chaining, no business logic.
It gets its own score, so a clean passive scan can't hide it.
5/ The full guide, including how it runs behind a passkey login: decloak.dev/journal/active-t…
What's the oddest file you've found still publicly reachable on a production site?