decloak.dev

1/ The phishing site imitating your brand isn't on your domain. It's on exarnple.com, on someone else's servers, and nothing in your logs will ever see it. Most companies find out when a customer forwards the email.

Decloak finished October as the #1 deal across all of AppSumo Radar 🏆 AI agents are making attacks faster and cheaper. Defenders need to see what attackers see, first. Thank you to everyone who backed us 🙏 Lifetime deal: appsumo.com/pl/PPMtkEdMGS/

1/ Yesterday's clean scan can be wrong today without anyone touching your site. A CVE lands against software you already run. A tag gets published. A plugin updates itself. So stop relying on remembering to scan.

1/ Anyone who can publish in Google Tag Manager can put JavaScript on your checkout page. No pull request. No review. No deploy. Nothing in your repo. That's why card skimmers love hiding there.

1/ A crawler only finds pages your site links to. The backup file, the old admin panel and the debug page nobody linked to are exactly the ones it misses. Here's what Decloak's Active Testing asks your site, and what it deliberately doesn't.

1/ Two critical PHP flaws leaked a day before their patch. Exploitation attempts started before the fix shipped. PHP runs most of the websites whose server-side language is known, and updating WordPress doesn't update PHP.

1/ The EU Cyber Resilience Act's first obligations kicked in on 11 September. US vendor questionnaires keep asking about NIST CSF. Decloak now maps every scan finding to both. That's eight frameworks from one scan.

1/ A scan says: "missing Strict-Transport-Security header." An auditor asks: "How do you protect data in transit, and can you show me?" Someone has to translate. Compliance mapping does it automatically.

1/ AI models now write code that compiles about 100% of the time. They still fail security tests in nearly half of tasks. Veracode tracked 100+ models for a year. The average pass rate moved from 55% to 56%.

1/ When we launched AI Pentesting, we published what it couldn't do: no SSRF, no XXE, no command injection. As of today, it confirms all three, with proof. Here's what changed: