Find the holes. Get the tickets.

A safe external security check for your web app. Every hole we find arrives as a ready-to-assign developer ticket: evidence, how to reproduce, how to fix, and a prompt you can paste into Cursor or Claude Code.

Get my scan for $99 One-off. No subscription.

VT-0412 from a scan of our demo app

Git repository is publicly downloadable at `/.git/`

High Confirmed demo.vulnticket.com

Evidence

$ curl -si https://demo.vulnticket.com/.git/HEAD
HTTP/2 200
content-type: application/octet-stream

ref: refs/heads/main

Why it matters

Anyone can download your full source code and its history, including any credentials that were ever committed. Off-the-shelf tools do this in one command.

How to reproduce

Run the curl command above.
A 200 response containing ref: means the repository is exposed.

How to fix

Block the path on the web server, stop deploying .git into the web root, then rotate every secret that was ever in the repository.

location ~ /\.git { return 404; }

AI-fix prompt

Our production server exposes the .git directory at https://demo.vulnticket.com/.git/. Update the nginx config in this repo so any path starting with /.git returns 404, change the deploy so .git is never copied into the web root, and add a smoke check that GET /.git/HEAD returns 404.

How it works

Verify your domain

Add a DNS TXT record, a file in /.well-known/ or a meta tag. We only ever scan what you have proven is yours.
We run a safe external scan

TLS, security headers, DNS and e-mail records, exposed files, known CVEs in what you run, plus non-destructive active checks.
Assign the tickets

Each finding is a ticket with evidence and a fix. Export them to GitHub Issues in one click, or copy them as Markdown.

Your site keeps running while we look

Only verified domains: Ownership is re-checked before every scan. A file or meta tag covers that host only; DNS covers the domain and its subdomains.
Read-only by default: GET requests, safe checks only, a low request rate and a hard time limit. No fuzzing, no load testing, nothing that writes.
Every scan is logged: Who started it, which target, the ownership proof, start and end time, and the IP we scanned from.
No evidence, no ticket: If we can’t show you the request and the response, it doesn’t reach your backlog.

One scan, every finding as a ticket

$99 one-off

One domain. No subscription, no sales call.

Domain ownership check (DNS, file or meta tag)
Passive checks: TLS, headers, DNS, SPF, DMARC, CAA, exposed files
Known CVEs in your stack, ranked by real-world exploitation
Safe, non-destructive active checks
Tickets with evidence, reproduction steps, fix and AI-fix prompt
Export to GitHub Issues or Markdown

Get my scan for $99