Attack Surface

Acest conținut nu este încă disponibil în limba selectată.

Attack Surface looks at your site from the outside and sees only what any visitor receives. It reads your public DNS, checks HTTPS and the headers and cookies of your home page, and looks for keys and files left public. Each finding says what it means and how to fix it. It needs no connector and it is on Free.

What it checks

A scan runs ten checks on the domain you confirmed:

DNS and e-mail: SPF and DMARC, a domain without e-mail that others can send as, which certificate authorities may issue for you (CAA), subdomains pointing to a name that no longer exists, and subdomains that answer outside Cloudflare. Subdomains come from the public certificate logs and from a list of common names.
Security headers: HSTS, content type, framing, Referrer-Policy, Permissions-Policy, Content Security Policy, and headers that reveal software versions. They get a grade from A+ to F, the same grade as Page Shield.
HTTPS: the redirect from plain HTTP, the certificate, and whether the server still accepts TLS 1.0 or 1.1.
Cookies set by the home page: Secure, HttpOnly and SameSite.
Third-party scripts loaded without an integrity check (SRI).
Privacy: trackers that load with no consent banner on the page.
Source maps that publish your original front-end code.
Secret keys in the JavaScript sent to visitors: Stripe, Supabase, OpenAI, Anthropic and GitHub.
Database settings in the front end (Supabase, Firebase), with what protects the data behind them.
Files left public: /.env, /.env.local, /.env.production and /.git/HEAD.

Turn it on

The scan runs only on a domain you proved is yours.

In the dashboard, open your site and go to Site settings. Under Domain, type the host name, such as shop.example.com, and save.
Where you manage the DNS of that domain, add the TXT record the page shows. Its name is _qlyne.shop.example.com and its value starts with qlyne-site-verification=.
Click Check now. Once it says Confirmed, you can remove the record.
Go to Attack Surface, Overview, and click Run scan. The page updates by itself while the scan runs.

From then on, Qlyne scans every confirmed domain again once a day, with no action from you. You can also start a scan yourself, one every 10 minutes. Changing the domain in Site settings asks for a new confirmation, with a new value for the record.

With the MCP server, an AI assistant can confirm the domain, start a scan and read the report.

On a site behind Qlyne

The scanner’s requests carry a header signed with your connector secret, so the scanner trap of your own site lets them through. Every other rule applies to the scanner as to any visitor. Challenge and block pages from the connector are recognised and never become findings about your site.

What you see

The Overview of Attack Surface shows the last finished scan:

The domain, the header grade, when it ran, how many DNS queries and requests it made, and how many seconds it took.
Notes on what could not be checked this time, such as certificate logs that didn’t answer.
The count of findings by severity: Critical, High, Medium, Low and Info, with a filter.
Each finding with its severity, title, code (such as QLY-FIL-001), the CWE when there is one, and the evidence. Then the impact, the Fix: and links to read more. New marks what appeared in this scan.
Fixed since the previous scan, with what disappeared.
History, with the last 10 scans.

The evidence never holds a secret. A public .env shows the names of its settings, never the values, and keys appear masked.

The site overview sums up the last scan. A secret key or a database setting found in the front end also shows up there, under “Outside what the connector sees”, with a link to the finding.

Next to the report, JSON and Markdown download it. Markdown pastes into a ticket or goes to whoever fixes the site; JSON feeds another tool. Only people who can edit the site can open the report and download it.

Limits

It only reads. Every request is a GET without cookies. It never logs in, submits forms, tries passwords, sends attack payloads or queries your database.
It stays on the confirmed domain and its subdomains, on public addresses, on ports 80 and 443. It never follows links to other domains.
At most 30 requests to your site per scan, 10 seconds each. On the home page it reads up to 5 scripts from your own domain.
It doesn’t run JavaScript yet. Cookies and scripts that your code adds after the page loads are not in the report. Cookies come from the home page only.
It doesn’t look for known vulnerable software versions and doesn’t scan ports.
A finding can’t be hidden or marked as accepted. It leaves the report when the next scan no longer sees it.
The history shows what is new and what was fixed since the previous scan. There is no trend over time.

FAQ

Will it take my site down?

No. A scan makes at most 30 GET requests, a new one can start only 10 minutes later, and the automatic scan runs once a day. Two of those requests try TLS 1.0 and 1.1, which a well-configured server refuses. Nothing is sent to forms, logins or your database.

How long does a scan take?

In our production, the 9 scans finished between 10 and 18 October 2026 took 3 to 59 seconds each (measured on 18 October 2026). A scan stops after 5 minutes at most. The report says how long yours took.

Can I scan someone else’s site?

No. The scan runs only after the TXT record shows up in the domain’s DNS, and only whoever controls that DNS can publish it. If QlyneScanner/1.0 shows up in the logs of a site you didn’t confirm, The Qlyne scanner explains what it asked for and how to stop it.

What do I do with a critical finding?

Two findings are critical: a public environment file (QLY-FIL-001) and a secret key in the JavaScript (QLY-SEC-001). Treat what they expose as leaked. First change every password and key involved, in the dashboard of each provider. Then remove the file or move the key to your server, as the Fix: of the finding describes. Run the scan again: the finding moves to Fixed since the previous scan. Removing the file alone isn’t enough, since anyone may have downloaded it already.

Is it on Free?

Yes. Attack Surface is on every plan, Free included, with the daily scan. See Plans.

Troubleshooting

The TXT record is not found

Check now says “Not found yet. New records can take a few minutes to show up.” Wait a few minutes and click again. If it still fails:

Many DNS panels add your domain to the name on their own. For shop.example.com in the zone example.com, type _qlyne.shop as the name, or the record ends up at _qlyne.shop.example.com.example.com.
Copy the value exactly, with no extra spaces or quotes.
If you changed the domain, the value changed too. Publish the new one.
From a terminal, dig +short TXT _qlyne.shop.example.com should print the value. When it does, Check now finds it.

A finding looks wrong

Read the evidence first: it shows what the scanner received, such as the address, the status or the header. A few common causes:

An old subdomain still in your DNS or in the certificate logs. Delete the DNS record if you no longer use it.
A header your server sends on some pages only. The scanner reads the home page.
Another firewall in front of your site that blocks the scanner. The report then says the home page couldn’t be checked.

Files are reported only when the content looks like the file, so a site that answers every address with its home page gives no finding. After a fix, click Run scan and check Fixed since the previous scan. If the evidence doesn’t match your site, write to contato@qlyne.com with the domain and the code of the finding.

The scan stays on “Scanning”

A scan usually ends in under a minute and stops after 5 minutes at most. Keep the page open: it updates by itself. If it ends with “The last scan didn’t finish”, click Run scan again in a few minutes.

If it still says “Scanning” after more than 5 minutes, the scan was lost on our side (the worker stopped mid-scan). Nothing to do: within 15 minutes of its start, Qlyne marks it as failed by itself, with the message “Timed out”, Run scan comes back and the daily scan includes the site again. Click Run scan then. Only if the button is still disabled an hour later, write to contato@qlyne.com with the domain.