sample report · acme.dev is a fictional target

run this against your own domain

recon.sh report

acme.dev

Wed, 20 May 2026 03:51:42 GMT · external · non-destructive

what your app looks like from outside

a self-serve analytics dashboard for indie saas. team accounts, api keys, and stripe billing.

Next.jsStripeCloudflarePostgres

every report exports as a single self-contained HTML file: your unlocked findings, evidence, and the cleanup list. opens offline, prints to PDF.

1 critical and 2 high issues found. reachable from the open internet right now.

severity

1critical 2high 2medium 2low 3informational

10total

critical · 1

SSRF in webhook URL field exfiltrates cloud metadata credentials

POST /api/integrations/webhooks

high · 2

IDOR in invoice download lets any auth user read other tenants' invoices

GET /api/v1/invoices/:invoice_id

Race condition in coupon application yields $0 checkout totals

POST /api/checkout/complete

medium · 2

Stripe webhook signing secret exposed via .git directory

GET /.git/config

Stack traces and dependency versions leaked in 500 responses

Multiple (any unhandled exception path)

low · 2

Password reset endpoint enumerates registered emails

POST /api/auth/password-reset

Server header discloses nginx version with published CVEs

All HTTPS responses

info · 3

Strict-Transport-Security header not set on www.acme.dev

https://www.acme.dev/

X-Frame-Options missing, clickjacking surface present

All HTML responses

Permissions-Policy header not set

All HTML responses

trust

evidence: every paid finding ships request, response, PoC, and remediation
verified: each finding was re-run against acme.dev before it appears here
guarantee: credits back if a finding does not reproduce, or if the scan fails or times out

clean up after the scan

delete the DNS verification record _recon-verify.acme.devverification is done; the TXT record is no longer needed.
rotate the credentials you providedtreat them as compromised: they passed through third-party infrastructure during the scan.

stuff we created on your app

test account we registered pentest-704218@example.comdelete this user from your admin panel; we created it to test authenticated flows.
a test comment we posted comment on /dashboards/demo (marker PENTEST_DO_NOT_USE)delete this comment; we posted it during the scan and could not remove it automatically.

scan another domain