Original Summary

hey guys, been working on an agentless vulnerability scanner recently and wanted to test out the recon engine. so I ran a passive external scan (no payloads, just checking public dns and headers) on 100 newly launched saas and ai tools from product hunt. tbh the results were a lot worse than I expected. roughly 1 in 5 had high severity exposures that you can find in like 5 minutes from the outside. the craziest part is how people are treating AI agents. back in the day everyone left phpmyadmin open. now it's mcp endpoints and langfuse. I saw multiple startups leaving their mcp hostnames in public dns and just serving up mcp.json configs to anyone who asks. even found a live langfuse instance with no auth at all. if you leave that open, literally all your prompt traces and customer data are just sitting there on the public web. another huge issue is the cloudflare illusion. founders put their marketing site behind a waf and think they're secure. but in like 14 cases I checked, the bare apex domain or the core API was resolving directly to the origin server IP. meaning anyone can just bypass the waf entirely by hitting the origin directly. also almost nobody (58 out of 100) has a security.txt file. so even if a good guy finds a leak, there's no way to easily report it.   submitted by   /u/kaosthecreator_ [link]   [comments]

  • 情报分类：商业与市场研究
  • 分类依据：内容涉及商业、投资或市场动态
  • 信息来源：Reddit · SaaS
  • 发布时间：2026/10/16 04:00:43