Wranglr Shield — Attack Surface Intelligence
Wranglr Shield is an external attack surface scanner for websites and web
applications. Point it at a domain you own and it maps what the public
internet can already see, then tells you what to fix and how.
What Shield checks
- Attack surface mapping — discovers subdomains through Certificate Transparency logs and DNS, and renders the result as an interactive asset graph linking your site to its scripts, APIs and storage.
- Leaked credentials — scans public JavaScript bundles for API keys and secrets (Stripe, AWS, OpenAI, Anthropic, GitHub, Google Cloud, Firebase, Mailgun, Slack and Discord webhooks, private keys) with entropy scoring to suppress false positives.
- Supabase Row Level Security — detects a Supabase project in your bundle and checks, read-only, whether its tables are readable through the public anon key. Also flags a
service_role key shipped to the browser, which bypasses RLS entirely.
- HTTP security headers — HSTS, Content-Security-Policy, X-Frame-Options, X-Content-Type-Options, Permissions-Policy, Referrer-Policy, cookie HttpOnly/Secure/SameSite flags, and server banner disclosure.
- Email authentication — SPF, DMARC, DKIM and CAA records, so attackers cannot spoof mail from your domain.
- Exposed files —
.env, .git, wp-config.php, .htaccess and Apache server-status, verified against the response body so single-page apps do not produce false positives.
- Open ports and known CVEs — internet-facing SSH, FTP, RDP, MySQL, PostgreSQL and MongoDB, plus vulnerabilities indexed against your server's IP.
- Domain expiry — registration expiry warnings via RDAP, so a lapsed renewal cannot cost you the domain.
How it works
Every finding carries evidence — the request that produced it, the
matched snippet (redacted), a confidence score and a timestamp — plus
specific remediation and, where applicable, copy-pasteable configuration
to fix it. Reports export to PDF. Scans are read-only: Shield never
attempts exploitation and never issues a request that could modify a
target.
Who it is for
Developers, agencies and small teams running production websites —
particularly anyone shipping a React, Next.js, Vue or Nuxt front end
against Supabase or Firebase, where a misconfigured Row Level Security
policy or a key left in a bundle silently exposes an entire database.
Shield is part of Wranglr, a South
African edge hosting and software platform.
