Public API Exposure Auditor

US Single Audit Leads Scraper (Federal Audit Clearinghouse)

scrapesage/single-audit-leads-scraper

Scrape the Federal Audit Clearinghouse (SF-SAC): every US org filing a Single Audit — nonprofits, governments, universities, tribes — plus their auditor CPA firms. Name, EIN, email, phone, federal $ spent, programs, findings & lead score. Grant-recipient + CPA-firm B2B leads with monitoring.

WordPress security scanner. Probes the WordPress REST API for endpoints leaking users, plugins, drafts and customer data - the misconfigurations attackers enumerate before a brute-force. 40% of the web runs WordPress. Counts only, no data exfiltrated. Fix guidance included. By Renzo Madueno.

Accessibility and image-SEO audit for any WordPress site: every image missing alt text, with the page it lives on, plus coverage percentages and the worst pages. Distinguishes missing alt from valid decorative alt="". Charged only when an audit completes.

Probes a public Strapi instance for misconfigured Public role permissions. Detects content-types readable without auth via /api/{collection}. Returns counts + curl reproducer. Counts only.

Supabase RLS security scanner. Probes a public Supabase project for Row-Level-Security misconfigurations and detects tables readable by the anon key - the #1 cause of Supabase data leaks. Returns row counts + a curl reproducer per finding. Counts only, no row data exfiltrated. By Renzo Madueno.

Audit a public URL's CORS configuration in one API call. Inspects Access-Control headers on simple and preflight requests, detects wildcard-with-credentials, reflected origins missing Vary: Origin, null-echo origins, and over-permissive methods or headers. Returns score, grade, and recommendations.

Official Complaint Auditor

skootle/public-review-inventory-auditor

Audit official CFPB and NHTSA public complaint inventories with normalized records, source status, provenance, deterministic snapshots, API output, scheduling, monitoring, and integrations.

Email Deliverability & Domain Posture Auditor

gp005/email-deliverability-auditor

Audit email deliverability and domain posture in bulk: MX, SPF, DKIM (common selectors), DMARC policy, DNSSEC, MTA-STS, TLS-RPT, and BIMI. Returns a 0-100 posture score, a prioritized fix list, and per-record detail. Pure DNS-over-HTTPS — no scraping, no API keys.

Probes a public Convex deployment for queries that return data without auth. Convex queries are public-by-default unless you check auth inside the handler. Returns counts + reproducer.

Audit Set-Cookie response headers for Secure, HttpOnly, SameSite, cookie prefixes, Partitioned (CHIPS), tracking cookies, and privacy posture.

n8n Workflow Auditor - Linter & Security Review

mediocre_interest/n8n-workflow-auditor

Audit n8n workflows for hardcoded credentials, unauthenticated webhooks, expression-injection exposure, missing error handling, deprecated nodes, and unreachable branches. Paste workflow JSON or connect an n8n instance and get one ranked finding per row, plus a health score out of 100 per workflow.