Website Exposure Audit & Dorks List for Defense (OSINT API)

Website Exposure Audit & Dorks List for Defense helps you audit and fix what search engines, web archives, caches, code hosts and AI crawlers expose about a website you own. Ask a question like "my .env file was indexed, what do I do first?" and get the 3 best expert sections back as clean JSON, with commands, config and references. Answers cost $0.10, and you don't pay for platform usage.

Made for developers, DevOps, site owners, agencies and security teams. It covers search engines, web archives, Common Crawl, GitHub and public cloud buckets. Output: knowledge sections as JSON (Markdown text, code blocks, references). It's a knowledge API, not a scanner, and it works as a tool for AI agents through the Apify MCP server.

It's built from the book Find and Fix What Search Engines Expose About Your Site (v1.0, October 2026) by Youssef Ferri / Lycorax Technologies: 80 structured sections, about 18,000 words, 66 cited references, the SCRUB Loop (Search → Classify → Repair → Unlist → Build guards) and the Exposure Severity Score.

Use with AI agents (MCP)

This Actor is an AI agent / MCP tool. Through the hosted Apify MCP server, Claude, Cursor, VS Code, ChatGPT or any MCP client can call it, read the input fields below as the tool's docs, and get the results as JSON.

• This tool only: https://mcp.apify.com/?tools=j0l30/website-exposure-defense-knowledge
• All 5 Lycorax tools: https://mcp.apify.com/?tools=j0l30/shopify-seo-alt-text-fixer,j0l30/woocommerce-seo-alt-text-fixer,j0l30/website-image-seo-audit,j0l30/domain-rdap-dns-reputation-checker,j0l30/website-exposure-defense-knowledge

Sign in with Apify (OAuth) when your client asks, or send the header Authorization: Bearer <APIFY_TOKEN>. Runs are billed to your Apify account at the prices in "How much does it cost?". The tool returns the run and its datasetId; the agent then reads the rows with get-dataset-items, which the server adds for you.

Claude Desktop / claude.ai: Settings → Connectors → Add custom connector → paste the URL as Remote MCP server URL.

Claude Code:

$claude mcp add --transport http lycorax "https://mcp.apify.com/?tools=j0l30/website-exposure-defense-knowledge"

Cursor (~/.cursor/mcp.json, or .cursor/mcp.json in your project):

{ "mcpServers": { "lycorax": { "url": "https://mcp.apify.com/?tools=j0l30/website-exposure-defense-knowledge" } } }

VS Code (.vscode/mcp.json):

{ "servers": { "lycorax": { "type": "http", "url": "https://mcp.apify.com/?tools=j0l30/website-exposure-defense-knowledge" } } }

ChatGPT (Developer mode on): Settings → Apps & Connectors → Create → MCP Server URL = the URL, Authentication = OAuth. ChatGPT can't change a connector's tools later, so pick the one-tool or the all-tools URL first.

Swap in the all-tools URL to give your agent every Lycorax tool at once.

Example prompts

1. "My .env file was indexed by a search engine on a site I own. What do I do in the first 15 minutes?"
2. "List the free catalog of sections, then fetch only the section on the exposed .git folder fix for my own site."
3. "Give me a defensive search-operator query set to audit what search engines show about my own domain example.com, and how to remove what I find."

Defensive use only: it answers questions about sites you own or are authorized to test, and it never scans anything. Start with mode: "catalog" (free) to see the section ids.

Output sample. A real catalog item (free). ask, unit, chapter and pack return the same fields with the full Markdown in content_markdown, plus license and publisher.

{"id": "ch2.01-the-scrub-loop", "chapter_id": "ch2", "chapter": "The SCRUB Loop and the Exposure Severity Score", "stage": "The method", "title": "The SCRUB Loop", "summary": "Five steps. Each one has a question it answers, and you do not skip ahead.", "tags": ["ci", "rotate", "removal"], "words": 278, "content_markdown": "(buy with mode=unit)"}

Other Lycorax tools: Shopify Alt Text Generator · WooCommerce Alt Text Generator · Image SEO Checker for Any Website · Domain Reputation Checker.

What can this website exposure knowledge API do?

• Answer a leak question in seconds. Leaked .env file, exposed .git folder, public backup, indexed PDF with personal data, open admin panel, staging site, source maps, a secret pushed to GitHub, or a public cloud bucket.
• Give your agent a step-by-step incident playbook. Six time-boxed playbooks, starting with the first 15 minutes after a leaked secret.
• Run a defensive self-audit. Search operators ("dorks" for defense) that work across several search engines, plus an audit URL builder script.
• Remove exposed files from search results and archives. Service-by-service removal steps for search engines, web archives, caches, Common Crawl and AI crawlers.
• Prevent the next leak. Pre-commit secret scanning, push protection, CI checks, X-Robots-Tag, security.txt and canary tokens.
• Know the law. Authorisation rules, Moroccan law (Penal Code art. 607-3, Loi 09-08), and when the GDPR reaches you.

Who is it for?

• AI agents and MCP clients (Claude, Cursor, ChatGPT, custom LangChain or CrewAI agents) that need trusted security knowledge instead of guessing.
• Developers, DevOps and site owners fixing a data leak or hardening a site before launch.
• Agencies and freelancers running monthly website exposure audits for clients.
• Security and compliance teams writing an incident runbook.

How much does it cost?

Pay per event. You only pay for the content you get, and platform usage is included.

Mode	What you get	Price
catalog	Every section id, title, summary and tags, plus a free agent SKILL.md	Free
ask	The 3 sections that best answer your question, in full with code	$0.10 per answer
unit	One section by id	$0.05 per section
chapter	A whole SCRUB stage (for example ch6 Repair or ch9 Playbooks)	$0.40 per chapter
pack	All 80 sections and SKILL.md	$3.00 one time

How to use it

1. Run catalog once (free) to see every section id.
2. Use ask with a plain question for a quick answer.
3. Use unit or chapter to fetch exactly what you need, or pack for a full audit.

Input example

{ "mode": "ask", "query": "my .env file was indexed by search engines, what do I do first?" }

Other inputs: { "mode": "unit", "unitId": "ch2.01-the-scrub-loop" } or { "mode": "chapter", "chapterId": "ch9" }.

Output example

Each dataset item has id, chapter_id, chapter, stage, title, summary, tags, content_markdown, code_blocks, references and license.

{
  "id": "ch9.01-playbook-1-the-first-15-minutes-after-a-leaked-env-or-secret",
  "chapter_id": "ch9",
  "chapter": "Time-boxed playbooks",
  "stage": "Under the clock",
  "title": "Playbook 1: the first 15 minutes after a leaked `.env` or secret",
  "summary": "Trigger. A secret file or value is reachable on a site you own, or you learn it was.",
  "tags": ["env", "secret", "bucket", "ci", "rotate"],
  "content_markdown": "..."
}

What's inside: chapters

Chapter	Topic
ch1	Your site is more public than you think
ch2	The SCRUB Loop and the Exposure Severity Score
ch3	Search: auditing what search engines hold
ch4	Where leaks outlive the fix: archives, caches, AI crawlers, repos, buckets, source maps, .git, staging subdomains
ch5	Classify: scoring what you found
ch6	Repair: rotate secrets, deny rules, framework notes
ch7	Unlist: purge every copy
ch8	Build guards: prevention and quiet watching
ch9	Six time-boxed incident playbooks
ch10	Four real leaks, one loop (case studies)
ch11	The law, your duty, and the Moroccan context
appA–appD	Templates, audit URL builder script, operator table, glossary

AI agents can pay here (x402, USDC)

Your agent doesn't need an Apify account, API key or credit card. With the x402 protocol, it pays in USDC on Base or Solana and runs this Actor by itself.

1. Give your agent the Apify x402 skill and a Coinbase Agentic Wallet with a little USDC (the minimum top-up is $1).
2. The agent buys a prepaid Apify token with one x402 payment. The token's balance is a hard spending cap.
3. It calls https://api.apify.com/v2/acts/j0l30~website-exposure-defense-knowledge/run-sync-get-dataset-items with that token and gets the sections back as JSON.

Start with the free catalog. A $1 balance covers about 10 ask answers at $0.10 each. Prepaid tokens expire 14 days after purchase, and unused balance isn't refunded. x402 on Apify is still experimental.

Agent-ready call example

curl -s -X POST -H "Authorization: Bearer $TOKEN" -H "Content-Type: application/json" \
  -d '{"mode":"ask","query":"exposed .git folder on my site, what now?"}' \
  "https://api.apify.com/v2/acts/j0l30~website-exposure-defense-knowledge/run-sync-get-dataset-items"

FAQ

What should I do first if my .env file was indexed?

Rotate every secret in it before anything else, then block the file at the web server, then remove it from search engines and archives. Run ask with your situation, or fetch ch9 for the full playbook.

How do I remove an exposed file from search results?

Fix it at the source first so it returns 404 or 410, then request removal from each search engine and archive. ch7 covers each service step by step.

Can an AI agent pay for this without an Apify account?

Yes. Agents can pay with USDC through x402, buying a prepaid Apify token and then running this Actor with it. See "AI agents can pay here" above.

Does it include a dorks list for OSINT?

Yes, for defense. It has search operators that work across several search engines, an operator table and an audit URL builder script, so you can check what's exposed about your own sites. Each pattern comes with the fix, removal and prevention steps.

Is this a hacking tool?

No. It's defensive only. It teaches you to audit and fix domains, repos and buckets you own or have written permission to test. It doesn't scan or attack anything.

Does it store my questions?

No. There's no tracking and no third-party calls, and the publisher doesn't store your queries.

Can I train a model on it?

Not with this license. Runtime use is allowed; training or fine-tuning needs a separate Training License. Contact freejosephe@gmail.com.

How it compares (honestly)

• Exposure scanners: a scanner probes your site for you. This Actor doesn't scan anything. It tells you what to look for and how to fix and remove it. Pair it with your own checks, or with the Domain Reputation Checker for DNS and TLS hygiene.
• Public dorks lists: they're usually raw search operators with no next step. Here each search pattern sits next to the repair, removal and prevention steps, and it's limited to sites you own.
• Asking a general chatbot: answers come from a fixed, cited corpus (80 sections, 66 references), not generated text, so the same question returns the same sections.

More tools from the same publisher

• Shopify Alt Text Generator: bulk alt text audit and auto-fix for Shopify product images.
• WooCommerce Alt Text Generator: the same for WooCommerce products and WordPress media, with a WP-CLI script.
• Image SEO Checker for Any Website: image SEO and alt text checks on any CMS, with white-label PDF reports.
• Domain Reputation Checker: bulk RDAP lookup, DNS, SPF and DMARC checks and a risk score.

License and rules

• Defensive only. Unauthorised access is a crime in Morocco (Penal Code art. 607-3 and following) and almost everywhere else.
• License. Runtime use only; no redistribution of the content.
• Not legal advice. Human readers can get the illustrated ebook at ko-fi.com/lycorax.