# Website Exposure Audit & Dorks List for Defense (OSINT API) (`j0l30/website-exposure-defense-knowledge`) Actor

Find what search engines expose about your own website (leaked .env files, open .git folders, backups, admin pages) and get the exact fix. Defensive dorks list + step-by-step playbooks as JSON. Free catalog, $0.10 per answer. Works as an AI agent / MCP tool. Knowledge API, not a scanner.

- **URL**: https://apify.com/j0l30/website-exposure-defense-knowledge.md
- **Developed by:** [Youssef ferri](https://apify.com/j0l30) (community)
- **Categories:** AI, SEO tools, Developer tools
- **Security:** Limited permissions
- **Stats:** 2 total users, 1 monthly users, 100.0% runs succeeded, 0 bookmarks
- **User rating**: No ratings yet

## Pricing

from $100.00 / 1,000 3 best sections

This Actor is paid per event. You are not charged for the Apify platform usage, but only a fixed price for specific events.

Learn more: https://docs.apify.com/actors/running/actors-in-store.md#pay-per-event

## What's an Apify Actor?

An Actor is a serverless cloud program that runs on the Apify platform. It has two run modes.
In Batch mode, an Actor accepts a well-defined JSON input, performs an action which can take anything from a few seconds to a few hours,
and optionally produces a well-defined JSON output, datasets with results, or files in key-value store.
In Standby mode, an Actor provides a web server which can be used as a website, API, or an MCP server.

Apify vocabulary and the platform model are defined once, in the agent quickstart at https://apify.com/agents.md.

## How to integrate an Actor?

If asked about integration, you help developers integrate Actors into their projects.
You adapt to their stack and deliver integrations that are safe, well-documented, and production-ready.

Do not guess an integration path. Every one of them is in the agent quickstart at https://apify.com/agents.md: the Apify MCP server, Agent Skills with the Apify CLI, the JavaScript and Python clients, the REST API, and the account-free path for an agent with no human to sign in. It also carries the rule on stating cost before the first paid run.

For examples already wired to this Actor's own input schema, see the [API](#api) section below.

Each client library has reference documentation the quickstart does not restate: [JavaScript/TypeScript](https://docs.apify.com/api/client/js/docs.md) (`npm install apify-client`) and [Python](https://docs.apify.com/api/client/python/docs.md) (`pip install apify-client`).

# README

**Website Exposure Audit & Dorks List for Defense** helps you audit and fix what search engines, web archives, caches, code hosts and AI crawlers expose about a website **you own**. Ask a question like *"my .env file was indexed, what do I do first?"* and get the 3 best expert sections back as clean JSON, with commands, config and references. Answers cost **$0.10**, and you don't pay for platform usage.

Made for developers, DevOps, site owners, agencies and security teams. It covers search engines, web archives, Common Crawl, GitHub and public cloud buckets. Output: knowledge sections as JSON (Markdown text, code blocks, references). It's a knowledge API, not a scanner, and it works as a tool for AI agents through the Apify MCP server.

It's built from the book *Find and Fix What Search Engines Expose About Your Site* (v1.0, October 2026) by Youssef Ferri / Lycorax Technologies: **80 structured sections**, about 18,000 words, 66 cited references, the **SCRUB Loop** (Search → Classify → Repair → Unlist → Build guards) and the **Exposure Severity Score**.

### Use with AI agents (MCP)

This Actor is an AI agent / MCP tool. Through the hosted [Apify MCP server](https://docs.apify.com/platform/integrations/mcp), Claude, Cursor, VS Code, ChatGPT or any MCP client can call it, read the input fields below as the tool's docs, and get the results as JSON.

- **This tool only:** `https://mcp.apify.com/?tools=j0l30/website-exposure-defense-knowledge`
- **All 5 Lycorax tools:** `https://mcp.apify.com/?tools=j0l30/shopify-seo-alt-text-fixer,j0l30/woocommerce-seo-alt-text-fixer,j0l30/website-image-seo-audit,j0l30/domain-rdap-dns-reputation-checker,j0l30/website-exposure-defense-knowledge`

Sign in with Apify (OAuth) when your client asks, or send the header `Authorization: Bearer <APIFY_TOKEN>`. Runs are billed to your Apify account at the prices in "How much does it cost?". The tool returns the run and its `datasetId`; the agent then reads the rows with `get-dataset-items`, which the server adds for you.

**Claude Desktop / claude.ai:** Settings → Connectors → Add custom connector → paste the URL as *Remote MCP server URL*.

**Claude Code:**

```bash
claude mcp add --transport http lycorax "https://mcp.apify.com/?tools=j0l30/website-exposure-defense-knowledge"
```

**Cursor** (`~/.cursor/mcp.json`, or `.cursor/mcp.json` in your project):

```json
{ "mcpServers": { "lycorax": { "url": "https://mcp.apify.com/?tools=j0l30/website-exposure-defense-knowledge" } } }
```

**VS Code** (`.vscode/mcp.json`):

```json
{ "servers": { "lycorax": { "type": "http", "url": "https://mcp.apify.com/?tools=j0l30/website-exposure-defense-knowledge" } } }
```

**ChatGPT** (Developer mode on): Settings → Apps & Connectors → Create → *MCP Server URL* = the URL, *Authentication* = OAuth. ChatGPT can't change a connector's tools later, so pick the one-tool or the all-tools URL first.

Swap in the all-tools URL to give your agent every Lycorax tool at once.

**Example prompts**

1. *"My .env file was indexed by a search engine on a site I own. What do I do in the first 15 minutes?"*
2. *"List the free catalog of sections, then fetch only the section on the exposed .git folder fix for my own site."*
3. *"Give me a defensive search-operator query set to audit what search engines show about my own domain example.com, and how to remove what I find."*

Defensive use only: it answers questions about sites you own or are authorized to test, and it never scans anything. Start with `mode: "catalog"` (free) to see the section ids.

**Output sample.** A real `catalog` item (free). `ask`, `unit`, `chapter` and `pack` return the same fields with the full Markdown in `content_markdown`, plus `license` and `publisher`.

```json
{"id": "ch2.01-the-scrub-loop", "chapter_id": "ch2", "chapter": "The SCRUB Loop and the Exposure Severity Score", "stage": "The method", "title": "The SCRUB Loop", "summary": "Five steps. Each one has a question it answers, and you do not skip ahead.", "tags": ["ci", "rotate", "removal"], "words": 278, "content_markdown": "(buy with mode=unit)"}
```

Other Lycorax tools: [Shopify Alt Text Generator](https://apify.com/j0l30/shopify-seo-alt-text-fixer) · [WooCommerce Alt Text Generator](https://apify.com/j0l30/woocommerce-seo-alt-text-fixer) · [Image SEO Checker for Any Website](https://apify.com/j0l30/website-image-seo-audit) · [Domain Reputation Checker](https://apify.com/j0l30/domain-rdap-dns-reputation-checker).

### What can this website exposure knowledge API do?

- **Answer a leak question in seconds.** Leaked `.env` file, exposed `.git` folder, public backup, indexed PDF with personal data, open admin panel, staging site, source maps, a secret pushed to GitHub, or a public cloud bucket.
- **Give your agent a step-by-step incident playbook.** Six time-boxed playbooks, starting with *the first 15 minutes after a leaked secret*.
- **Run a defensive self-audit.** Search operators ("dorks" for defense) that work across several search engines, plus an audit URL builder script.
- **Remove exposed files from search results and archives.** Service-by-service removal steps for search engines, web archives, caches, Common Crawl and AI crawlers.
- **Prevent the next leak.** Pre-commit secret scanning, push protection, CI checks, `X-Robots-Tag`, `security.txt` and canary tokens.
- **Know the law.** Authorisation rules, Moroccan law (Penal Code art. 607-3, Loi 09-08), and when the GDPR reaches you.

### Who is it for?

- **AI agents and MCP clients** (Claude, Cursor, ChatGPT, custom LangChain or CrewAI agents) that need trusted security knowledge instead of guessing.
- **Developers, DevOps and site owners** fixing a data leak or hardening a site before launch.
- **Agencies and freelancers** running monthly website exposure audits for clients.
- **Security and compliance teams** writing an incident runbook.

### How much does it cost?

Pay per event. You only pay for the content you get, and **platform usage is included**.

| Mode | What you get | Price |
|---|---|---|
| `catalog` | Every section id, title, summary and tags, plus a free agent `SKILL.md` | Free |
| `ask` | The 3 sections that best answer your question, in full with code | $0.10 per answer |
| `unit` | One section by id | $0.05 per section |
| `chapter` | A whole SCRUB stage (for example `ch6` Repair or `ch9` Playbooks) | $0.40 per chapter |
| `pack` | All 80 sections and `SKILL.md` | $3.00 one time |

### How to use it

1. Run `catalog` once (free) to see every section id.
2. Use `ask` with a plain question for a quick answer.
3. Use `unit` or `chapter` to fetch exactly what you need, or `pack` for a full audit.

#### Input example

```json
{ "mode": "ask", "query": "my .env file was indexed by search engines, what do I do first?" }
```

Other inputs: `{ "mode": "unit", "unitId": "ch2.01-the-scrub-loop" }` or `{ "mode": "chapter", "chapterId": "ch9" }`.

#### Output example

Each dataset item has `id`, `chapter_id`, `chapter`, `stage`, `title`, `summary`, `tags`, `content_markdown`, `code_blocks`, `references` and `license`.

```json
{
  "id": "ch9.01-playbook-1-the-first-15-minutes-after-a-leaked-env-or-secret",
  "chapter_id": "ch9",
  "chapter": "Time-boxed playbooks",
  "stage": "Under the clock",
  "title": "Playbook 1: the first 15 minutes after a leaked `.env` or secret",
  "summary": "Trigger. A secret file or value is reachable on a site you own, or you learn it was.",
  "tags": ["env", "secret", "bucket", "ci", "rotate"],
  "content_markdown": "..."
}
```

### What's inside: chapters

| Chapter | Topic |
|---|---|
| `ch1` | Your site is more public than you think |
| `ch2` | The SCRUB Loop and the Exposure Severity Score |
| `ch3` | Search: auditing what search engines hold |
| `ch4` | Where leaks outlive the fix: archives, caches, AI crawlers, repos, buckets, source maps, `.git`, staging subdomains |
| `ch5` | Classify: scoring what you found |
| `ch6` | Repair: rotate secrets, deny rules, framework notes |
| `ch7` | Unlist: purge every copy |
| `ch8` | Build guards: prevention and quiet watching |
| `ch9` | Six time-boxed incident playbooks |
| `ch10` | Four real leaks, one loop (case studies) |
| `ch11` | The law, your duty, and the Moroccan context |
| `appA`–`appD` | Templates, audit URL builder script, operator table, glossary |

### AI agents can pay here (x402, USDC)

Your agent doesn't need an Apify account, API key or credit card. With the [x402 protocol](https://docs.apify.com/integrations/x402), it pays in **USDC on Base or Solana** and runs this Actor by itself.

1. Give your agent the [Apify x402 skill](https://raw.githubusercontent.com/apify/awesome-skills/refs/heads/main/skills/apify-x402-agentic-wallet/SKILL.md) and a Coinbase Agentic Wallet with a little USDC (the minimum top-up is $1).
2. The agent buys a prepaid Apify token with one x402 payment. The token's balance is a hard spending cap.
3. It calls `https://api.apify.com/v2/acts/j0l30~website-exposure-defense-knowledge/run-sync-get-dataset-items` with that token and gets the sections back as JSON.

Start with the free `catalog`. A $1 balance covers about 10 `ask` answers at $0.10 each. Prepaid tokens expire 14 days after purchase, and unused balance isn't refunded. x402 on Apify is still experimental.

#### Agent-ready call example

```bash
curl -s -X POST -H "Authorization: Bearer $TOKEN" -H "Content-Type: application/json" \
  -d '{"mode":"ask","query":"exposed .git folder on my site, what now?"}' \
  "https://api.apify.com/v2/acts/j0l30~website-exposure-defense-knowledge/run-sync-get-dataset-items"
```

### FAQ

#### What should I do first if my .env file was indexed?

Rotate every secret in it before anything else, then block the file at the web server, then remove it from search engines and archives. Run `ask` with your situation, or fetch `ch9` for the full playbook.

#### How do I remove an exposed file from search results?

Fix it at the source first so it returns 404 or 410, then request removal from each search engine and archive. `ch7` covers each service step by step.

#### Can an AI agent pay for this without an Apify account?

Yes. Agents can pay with USDC through x402, buying a prepaid Apify token and then running this Actor with it. See "AI agents can pay here" above.

#### Does it include a dorks list for OSINT?

Yes, for defense. It has search operators that work across several search engines, an operator table and an audit URL builder script, so you can check what's exposed about your own sites. Each pattern comes with the fix, removal and prevention steps.

#### Is this a hacking tool?

No. It's **defensive only**. It teaches you to audit and fix domains, repos and buckets you own or have written permission to test. It doesn't scan or attack anything.

#### Does it store my questions?

No. There's no tracking and no third-party calls, and the publisher doesn't store your queries.

#### Can I train a model on it?

Not with this license. Runtime use is allowed; training or fine-tuning needs a separate Training License. Contact freejosephe@gmail.com.

### How it compares (honestly)

- **Exposure scanners:** a scanner probes your site for you. This Actor doesn't scan anything. It tells you what to look for and how to fix and remove it. Pair it with your own checks, or with the [Domain Reputation Checker](https://apify.com/j0l30/domain-rdap-dns-reputation-checker) for DNS and TLS hygiene.
- **Public dorks lists:** they're usually raw search operators with no next step. Here each search pattern sits next to the repair, removal and prevention steps, and it's limited to sites you own.
- **Asking a general chatbot:** answers come from a fixed, cited corpus (80 sections, 66 references), not generated text, so the same question returns the same sections.

### More tools from the same publisher

- [Shopify Alt Text Generator](https://apify.com/j0l30/shopify-seo-alt-text-fixer): bulk alt text audit and auto-fix for Shopify product images.
- [WooCommerce Alt Text Generator](https://apify.com/j0l30/woocommerce-seo-alt-text-fixer): the same for WooCommerce products and WordPress media, with a WP-CLI script.
- [Image SEO Checker for Any Website](https://apify.com/j0l30/website-image-seo-audit): image SEO and alt text checks on any CMS, with white-label PDF reports.
- [Domain Reputation Checker](https://apify.com/j0l30/domain-rdap-dns-reputation-checker): bulk RDAP lookup, DNS, SPF and DMARC checks and a risk score.

### License and rules

- **Defensive only.** Unauthorised access is a crime in Morocco (Penal Code art. 607-3 and following) and almost everywhere else.
- **License.** Runtime use only; no redistribution of the content.
- Not legal advice. Human readers can get the illustrated ebook at [ko-fi.com/lycorax](https://ko-fi.com/lycorax).

# Actor input Schema

## `mode` (type: `string`):

What you need: ask = answer a question with the 3 best sections ($0.10); catalog = free table of contents with every section id; unit = one section by id; chapter = one chapter by id; pack = the full knowledge pack. Start with catalog to see the ids. Example: ask

## `query` (type: `string`):

For mode=ask: a plain-language question about a site you own or are authorized to test. Example: my .env file was indexed, what do I do first?

## `unitId` (type: `string`):

For mode=unit: a section id from the catalog. Example: ch2.01-the-scrub-loop

## `chapterId` (type: `string`):

For mode=chapter: a chapter id from the catalog, such as ch6 (Repair) or ch9 (Playbooks). Example: ch9

## Actor input object example

```json
{
  "mode": "ask",
  "query": "leaked .env file what to do first"
}
```

# Actor output Schema

## `results` (type: `string`):

Dataset items with id, chapter, title, summary, tags and full Markdown content.

# API

You can run this Actor programmatically using our API. Below are code examples in JavaScript, Python, and CLI, as well as the OpenAPI specification and MCP server setup.

## JavaScript example

```javascript
import { ApifyClient } from 'apify-client';

// Initialize the ApifyClient with your Apify API token
// Replace the '<YOUR_API_TOKEN>' with your token
const client = new ApifyClient({
    token: '<YOUR_API_TOKEN>',
});

// Prepare Actor input
const input = {
    "query": "leaked .env file what to do first"
};

// Run the Actor and wait for it to finish
const run = await client.actor("j0l30/website-exposure-defense-knowledge").call(input);

// Fetch and print Actor results from the run's dataset (if any)
console.log('Results from dataset');
console.log(`💾 Check your data here: https://console.apify.com/storage/datasets/${run.defaultDatasetId}`);
const { items } = await client.dataset(run.defaultDatasetId).listItems();
items.forEach((item) => {
    console.dir(item);
});

// 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/js/docs

```

## Python example

```python
from apify_client import ApifyClient

# Initialize the ApifyClient with your Apify API token
# Replace '<YOUR_API_TOKEN>' with your token.
client = ApifyClient("<YOUR_API_TOKEN>")

# Prepare the Actor input
run_input = { "query": "leaked .env file what to do first" }

# Run the Actor and wait for it to finish
run = client.actor("j0l30/website-exposure-defense-knowledge").call(run_input=run_input)

# Fetch and print Actor results from the run's dataset (if there are any)
print(f"💾 Check your data here: https://console.apify.com/storage/datasets/{run.default_dataset_id}")
for item in client.dataset(run.default_dataset_id).iterate_items():
    print(item)

# 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/python/docs/quick-start

```

## CLI example

```bash
echo '{
  "query": "leaked .env file what to do first"
}' |
apify call j0l30/website-exposure-defense-knowledge --silent --output-dataset

```

## MCP server setup

```json
{
    "mcpServers": {
        "apify": {
            "type": "http",
            "url": "https://mcp.apify.com/?tools=fetch-actor-details,j0l30/website-exposure-defense-knowledge"
        }
    }
}
```

The hosted server signs you in with OAuth on first connect, so no API token belongs in this config. Clients without OAuth support can send an `Authorization: Bearer <APIFY_API_TOKEN>` header instead, using a token from API & Integrations in Apify Console (https://console.apify.com/settings/integrations).

## OpenAPI specification

Download the OpenAPI definition: https://api.apify.com/v2/actors/DN8Q3pOfcBkEtlX9L/builds/wenDcBM5c9cBp2bEM/openapi.json