Frontend Secret Exposure Scanner

Probes a public Supabase project for Row-Level-Security misconfigurations. Detects tables readable by the anon key — the #1 cause of Supabase data leaks. Returns row counts + a curl reproducer per finding. Counts only, no row data exfiltrated. -- By Renzo Madueno, https://rotatepilot.com

Subdomain Intelligence OSINT Scanner & Monitor

thescrapelab/subdomain-intelligence-osint

Subdomain finder and OSINT exposure monitor for authorized domains. Discover subdomains, validate DNS, classify live/auth-gated/DNS-only assets, detect technologies and providers, monitor changes, and generate reports.

IaC Security Misconfiguration Scanner API

kazkn/hosted-iac-policy-scan-api

Scan Terraform, Kubernetes, Dockerfile, Helm, CloudFormation, and 15 more Infrastructure-as-Code formats for security misconfigurations. Submit a GitHub repository or ZIP and get normalized Checkov findings plus an automation-ready JSON summary. Start your first scan now. No runner to maintain.

NF Vulnerability Scanner — All-in-One Website Security Audit

nativefoundation-inc/vuln-scan-actor

The most comprehensive all-in-one website vulnerability scanner on Apify. Multi-engine security testing — active scanning, CVE detection, server misconfig checks, plus SPF/DMARC email-spoofing checks and leaked-secret scanning. Structured JSON report with severities and priority grades.

Joins the official NVD CVE API 2.0, the CISA Known Exploited Vulnerabilities catalog and FIRST EPSS into one deduplicated, risk-prioritized vulnerability record with incremental change tracking and durable cross-run state.

Probes a public Strapi instance for misconfigured Public role permissions. Detects content-types readable without auth via /api/{collection}. Returns counts + curl reproducer. Counts only. -- By Renzo Madueno, https://rotatepilot.com

JWT Decoder & Security Analyzer

perryay/jwt-decoder-analyzer

Decode JWT tokens, verify HMAC/RSA/ECDSA/EdDSA signatures, detect alg=none bypass, key confusion, weak secrets, and expired tokens. Batch processing and audit report generation for DevSecOps teams.

Discover which 120+ sites an email address is registered on (LinkedIn, Twitter, Spotify, Pinterest, Imgur, and more) using the open-source holehe tool. No password-reset emails sent to target. For authorized OSINT and security research.

LinkedIn Search Jobs Scraper

api-empire/linkedin-search-jobs-scraper

LinkedIn Search Jobs Scraper extracts job listings from any LinkedIn search query. Capture titles, companies, locations, descriptions, salaries, and posting dates. Ideal for market research, hiring, lead generation, and workflows needing structured LinkedIn job search data.