Directus Security Scanner — Find public-role collection leaks

Probes a public Strapi instance for misconfigured Public role permissions. Detects content-types readable without auth via /api/{collection}. Returns counts + curl reproducer. Counts only. -- By Renzo Madueno, https://rotatepilot.com

Probes a public PocketBase instance for misconfigured collection rules. Detects collections readable without auth via /api/collections/*/records. Returns counts + curl reproducer. Counts only, no data exfiltrated. -- By Renzo Madueno, https://rotatepilot.com

Probes a public Payload CMS instance for collections readable without auth. Default templates leave read access wide open during development. -- By Renzo Madueno, https://rotatepilot.com

Probes a public Supabase project for Row-Level-Security misconfigurations. Detects tables readable by the anon key — the #1 cause of Supabase data leaks. Returns row counts + a curl reproducer per finding. Counts only, no row data exfiltrated. -- By Renzo Madueno, https://rotatepilot.com

Probes a public Nhost project's Hasura GraphQL endpoint for tables readable by anon role. Detects the #1 cause of Nhost data leaks: forgotten Hasura permission policies. Returns table-level counts + curl reproducer. Counts only. -- By Renzo Madueno, https://rotatepilot.com

Probes a public Convex deployment for queries that return data without auth. Convex queries are public-by-default unless you check auth inside the handler. Returns counts + reproducer. -- By Renzo Madueno, https://rotatepilot.com

Probes a public Hasura GraphQL endpoint for tables readable by the anon role. Works for self-hosted, Hasura Cloud, and frameworks on top. Counts only. -- By Renzo Madueno, https://rotatepilot.com

YouTube Channel & Video Scraper - Stats, Views, Trending

renzomacar/youtube-scraper

Extract data from YouTube channels and individual videos. Get subscriber counts, video titles, view counts, like counts, comment counts, publish dates, descriptions, tags, and thumbnails. Ideal for influencer research, content ana -- By Renzo Madueno, https://rotatepilot.com/cadet-programs-2026

TikTok Profile, Hashtag & Video Scraper - Views, Likes, Music

renzomacar/tiktok-scraper

Scrape TikTok profiles and video posts. Extract follower counts, total likes, video descriptions, view counts, comment counts, share counts, hashtags, and music info. Supports profile and hashtag-based scraping for influencer mark -- By Renzo Madueno, https://rotatepilot.com/cadet-programs-2026

Email & Contact Finder - Emails, Phones, Tech Stack

renzomacar/website-contact-finder

Crawl any website to find email addresses, phone numbers, and social media profiles. Smart crawling prioritizes contact, about, and team pages for fast results. Also detects tech stack. Perfect for B2B lead generation and sales outreach. -- By Renzo Madueno, https://rotatepilot.com