PocketBase Security Audit - Find Open API Rules Free

Audit any Appwrite project (cloud or self-hosted) for collections with over-permissive document-level permissions, public reads, and anonymous writes. Active anon fetch confirms live leaks. HTML report with paste-ready fix snippets. Free. -- By Renzo Madueno, https://rotatepilot.com

Probes a public Directus instance for misconfigured Public-role permissions. Detects collections readable without auth via /items/{collection}. Returns counts + curl reproducer. Counts only. -- By Renzo Madueno, https://rotatepilot.com

Static analyzer for firestore.rules + live anonymous probe. Detects 'if true' wide-open rules, expired test-mode, auth-only patterns, open storage. HTML report with paste-ready fix snippets. Free demo mode if you don't have rules handy. -- By Renzo Madueno, https://rotatepilot.com

Probes a public PocketBase instance for misconfigured collection rules. Detects collections readable without auth via /api/collections/*/records. Returns counts + curl reproducer. Counts only, no data exfiltrated. -- By Renzo Madueno, https://rotatepilot.com

Website Tech Stack Detector — 100+ Technologies

ryanclinton/website-tech-stack-detector

Identify the technologies, frameworks, and services running on any website. Website Tech Stack Detector crawls one or more URLs, inspects HTTP headers, HTML meta tags, script sources, and body content, then matches them against a fingerprint database of 106 web technologies across 17 categories.

Neuromorphic Threat Intelligence MCP Server

ryanclinton/neuromorphic-threat-intelligence-mcp

MCP intelligence server for neuromorphic threat intelligence detection and analysis.

👥 LinkedIn Groups Scraper - Members & Posts [NO COOKIES] ✅

unseenuser/LinkedIn-Groups-Scraper

Extract members, posts, and discussions from any public LinkedIn Group. Identify niche professional communities and build hyper-targeted lead lists by group affiliation. No login, no cookies, no Chrome extension. Bulk-process multiple groups. Built for B2B marketers and recruiters.

Bulk tech stack detection from any website. Uses OSS Wappalyzer fingerprint rulesets (6000+ technologies across 100+ categories) via HTTP analysis. Replaces the paywalled Wappalyzer API.

SEC Insider Trading Tracker — Form 4 API

ryanclinton/sec-insider-trading

Real-time SEC Form 4 API for behavioural insider-trading signal classification. Detects officer cluster buys, executive disposals, regime shifts. Suppresses compensation noise. Deterministic JSON output for hedge funds, compliance, and AI-agent workflows. No API key needed.

Probes a public Supabase project for Row-Level-Security misconfigurations. Detects tables readable by the anon key — the #1 cause of Supabase data leaks. Returns row counts + a curl reproducer per finding. Counts only, no row data exfiltrated. -- By Renzo Madueno, https://rotatepilot.com

Google Maps Scraper

poidata/google-maps-scraper

Quickly extract data from thousands of locations. Scrape Google Maps using keywords, categories, coordinates or GeoJSON polygons. Collect rich business data including addresses, contacts, opening hours, ratings, and more. Export results in multiple formats, run via API and integrate seamlessly.