🚀 Strapi Security Scanner - Find Public Leaks

Probes a public Directus instance for misconfigured Public-role permissions. Detects collections readable without auth via /items/{collection}. Returns counts + curl reproducer. Counts only.

Probes a public PocketBase instance for misconfigured collection rules. Detects collections readable without auth via /api/collections/*/records. Returns counts + curl reproducer. Counts only, no data exfiltrated.

Strapi Programmatic Pages Generator

ales_wilk/strapi-programmatic-pages-generator

Automate bulk programmatic page creation in Strapi CMS using JSON definitions stored in Apify Key-Value Store. Configure your Strapi credentials, point to your Key-Value Store, and let the Actor handle the rest.

Probes a public Nhost project's Hasura GraphQL endpoint for tables readable by anon role. Detects the #1 cause of Nhost data leaks: forgotten Hasura permission policies. Returns table-level counts + curl reproducer. Counts only.

Supabase RLS security scanner. Probes a public Supabase project for Row-Level-Security misconfigurations and detects tables readable by the anon key - the #1 cause of Supabase data leaks. Returns row counts + a curl reproducer per finding. Counts only, no row data exfiltrated. By Renzo Madueno.

Probes a public Payload CMS instance for collections readable without auth. Default templates leave read access wide open during development.

Probes a public Convex deployment for queries that return data without auth. Convex queries are public-by-default unless you check auth inside the handler. Returns counts + reproducer.

Probes a public Hasura GraphQL endpoint for tables readable by the anon role. Works for self-hosted, Hasura Cloud, and frameworks on top. Counts only.

Website AI Content & Data Leakage Scanner

glowing_glove/website-ai-content-data-leakage-scanner

Find public AI-readable content exposure, sensitive document links, open indexes, sitemap leaks, llms.txt hints, and risky crawl surfaces.

WordPress security scanner. Probes the WordPress REST API for endpoints leaking users, plugins, drafts and customer data - the misconfigurations attackers enumerate before a brute-force. 40% of the web runs WordPress. Counts only, no data exfiltrated. Fix guidance included. By Renzo Madueno.