· 1 min read · 0 views · 0 reactions
Recon for Builders: The Attacker's First Hour
What an attacker learns about your startup in the first hour, and the cheap fixes that make that hour boring.
Philips ADEPOJU · ayomide.co- Security
Placeholder post. Replace it with your own writing, or delete this file.
Every startup has an attack surface long before it has a security team. Here is what the first hour of recon usually finds, and how to make it boring.
Subdomains and forgotten services
Certificate transparency logs list every certificate you have ever issued. Staging servers, old admin panels and test APIs show up there.
# List subdomains from certificate transparency logs
curl -s "https://crt.sh/?q=%25.example.com&output=json" \
| jq -r '.[].name_value' | sort -u
Secrets in public code
Search your public repositories, and your team's personal ones, for keys that slipped in.
// Never ship this to the browser
const stripe = new Stripe(process.env.STRIPE_SECRET_KEY!);
The cheap fixes
- Put staging behind authentication.
- Rotate any key that was ever committed, even briefly.
- Add a
security.txtso researchers can reach you.
None of this needs a big budget. It needs an afternoon and the habit of looking at your company the way an attacker does.