Your public footprint
We map what is reachable without a login across the agreed site, domain and subdomains, including publicly accessible services you may have forgotten.
Zybee Exposure Report
PHP2Shell was just the beginning:
Understand your website’s risks.
Know what to fix first.
The only defense against AI hackers is AI-enhanced cybersecurity
The Zybee Exposure Report examines what your website or web app reveals to the public. Human-reviewed findings, clear business implications, and practical next steps—not another list of unexplained alerts.
$249 USD Pay after delivery. No prepayment.
Delivered in 12–48 hours after acceptance. Get your report first. Pay after delivery. One-time payment, no subscription.
✓No logins or credentials needed✓No changes to your website✓Reviewed by a real person
Clarity before decisions
A working website can still put your business at risk.
An exposed credential, a forgotten backup, or an overly permissive service can put confidential information and operations at risk. These issues are not always visible to the people running the business.
We examine the publicly accessible parts of your website or application that you authorize us to review and turn what we find into a prioritized plan. This is a focused technical review—not an assessment of your entire business.
The outside-in review
What we check.
The agreed website, domain, and in-scope subdomains, as visible without signing in.
Exposed keys and credentials
Public frontend code can reveal API keys and credentials. We distinguish intended public identifiers from secrets and explain the evidence and risk.
Database exposure
We look for signs of public exposure in Supabase, Firebase, and connected services. No signing in, browsing customer records, or downloading your database.
Files that should not be public
Configuration files, backups, exports, and forgotten administration pages. Small deployment mistakes can reveal much more than intended.
Everyday protections
HTTPS, browser security headers, and publicly visible configuration. Practical checks for settings that are easy to miss.
Outdated components
When visible software versions suggest a known security issue, we flag the evidence and explain what needs a closer look. A version number alone is not proof that a vulnerability can be exploited.
No passwords. No source code access. No production changes.
A report you can act on
Evidence. Priorities. A practical plan.
Each finding explains what we saw, why it matters, and what to do next. We state limitations rather than filling the gaps with assumptions.
- 01Evidence you can follow
Where we observed the issue and the supporting evidence, with sensitive values redacted. Each finding is checked by a person.
- 02A sensible order of action
Fix now, fix soon, nice to have, or good to know—with the business implications and an estimate of the effort involved.
- 03A practical handoff
Clear fix instructions, a prompt for your AI coding tool or developer, and a one-page summary you can share with decision-makers.
Fix nowF-01 · ILLUSTRATIVE FINDING
A private API key is visible in your frontend code.
example.com /assets/app.js
What we saw
A public JavaScript bundle contains a credential intended for server-side use. Anyone who loads the site can inspect it. We did not use the key.
E-01 · PUBLIC CODE EXCERPT
service_api_key: [REDACTED]Illustrative example. No real credential shown.Why it matters
If the key is active, someone could abuse the access it grants or run up charges on your account. The impact depends on the permissions and limits attached to it.
Recommended fix · effort to be confirmed
Revoke the exposed key, issue a replacement, and move the service call to a server-side function. The effort depends on the integration; the report provides an estimate for the actual finding.
Fix prompt for your AI coding tool
Help me remove a private service API key from my frontend. Move calls that need it to an authenticated server-side function and store the replacement key in server-only environment variables. Revoke the exposed key with the provider. Review the function’s authorization and usage limits. Rebuild and verify the old and new secrets are absent from public assets. Do not print secrets or access customer data.
A second set of eyes. Clear boundaries.
Public and authorized only
Nothing behind a login. No use of your credentials, no exploitation, and no destructive tests.
Your systems stay unchanged
No code or database changes. No customer data downloads. Hands-on remediation is a separate service.
A focused review, not a security guarantee
No full penetration test, source code review, compliance certification, or assessment of the whole business. Questions that need deeper investigation are flagged for a separately agreed scope.
From request to next steps
Easy to start. Clear next steps.
01
Send your URL
Tell us which website or app to review and confirm ownership or permission. We confirm scope and price before starting.
02
We review from the outside
We examine publicly accessible areas and check findings by hand. If verification would require deeper access, we explain that limit.
03
Receive your report
Your report arrives by email in 12–48 hours after acceptance, with the invoice. You pay after delivery, by card or bank transfer. One-time payment, no subscription.
Human-reviewed means human-reviewed
“I personally review every report. And yes, you can reply to me.”
I’m Steffen. I check what your website exposes and turn the findings into practical next steps. You receive a report you can act on—not a scanner export with your name on it.
Steffen SteinFounder · Zybee Labs
Is this a full security assessment of my business?
No. This is a focused review of your website or web application’s public exposure. It does not assess internal systems, staff practices, or all business risks. It is not a full penetration test, authenticated test, source code review, or compliance certification.
Will you change anything or access customer data?
No. We do not change code, write to your database, use your credentials, or run destructive tests. We check publicly accessible areas without browsing customer records or downloading your database. When deeper access is needed to verify a concern, we say so rather than cross that boundary.
Does my website need to use AI or a specific platform?
No. The report is for publicly accessible websites and web apps, regardless of how they were built. You can give the fix instructions to your developer or use them with tools such as Lovable, Replit, Cursor or Claude.
What if you find nothing urgent?
You still receive a report showing what we checked, what we observed, and any limitations. We do not manufacture findings. A report with no urgent findings is useful, but it is not a guarantee that your website has no vulnerabilities.
What does it cost, and how do I pay?
The report is $249 USD, one-time. We confirm your price before starting. Get your report first and pay after delivery by card or bank transfer. One-time payment, no subscription.
When will I receive the report?
Within 12–48 hours after we accept your request.
Can you help fix the findings?
Your report includes fix instructions, an effort estimate, and a prompt for your AI coding tool or developer. Hands-on remediation is separate and agreed independently. Reply to the report email to discuss the next step.
A clear next step
Make your next security decision an informed one.
Get a focused outside-in review of your website or web app, with a clear list of what to fix first.
$249 USD
One-time paymentNo subscription.
- Send your website URL.
We confirm the scope and price before starting.
- Get your report first.
Pay after delivery by card or bank transfer. One-time payment, no subscription.
- Get your exposure report.
Delivered by email in 12–48 hours after we accept your request.
Public, outside-in checks only. No credentials, code changes, or data downloads.
Zybee Exposure Report
Start with your website URL.
Share a few details to send your request.
Your request is on its way.
We sent a confirmation to .
Request ID:
We confirm acceptance and scope by email. Your report follows within 12–48 hours of acceptance, together with the invoice.
Prefer a conversation? hello@zybee.ai