VulnStrike | ExpoStacker

LIVE PRODUCT

vulnstrike.expostacker.com.br/

live preview

VulnStrike — your site's security grade in 30 seconds

Use now Architecture

Tech stack: Next.js 15 React 19 TypeScript Supabase Cloudflare Workers Tailwind

50+
Checks: ~30s
Free scan: A+–F
Clear grade

Client

VulnStrike

Sector

Cybersecurity — SaaS / Defensive security

Timeline

Produto lançado · Set 2026

Live product

Use now

Results

Client-reported results during rollout

50+ Verificações por scan

~30 s Tempo do scan grátis

0 Dependências de servidor

Client-reported data

The challenge

VulnStrike answers the question every site owner has and no tool answers in plain language: "is my site exposed?" The answer comes as a school grade — A+ to F — with each problem explained and the fix beside it.

DASTs enterprise (Acunetix, Nessus) custam caro e falam inglês técnico; ferramentas gratuitas exigem conhecimento de segurança para interpretar. O dono de site comum não sabe nem se os headers básicos estão configurados. O desafio: transformar dezenas de verificações técnicas em uma nota compreensível, com instrução de correção em português.

The approach

The solution splits scanning into two levels with an authorization boundary: the public scan is 100% passive — it only reads what any visitor already sees (headers, DNS, public HTML, public certificates). The deep scan, which probes sensitive files like /.env and /.git/HEAD, requires proof of ownership via .well-known file or DNS TXT. On top of that: a critical-infrastructure blacklist (government, banks, healthcare), an anti-SSRF guard that resolves DNS and blocks private IPs before any request, and per-IP rate limiting on the anonymous scan.

The solution

The product covers the full security cycle of a site:

Anonymous free scan on the homepage — passive, no signup, result in ~30s
A+–F grade with Observatory-style score and per-severity breakdown
Deep scan with ownership verification (.well-known file or DNS TXT)
26 sensitive files probed: .env, .git/HEAD, SQL dumps, SSH keys, actuator, backups
Full DNS: SPF, DMARC, MX, CAA — policy analyzed, not just presence
Public shareable report link — revocable at any time
Printable PDF with white-label option for agencies
Scheduled scans (daily/weekly) with new-vulnerability alerts
Before/after comparison between scans of the same domain
Mercado Pago billing (Pix/card) with webhook and automatic activation
14-day Pro trial without card + automatic expiry lifecycle
Critical-infrastructure blacklist + SSRF guard — scan only what's yours
Lab verification engine: validated 16-phase pipeline — proven SQLi with evidence, not just alerts
Authenticated scan with captured session — automatically diffs what only shows up logged in
Deep SPA extraction: internal routes, JS bundles, GraphQL operations and cross-host APIs

Timeline

Como o projeto foi conduzido, do mapeamento ao deploy. How the project was conducted, from mapping to deploy.

Methodology

Como o projeto foi conduzido, do mapeamento ao deploy. How the project was conducted, from mapping to deploy.

Repositioning: offensive framework → defensive SaaS (exploit modules removed from the public surface)

Edge scanner: passive checks (headers/DNS/certificates) + deep scan with verification

Anti-abuse by design: critical-infrastructure blacklist, SSRF guard, per-IP rate limit

Observatory-style scoring: per-severity penalty + good-practice bonuses

Mercado Pago billing with HMAC webhook and automatic 14-day trial

Cyan/radar AI-generated identity (11 assets) + dogfooding its own security headers

Validation: full production journey — signup, scan, public report, verified deep scan

Architecture

→ Next.js 15 + React 19 with OpenNext running on Cloudflare Workers
→ Scanner pipeline: DNS-over-HTTPS + crt.sh (Certificate Transparency) for domain recon
→ Dedicated Supabase with RLS — each scan isolated per tenant
→ Technical report with score, finding prioritization and evidence
→ Mercado Pago for per-scan billing; Resend + Turnstile for email and anti-bot

Conceptual diagram — does not reflect real implementation

Tech stack

Technical choices and what was left out.

Decision log

What I chose, what I rejected, and why.

100% passive public scan, deep scan behind verification

Why: Probing /.env and /.git on any domain without proof of ownership is offensive reconnaissance — unsellable and ethically wrong. The authorization boundary is what separates a defensive tool from a weapon.

Rejected alternatives: Free deep scan with disclaimer (rejected — a disclaimer doesn't prevent abuse); passive-only with no deep tier (rejected — loses the product's real value).

A+–F grade instead of a raw findings list

Why: The audience isn't the pentester — it's the site owner. A school grade communicates urgency instantly and creates the metric the customer wants to improve ("I got a D, I want an A").

Rejected alternatives: Pure 0-100 score (rejected — less intuitive); findings list only (rejected — no progress narrative).

Mandatory SSRF guard before any fetch

Why: A scanner accepting any target can be abused to map internal networks — 169.254.169.254, 10.x, localhost. The scan resolves DNS first and aborts if the IP is private/metadata.

Rejected alternatives: Blocking only IP strings (rejected — DNS can point a public domain at an internal IP); trusting input (rejected — classic SSRF).

Edge (Workers) instead of a server for the scanner

Why: Each check is an independent HTTP GET — perfect for parallel fetch at the edge. Workers free's 50-subrequest limit forced curation: 26 highest-value files instead of hundreds.

Rejected alternatives: Traditional Node server (rejected — cost and deploy); Cloudflare Queue for async scans (roadmap — for even deeper scans).

Proof engine separate from the edge scanner

Why: Competitors report 'possible vulnerability'. We prove it: the lab engine runs the full pipeline (16 phases — crawler, fuzzing, evidence-backed SQLi, authenticated extraction) and only reports what's confirmable. That's what backs the 'verified findings' marketing.

Rejected alternatives: Passive-only edge scan (rejected — no differentiation from Mozilla Observatory); sqlmap directly on client (rejected — needs a backend worker, not edge).

Security and access

Defense by design

Anonymous public scan = passive checks only (headers, DNS, public HTML)
Deep scan requires proof of ownership (.well-known file or DNS TXT)
Critical-infrastructure blacklist: government, banks, healthcare, education, private IPs
SSRF guard: resolves DNS and blocks private/metadata IPs before any fetch
Per-IP rate limit (3 scans/day) + Turnstile when configured
RLS on all tables; service role server-only; HttpOnly+Secure+SameSite cookies
The site itself answers with HSTS, CSP, X-Frame-Options, nosniff — dogfooding

Lessons learned

Not everything went as planned.

— The ethical boundary is the most important feature: what separates a commercial scanner from an attack tool is exactly where it refuses to go. And at the edge, the subrequest limit is the architecture — 26 curated checks beat 200 generic ones.

StackPost

StackPost — API Unificada de Redes Sociais

API unificada de redes sociais multi-tenant com 19 integrações, 114 endpoints REST, OAuth centralizado, agendamento, analytics e comentários.

View case →

Nexus IA

Nexus IA — Plataforma de IA

Plataforma de IA com 620+ endpoints REST, Nexus Auto com roteamento automático entre 20+ modelos, workspace com agente autônomo, multimodal e 6 planos comerciais.

View case →