Sample data
Get started

Fictional organization. Nothing here is scanned and no AI is called.

Northstar Sample Co.

Open issues
4
Hosts
7
Websites
3
Verified domains
1 of 3

Open issues

View all

Domains

  • example.com

    With subdomainsIncomplete

    Approved, 26d left

  • example.net

    Exact domain

    Awaiting DNS

    Add this TXT record at your DNS provider, then check it.

    Type
    TXT
    Name
    _agathasec-verification.example.net
    Value
    agathasec-verification=sample-only-not-a-real-token
    Expires in 20h

  • example.org

    Exact domain

    Expired 5 Oct

Findings

  • Grafana lets anyone read server fileshighgrafana.example.com/

    The sample Grafana website lets someone read a server file without signing in.

    How to fix

    Upgrade Grafana to a supported patched version and restrict who can reach it.

    This file-read vulnerability is listed in the saved CISA known-exploited catalog. The finding does not prove anyone attacked this system.

    CVE-2021-43798EPSS 88.5%, 2026-10-07Known exploitedSeen 8 Oct, 14:00 UTC

    Scan incomplete. Other issues may remain.

    Grafana v8.x - Arbitrary File Read check. Sample explanation.

    Evidence
    Tool
    nuclei 3.11.1, fixed check (sample)
    Recorded
    8 Oct, 14:00 UTC
    HTTP status
    200
    root:x:0:0:root:/root:/bin/sh
# Fictional response
  • Environment file is publichighwww.example.com/.env~

    A backup configuration file is publicly accessible on the sample website.

    How to fix

    Remove the backup from the web root, block configuration file access and rotate exposed credentials.

    A visitor could read application settings and credentials stored in the file.

    Seen 8 Oct, 14:00 UTC

    Scan incomplete. Other issues may remain.

    Generic Env File Disclosure check. Sample explanation.

    Evidence
    Tool
    nuclei 3.11.1, AI follow-up (sample)
    Recorded
    8 Oct, 14:00 UTC
    HTTP status
    200
    DATABASE_URL=[REDACTED]
API_TOKEN=[REDACTED]
  • Git repository is exposedmediumwww.example.com/.git/config

    The sample website exposes its Git repository configuration.

    How to fix

    Exclude the .git directory from deployments and block public access to it.

    Repository details can help a visitor locate source code or discover embedded credentials.

    Seen 8 Oct, 14:00 UTC

    Scan incomplete. Other issues may remain.

    Git Configuration - Detect check. Sample explanation.

    Evidence
    Tool
    nuclei 3.11.1, fixed check (sample)
    Recorded
    8 Oct, 14:00 UTC
    HTTP status
    200
    [core]
repositoryformatversion = [REDACTED]
[remote "origin"]
url = [REDACTED]
  • Internal metrics are publicmediumwww.example.com/api/metrics

    Internal monitoring metrics are readable without signing in on the sample website.

    How to fix

    Require authentication or make this endpoint reachable only by monitoring servers.

    Metrics can reveal service names and operating details that should stay inside the monitoring system.

    Seen 8 Oct, 14:00 UTC

    Scan incomplete. Other issues may remain.

    Prometheus Metrics - Detect check. Sample explanation.

    Evidence
    Tool
    nuclei 3.11.1, fixed check (sample)
    Recorded
    8 Oct, 14:00 UTC
    HTTP status
    200
    # HELP process_cpu_seconds_total Sample CPU use
# TYPE process_cpu_seconds_total counter
process_cpu_seconds_total 42

Scans

  • example.com

    8 Oct, 14:04, with subdomains

    Incomplete

    7 hosts3 websites1 private, not contacted

    Details

    Not everything was checked. Missing results don’t mean these hosts are safe.

    • some websites were outside the two-website pilot limit
    DNS proof rechecked
    8 Oct, 14:00 UTC
    Checks and probes
    20
    HTTP requests
    22
    AI spend reserved
    $0.023

Assets

  • api.example.com192.0.2.12200 Northstar
  • grafana.example.com192.0.2.11200 Grafana
  • internal.example.com10.0.0.25Private, not contacted
  • mail.example.com192.0.2.20No website
  • old.example.com—No address
  • vpn.example.com192.0.2.21No website
  • www.example.com192.0.2.10200 Northstar
Checks and limits
  • Environment file is publichigh
  • Git repository is exposedmedium
  • Internal metrics are publicmedium
  • Grafana lets anyone read server fileshigh
Per website
20 checks, 32 requests
Per scan
40 checks, 64 requests, 15 min, $0.10 AI
Pilot
Up to 2 websites per scan