Orb44 Journal
Notes on perimeter, CDN leaks, and what the street sees.
The Cloudflare IllusionWe scanned 100 Product Hunt startups from the outside. 11% had confirmed high-severity exposures. ~20% show signals a security engineer would flag as critical.
- How to Check If Your Website Admin Panel Is Exposed to the Internet
Admin panels left publicly accessible are a top attack target. Here's how to detect exposed admin paths before attackers do.
- Exposed .env File: What It Leaks and How to Check
A publicly accessible .env file hands attackers database passwords, API keys, and secret tokens in plaintext. Here's what's at risk and how to detect it.
- How to Check If Your Cloudflare Origin Is Exposed
Running behind Cloudflare doesn't automatically hide your origin. Here's a systematic checklist to verify whether your origin IP is discoverable.
- MCP Server Security: What It Exposes and How to Check
MCP servers often run exposed without authentication. Learn what Model Context Protocol endpoints leak, how to fingerprint them, and how to lock them down.
- MCP Tool Poisoning: How Attackers Abuse Exposed MCP Servers
Tool poisoning injects malicious instructions into MCP tool definitions. Learn how the attack works, why unauthenticated MCP access enables it, and how to detect it.
- OpenAI and Anthropic API Keys Exposed in JavaScript
AI API keys embedded in client-side JavaScript grant full account access. How keys leak through bundlers, what attackers can do, and how to fix it.
- MCP Server Exposed to the Internet: Attack Surface Analysis
A public MCP server is an unauthenticated RPC endpoint with file access, SSRF, and credential exposure. Full attack surface breakdown and remediation checklist.
- AI Agent Security: What Gets Exposed When You Deploy an AI Agent
Deploying an AI agent creates new attack surface: public endpoints, exposed system prompts, leaked API keys, and overprivileged tool access. Here's what to audit.
- Third-party JavaScript security: how supply-chain attacks work
Third-party scripts run with full DOM access on your site. One compromised CDN or npm package can skim cards from every visitor. Here's exactly how it happens.
- WordPress XML-RPC: why it's still a security risk in 2026
WordPress XML-RPC enables credential brute-force at scale via multicall and DDoS via pingbacks. How to check if it's enabled and block it properly.
- Cloudflare DNS-Only vs Proxied: Security Implications
Cloudflare's orange cloud vs grey cloud isn't just about CDN. DNS-only records expose your origin IP and bypass all of Cloudflare's security controls.
- WordPress admin username exposure via wp-json REST API
WordPress REST API exposes admin usernames at /wp-json/wp/v2/users by default. Attackers use this for targeted brute-force. Here's how to detect and stop it.
- WooCommerce guest order enumeration: product catalog and order exposure
WooCommerce's REST API can expose order data and product catalogs without authentication. Guest checkout orders are especially easy to enumerate.
- Shopify products.json and collections.json: what bypasses the password page
Shopify's password page doesn't protect JSON endpoints. /products.json, /collections.json, and /search.json remain public. Here's what that means for your store.
- Shopify security audit checklist: what to check before going live
An 8-point Shopify security checklist: JSON endpoints, App Proxy exposure, checkout script integrity, admin 2FA, API scopes, webhooks, and theme JS.
- How to Find the Origin IP Behind Cloudflare
Cloudflare hides your server's IP only if every DNS record goes through the proxy. Here are the real methods used to find the origin IP behind it.
- Exposed .git Directory: Risk and Detection
An accessible .git directory allows full source code reconstruction from a web server. Learn the risk, how to detect it, and how to block it.
AI keys in public JS: someone else burns your quotask- and sk-ant- on the storefront are a bill, not a config. One-minute check.
Webhook on the storefront: where the widget postsA callback in public JS is not a breach — until a token sits in the URL. One-minute check.
Cloudflare is on, but the site still goes down. How to check bypassYou paid for a shield and the panel is green — yet hits reach the server. Often the side door is still open.
Google ads rejected or Chrome says “dangerous site”. What to check firstPeople usually search the symptom, not “pentest”: ads fail, browser warns, mail lands in spam. Here is a quick outside check.
PushEngage: check after the CDN leakIn June 2026 Awesome Motive CDN scripts were tampered with. PushEngage was in the same incident. Plain explanation and a one-minute homepage check.
- TrustPulse: same CDN leak as OptinMonster
June 2026 Awesome Motive CDN tampering also hit TrustPulse. What happened and how to check the homepage.
bootcdn and staticfile: same story as polyfill — how to checkNot only polyfill.io. bootcdn, bootcss and staticfile showed up in the same reports. If they are still on your site, remove them and re-check.
Are you still loading polyfill.io? Check in a minuteIn 2024 the CDN changed hands and the script turned bad. Many sites still embed it. Plain story and a homepage check.
News says a CDN is bad. How do you check your site quickly?On those days people do not want long guides. They want a short page: paste the domain, see if it hits you.
Quiet from the outside. Are extra doors still open on the server?An outside-only view can lie. You also need the server next to it. In Orb44 that is one card: street view and machine pulse.
Protection looks on. Can hits still reach the server?You pay for a website shield. If the real server address is still open, traffic can go around it. One plain question.
How your site looks from the outside — in a few minutesNot a long audit and not a hundred-line dump. A clear picture: shield, open doors, checkout, blocklists — and what you can do today.
- OptinMonster CDN leak — are you still pulling it?
June 2026: Sansec found tampered OptinMonster / TrustPulse / PushEngage scripts on Awesome Motive CDNs. Enter your domain — we check whether the storefront still loads those hosts.
