Skip to main content
Search tells you what is exposed. The guides in this section measure it for one organization: a risk score with benchmarks, an inventory of its internet-facing hosts, a full external assessment, its exposed code, and a report you can hand to people who do not use the API. Every call acts on the organization your API key belongs to. These features do more than read. You start scans and assessments, generate and schedule reports, and choose the competitor domains you compare against.

​
Where to go

Risk and exposure

A risk score from 0 to 100, where higher means riskier, built from nine factors. Read leak statistics, weekly trends and a peer benchmark, and compare against up to 5 competitor domains.

Infra search

Passively list the hosts, IPv4 addresses, open ports and known CVEs under a domain. The dashboard calls it Attack Surface Discovery.

Attack Surface

Run a full or targeted assessment of a domain and follow its progress. Then generate, brand and download the assessment report, or read its data.

Code exposure

Search GitHub, GitLab, Gists, Postman and Google for keywords tied to the organization, such as acme.com, and find the contributors behind exposed code.

Reports

Compare the leaked credentials found across a set of domains, on demand or every month, and download the report as a ZIP file.

​
Which one fits

In the dashboard, Infra search is Exposure → Attack Surface Discovery, Attack Surface is Exposure → Risk Assessments, and credential comparison reports live under Exposure → Credential Reports.

​
What each feature uses

Each guide states its own refusals. Plans and quotas explains plan features, allowances and slots, and every API-key request also counts toward the limits in Rate limits. Want new findings pushed to you instead of pulling them? Set up monitors.

​
Endpoints

Each feature starts with one of these calls. Its guide lists the rest.