Free check

What your domain shows a stranger

Send us a domain and we will read back what it already publishes to every visitor, in plain words, on one page. It costs nothing, it commits you to nothing, and you keep it whether or not we ever speak again.

What we look at

Only what a browser fetches on its own when somebody visits you. That is the whole method, and it is the reason we can do this for a company that has never heard of us.

• Your home page, requested once, as a visitor would.
• /.well-known/security.txt — the file whose entire purpose is to be fetched by strangers looking for somewhere to report a problem.
• Public DNS: your SPF and DMARC records, as published.
• The TLS certificate your server hands every visitor, and when it expires.
• The response headers that come back with your home page.

What we do not do

No port scan. No guessing at paths, files or subdomains. No payloads, no fuzzing, no attempt to authenticate, nothing sent that a browser would not send. We do not test systems we have no authorisation to test — that rule is the business we are in, not a disclaimer at the bottom of a page.

What example.com shows a stranger — 21 September 2026

Observed passively: the home page, the security.txt path, public DNS
records and the TLS certificate. Nothing was scanned, probed or tested.

- security.txt: not published. The request follows the redirect to the
  www host and ends in a 404, so someone outside the company who finds
  a problem has no published address to send it to.
- TLS certificate: Let's Encrypt, expires 30 September 2026 — nine days
  out. Most likely an automated renewal that has not run yet, but worth
  a glance.
- Email: SPF ends in ~all (soft fail); DMARC p=quarantine.
- Response headers missing on the home page: Referrer-Policy,
  Permissions-Policy.

The thing it usually finds

Nearly every time, the same line: no published address for someone outside the company who has found a problem. Not a policy failure — a plumbing one. The person who found it then decides what to do about it without you. Most do nothing. Some publish it. A few write to whoever they can find and are read as spam.

That gap we will also close at no cost: a page carrying your policy in your name, one line for your security.txt, and the triage behind it. Reports come to us, we read them, drop the noise, and pass on only what is real, with a first response to the reporter inside a window you set. The free disclosure programme explains it, and our own runs on the same intake so you can see it from the outside before asking for one.

Ask for yours

Put in a domain you are responsible for and where to send the result. The check runs while you wait and the report arrives by email, usually within a minute. You do not need an account, there is nothing to sign, and nobody will call you.

Prefer to ask a person? Write to founder@exceptionsecurity.com with the domain and we will run it and reply, usually the same day.

And if you ever want more than a front door

The snapshot is the smallest thing we do. The rest is private, invitation-only security testing, and the part worth your attention is not the promise — it is which of these are enforced by software rather than written in a contract you would have to police yourself.

• Nothing is touched until three things exist at once: a scope you named, a signed NDA, and a written testing authorisation. Each blocks on its own, and there is no override in the interface — an operator who wanted to skip one could not.
• Authorisation is re-checked on every single request, against that scope and those dates. A researcher acting outside either is refused by the platform, not reminded by a contract. When your window closes, access closes with it.
• Neither side sees the other. The researcher never learns which organisation they are working on; you never learn their legal identity. It is enforced in the data the platform returns. Someone who knows exactly which company is exposed, and for how long, is holding something over it — removing the identity removes the leverage.
• Every finding is validated and scored by our team. Each one carries working steps and a scored impact, not a scanner export.
• Nothing is published without your approval of the exact wording — no finding, no write-up, no mention of your organisation. That is a step in the software, not a clause.
• The record cannot be rewritten afterwards. Every consequential action lands in a hash-chained log where each entry carries a digest of the one before it, so nothing can be altered or removed without breaking the chain. It is verifiable on demand, and it constrains us exactly as much as it constrains anyone else.

You set the reward for each severity and pay only for a finding you accept. Reject one and it costs nothing. There is no subscription, setup fee, retainer or minimum, and if nothing is found there is nothing to pay. The full mechanism is in the architecture, and what a private bug bounty is sets out when it is the right answer.

When this is the wrong thing to buy

If you have no way to receive a report at all, start with the free disclosure programme instead — a front door has to exist before testing makes sense. If you have no capacity to fix what comes back, fix that first; findings you cannot act on are a liability, not an asset. And if you need a fixed scope assessed on a fixed date for a compliance deadline, commission a scheduled penetration test — this runs alongside that, and does not replace it.

We have no client logos to show you and we will not invent any. What we can offer instead is that everything above is checkable rather than believable: we run our own disclosure programme on the same intake a client gets, because a supplier who offers to receive your vulnerability reports and publishes no way to receive its own is asking you to take it on faith. Our security page also states what we do not claim, including that there is no reward programme for this platform today. If a snapshot is all you ever want from us, that is a good outcome too.