Hey Product Hunt! 👋

I’m Kiran Mondal, the creator of TriScout v2.4 TAC-OPS—an on-demand, ethical passive cybersecurity reconnaissance console and CLI toolkit.

💡 Why I built TriScout

While deploying my own web applications, I noticed a frustrating gap in security tooling: most vulnerability scanners are either invasive enterprise suites that trigger WAF blocks, or simple header checkers that miss real-world source leaks. I wanted a fast, zero-intrusion tool that developers and SecOps teams could run safely to see what their public attack surface actually looks like from the outside.

⚡ What TriScout v2.4 TAC-OPS does

* 12-Point Passive Security & DOM Audit: Evaluates HTTP security headers (HSTS, CSP, X-Frame-Options, MIME Sniffing, Referrer-Policy, Permissions-Policy), cookie security flags (HttpOnly, Secure), and scrapes the public DOM for insecure form actions and server fingerprinting—all without sending a single intrusive payload.

* Real-Time Credential & Stack Trace Leak Detection: Scans public page sources for accidentally exposed API keys (OpenAI, AWS, GitHub PATs, Google Cloud, Stripe, Private RSA keys) and raw SQL/stack trace leaks.

* Strict Ethical Guardrails: Built-in DNS resolution checks automatically block scans against private IP ranges, loopback addresses, and internal networks.

* Multi-Tenant Security by Design: Powered by Neon Serverless PostgreSQL with Row-Level Security (RLS) so every operator's scan history is cryptographically isolated at the database layer, paired with Token Bucket rate limiting (5 OTPs/min), Email 2FA OTP, and GitHub OAuth.

* Web HUD + Global NPM CLI: Use the interactive TAC-OPS command center in your browser, or run audits directly in your terminal and CI/CD pipelines via our CLI tool (npx @kiran-mondal/triscout).

* Automated Reporting: Export posture grades (0–100) and full vulnerability ledgers to PDF, JSON, CSV, or dispatch alerts directly via SMTP relay.

🛠️ Under the Hood

TriScout is built on a hybrid serverless architecture on Vercel combining Node.js, Go, and Python microservices with Neon PostgreSQL (RLS).

💬 I’d love your feedback!

Try running a passive audit on one of your own domains at https://triscout.quarry.dpdns.org and let me know:

* What security score did your site get?

* What additional passive checks or CI/CD integrations would you like to see in v2.5?

I’ll be hanging out in the comments all day to answer questions, talk cybersecurity architecture, and hear your thoughts. Thank you so much for yo

ur support! 🚀🛡️