We have launched Surface Check, a free tool that shows you what your domain exposes to the public internet. Enter a domain and, in about thirty seconds, you get a plain-language snapshot of your external security, with every finding scored by severity and by how much effort it takes to fix. It is passive and read-only: it looks only at what is already public, never inside your app, and nothing you enter is stored.
Why we built it
Most founders cannot easily see what their own domain already gives away. Attackers can. Before anyone breaks into anything, they look at the outside: can they send email that appears to come from you, is your site forcing encryption, does a server quietly advertise the exact software version it runs. None of that requires touching your application, and all of it shapes how easy you are to target.
We wanted to put that same outside view in your hands for free, and to score it the way we score a full paid review, so the value is clear before you ever talk to us. It fits how we work: find the weaknesses, say plainly what they are, and tell you exactly what to fix first.
What it looks at
Surface Check runs a set of passive checks across a few areas:
- Email spoofing and delivery. Whether you publish SPF, DMARC, DKIM and MTA-STS, the records that stop someone sending phishing email as your domain and stop mail sent to you being intercepted.
- Transport security. Whether your site forces HTTPS, tells browsers to stay on it (HSTS), and whether your TLS certificate is valid and not about to expire.
- Browser protections. The response headers that defend your visitors: a Content-Security-Policy, clickjacking (framing) protection, and content-type sniffing protection.
- Housekeeping and best practice. CAA records, a security.txt contact for reporting issues, protective flags on cookies, and whether your server is broadcasting its exact software version.
Every finding comes with a severity, a fix-effort estimate, and the fix, in plain language. We even run it on our own domain and link to the result, so you can see we hold ourselves to the same standard.
How it fits with a full review
Surface Check is the outside view: your public surface. A full Secvura review goes deeper, into the application itself and the systems behind it, which is where issues like broken access control and the gaps AI coding tools tend to miss live. The free check is a genuinely useful first look; it is not a substitute for that deeper work.
If we do go further together, remediation stays on your terms: we prepare the fixes and hand them to your team to review and deploy, or apply them directly where you have authorised us to do so in writing.
Try it
Run it on your own domain now: Surface Check. It is free, takes about thirty seconds, and there is nothing to install.
If you would like the deeper review that goes beyond the public surface, get in touch through our website and we will respond within one working day.