Cloud Security Recon

Passive cloud posture check for Azure, AWS, GCP, Vercel, Netlify, and 8 more platforms. Detects Kudu exposure, S3 leaks, preview deploys, service account secrets, and WAF quality. No credentials. No login.

Target Domain or URL

I confirm I have permission to scan this domain.

What this tool checks

Azure:Kudu/SCM exposure, /.auth/me, staging slots, Blob containers

AWS:S3 bucket public listing, API Gateway stage disclosure

GCP:Service account emails, Firebase config, GCS buckets

Vercel:Preview deploy exposure, /.vercel/ paths, NEXT_PUBLIC_ secrets

Netlify:/.netlify/functions/ and Identity endpoint exposure

Cloudflare:Pages/Workers detection, WAF quality assessment

Railway / Render / Fly:Health endpoint info disclosure

All platforms:WAF quality rating: none / CDN-only / WAF-basic / WAF-premium

What the Cloud Security Recon tool does

Cloud Security Recon is a passive, unauthenticated scanner for websites hosted in the cloud. It fingerprints which platform serves a site (Azure, AWS, Google Cloud, Vercel, Netlify, Cloudflare, Railway, Render, Fly and others), rates its WAF or CDN protection, and probes a short list of platform-specific locations that are commonly left exposed, such as Azure Kudu consoles, public storage buckets and preview deployments.

Every probe is an ordinary HTTP request sent from Protego, the same kind of request any visitor could make. The tool never logs in, never guesses passwords and never asks for cloud credentials, so it shows what your cloud footprint looks like to an outsider.

How to use it

Enter a domain or URL. If you leave out https://, it is added for you.
Tick the box confirming you have permission to scan the domain. Only scan sites you own or are authorized to test.
Click Cloud Scan. Most scans finish within a minute, and the page stops waiting after 48 seconds if the target is slow or unreachable.
Read the Provider Fingerprint (platform, WAF or CDN, WAF quality) first, then the findings list, which shows the exact endpoint behind each issue.

Without an account you can run 20 scans per day. Signed-in users get 60 per day.

What the findings mean

Critical: fix today

Publicly listable storage (an S3 bucket, Azure Blob container or Google Cloud Storage bucket) or a reachable Azure Kudu/SCM console. Anyone can enumerate your files or reach admin tooling, so block public access or require Entra ID sign-in right away.

High: fix this week

Endpoints that answer without authentication, such as Azure /.auth/me or the App Service log stream, Netlify functions returning HTTP 200, or Google Cloud service account emails visible in page source.

Medium, low and info

Public preview deployments and staging slots, NEXT_PUBLIC_ values or a Firebase config in the HTML, and health endpoints. These leak information rather than grant access. Confirm each one is intentional.

WAF quality and the grade

WAF quality reads none, CDN only, WAF basic or WAF premium. CDN only means caching without application-layer filtering. The score starts at 100 and drops per finding. A clean result only covers what is visible from outside: identity, network rules and account settings need an authenticated review.

Frequently Asked Questions

Is it safe and legal to scan a site with this tool?

The scan is passive: it sends a small number of normal HTTP requests and does not attempt logins, exploits or brute forcing. Even so, only scan domains you own or have written permission to test, which is why the tool asks you to confirm before every scan.

Do I need to give the tool cloud credentials?

No. Cloud Security Recon works only with what is publicly reachable on the internet. It cannot see your IAM roles, network security groups or subscription settings. For those, use an authenticated posture tool such as Microsoft Defender for Cloud or AWS Security Hub.

Why did my scan fail or return no grade?

If the target times out, blocks automated requests, or returns a response that cannot be read, the tool reports an error instead of guessing. A missing grade means the posture could not be assessed, not that the site passed. Try again later or scan the exact hostname that serves the application.