What we find, and what it means

Notes from the work: findings we keep seeing, fixes that hold up, and the reasoning behind how this product decides what counts as a risk.

1 article matching

Tagged subdomain-takeover · clear

In 2023 a marketing team pointed a subdomain at a cloud app. In 2024 the app was deleted. The DNS record wasn't. In 2026, a stranger claimed it.

Aug 28, 2026

Talk to us.

Questions about what the engine checks, whether it fits your estate, or what it deliberately refuses to do. A person reads every message.

01You writePlain form, no qualifying call, no obligation. The marketing checkbox is optional and unticked.

02A person reads itMessages land with the team, not a queue-bot. Nothing is auto-replied.

03You get an answerTo the address you gave — including “this product is not the right fit”, when that is the honest answer.

Prefer email?

Reporting a vulnerability?

Read the disclosure policy first — it tells you what is in scope and what to expect.