close
Skip to content
View croxsec's full-sized avatar

Block or report croxsec

Block user

Prevent this user from interacting with your repositories and sending you notifications. Learn more about blocking users.

You must be logged in to block users.

Content in all repositories owned by your account will be closed.
Maximum 250 characters. Please don’t include any personal information such as legal names or email addresses. This note will only be visible to you.
Report abuse

Contact GitHub support about this user’s behavior. Learn more about reporting abuse.

Report abuse
croxsec/README.md

CROX Sec

Passive external security audits for web agencies and SMBs. Zero access needed — we measure exactly what an unauthenticated observer can see, then hand you the fix list.

What we do

  • External posture audit — DNS (SPF/DMARC/CAA/MX), TLS versions, HTTPS redirects, HSTS, exposed admin paths. No scanning, no payloads, no risk to production.
  • Email anti-spoofing — from p=none to enforced quarantine/reject, with the reporting hooks to keep it that way.
  • 20-minute fixes — most findings close with a DNS record or a header, not a procurement cycle.

Proof over promises

We ran our own methodology against 84 web agencies in 14 countries and published everything: the study.

Headline numbers: 51% DMARC p=none · 67% no HSTS · 26% /wp-login.php public · 4% CAA.

Open source

  • domain-posture — the passive posture scanner we use (MIT, stdlib-only).

Contact

Popular repositories Loading

  1. domain-posture domain-posture Public

    Python

  2. croxsec croxsec Public

    Python