What an attacker sees of your site in thirty seconds

In January 2023, T-Mobile announced that a third party had obtained data from about 37 million customer accounts. The method: a technical interface (an API) that was answering requests it should not have served. The fact is confirmed by the carrier itself in its official filing with the US stock market regulator (source: T-Mobile SEC 8-K filing, January 19, 2023; Krebs on Security).

An API is an application's service entrance: the channel through which the site talks to its database. When this door answers without checking who is knocking, it hands the data down the line.

Reconnaissance always precedes the attack

Nobody attacks blind. An intruder's first step is not to get in: it is to look. In a few seconds, and without forcing anything, a third party can read an amount of information you would not suspect:

• the technologies running your site and their versions,
• the technical addresses (APIs, endpoints) your pages call in the background,
• configuration files left accessible by mistake,
• forgotten subdomains, often less monitored than the main site.

None of this is illegal or sophisticated. It is observation. But it is from this map that the next steps are decided.

Why it is the first thing to look at

Your exposed surface is the only part of your security that is visible from the outside, so the only part you share with the attacker. The good news is that it can be measured. You can draw the same map they would, before them, and close what does not need to be open: a version that reveals a known flaw, an overly talkative API, a configuration file left in open access.

What I recommend

The free test draws this surface map and gives you an immediate score: it is the starting point, the one that shows you what a third party already sees. The commissioned audit goes further and tests what the scan cannot see: the real behavior of your APIs and your access controls once put under pressure.