A couple of weeks ago I posted about scanning 22 startups and finding React2Shell on a live production app. That scared me enough to keep going.
I pointed AttackerView at 3,369 startup domains. Took about two weeks. Here's what came back.
The numbers
58% had at least one failing security check. That's not "you should probably fix this someday." That's a real check, failing, right now.
40% had something medium-severity or higher, meaning a motivated person could actually exploit it.
135 domains (4%) had a high or critical finding.
The ones that kept me awake at night
.env files in the open (2 domains)
Two startups had their .env file accessible from the public internet. If you don't know what that is: it's where your app stores its secrets. Database passwords, API keys, credentials for Stripe or AWS or whatever else you use. These two had all of that sitting at a predictable URL. Anyone who thought to check would have found it.
.git folders in the open (5 domains)
Five had their entire git history downloadable. Every commit, every code change, including credentials that were "deleted" but still exist in the history if you know how to look. Which isn't hard.
CORS wide open (45+ domains)
CORS controls which other domains your app will share data with. 45 startups had a version of this broken where subdomains could bypass the rules entirely. 11 had it set to allow any origin with credentials, which means any page on the internet could silently make authenticated requests to their app. 8 more were reflecting back whatever origin asked, same result.
The rest
173 weren't redirecting to HTTPS at all. On a shared wifi network, everything their users do is readable.
11 trusted whatever Host header they received. That's how you get poisoned password-reset links.
I covered session cookie flags and source maps in my last post so I won't repeat that, but those showed up here too. A lot.
What I did about it
I built AttackerView as a side project, nights and weekends, while working my normal job. No funding, no team. A lot of people helped me get here though. Friends who broke the early builds on purpose. Colleagues who shared my launch post. People who sent me feedback at weird hours.
Every check in this post runs on AttackerView. Type a domain on attackerview.com to run them on your own app. New accounts get a 14-day trial, no credit card.