A quick guide to protecting your live site with Hacker Buddy

1. Sign up. Pick a plan under Get Hacker Buddy and send the sign-up email. We reply with your setup steps.

2. Add your domain and prove it's yours. Tell us which domain you want tested. We send you a DNS record to add, which shows that you control it. Testing starts only after that check passes.

Type   Name          Value
TXT    yourapp.com   hackerbuddy-verify=your-code

3. Hacker Buddy maps what's exposed. It finds the subdomains, services, and pages that can be reached from the internet, including the ones you may have forgotten about.

4. It tests like an attacker. Hacker Buddy looks for the weaknesses attackers go after: exposed admin pages and files, software with known vulnerabilities, weak encryption and security settings, and common web application flaws. Tests are designed to be non-destructive.

5. Read the report. Each finding has a severity, where it is, how it could be exploited, and how to fix it. The report is grouped into four categories, each with a score out of 5: Exposure, Software, Configuration, and Encryption.

HIGH  Admin login open to the internet
      yourapp.com/admin
      Anyone can reach the sign-in page, and it
      allows unlimited password guesses.
      Fix: restrict access or add two-factor
      sign-in.

MED   Outdated web server
      api.yourapp.com
      The version in use has a published
      vulnerability.
      Fix: update to the latest release.

2 findings · exposure 1.5 · software 3
configuration 4 · encryption 4.5

6. Get alerted when something changes. Hacker Buddy keeps testing. When a deploy opens something up, or a newly published vulnerability affects software you run, it emails you as soon as it finds the problem.

Subject: yourapp.com is at risk

A vulnerability published today affects the
web server on api.yourapp.com.
Fix: update to the latest release.

7. Fix and re-test. Once you've made a fix, Hacker Buddy tests again and tells you whether the hole is really closed.

8. Manage your plan. To add or remove a domain, switch between monthly and yearly, or cancel, email hi@hackerbuddy.example from the address you signed up with.

* Hacker Buddy only tests domains you have proved you control.
* Tests are real requests to your live site, so they will show up in your logs.
* Testing lowers risk; it doesn't prove your site is free of vulnerabilities.