From the 2MNY engineering team

Security Blog

Vulnerability analysis, hardening guides, and lessons from scanning 28,691 websites.

All AI & LLM Security 1 API Security 2 Attack Surface 3 DNS Security 2 HTTP Headers 1 Monitoring 2 OWASP 4 Product Updates 6 Small Business 1 SSL/TLS 1 Supply Chain Security 2 Threat Intelligence 2 Website Security 7 WordPress Security 1

Supply Chain Security

Your Package Manifests Are a Supply-Chain Gift to Attackers

Dependency scanners usually run where the code is built. But when the manifests themselves ship to the web root, anyone can download your exact dependency inventory — name, version, architecture — and match it against public vulnerability databases at their leisure. Here's what leaks per ecosystem, and how a free scan turns the same data into your defense.

2MNY Admin • Oct 13, 2026 • 5 min read

Attack Surface

Your Exposed .git Directory Is a Source-Code Fire Sale: What Attackers Actually Pull From It

Most teams treat an exposed /.git/ directory as a cosmetic misconfiguration. It is worse: with the config, index, HEAD and reflog readable, an attacker can enumerate your tracked files, your remotes, your commit timeline — and reconstruct the repository byte-for-byte offline. Here is what each file actually leaks, and how to prove (not guess) whether yours is exposed.

2MNY Admin • Oct 13, 2026 • 5 min read

Website Security

Stack Traces Are Free Reconnaissance: What Your Error Pages Teach Attackers

Every production stack trace is a miniature architecture document: framework, version, absolute file paths, class names, database driver, sometimes the query. Attackers harvest error pages on purpose. Here's what each framework's leak looks like, which debug endpoints make it worse, and how detection works without sending a single malicious payload.

2MNY Admin • Oct 13, 2026 • 4 min read

API Security

API Gateway Admin Planes: One GET Away From Total Takeover

An API gateway sits in front of everything and holds the keys to all of it: routes, upstream services, API keys, rate limits. When its admin plane answers an unauthenticated GET on a management port, attackers read your entire routing table — and on several gateways, rewrite it. Here's the 15-probe matrix we run and what each exposed plane really means.

2MNY Admin • Oct 13, 2026 • 4 min read

Website Security

Web Cache Deception: When Your CDN Caches a Stranger's Account Page

A victim clicks a link to /account/settings/style.css. The router normalizes the unknown suffix and serves the real account page — but the cache layer, keying on .css, stores the personalized response for everyone. Minutes later the attacker fetches the same URL and receives the victim's cached page. Here's how the attack works, how we prove it safely, and the three-layer defense.

2MNY Admin • Oct 13, 2026 • 4 min read

DNS Security

The Complete Email Authentication Audit: SPF, DKIM, DMARC, MTA-STS, TLS-RPT and BIMI

Email spoofing is not one setting — it's a chain of six DNS records, and the weakest link decides whether anyone can send mail as you. Most checkers verify three of them. The complete audit covers SPF syntax depth, DMARC policy strength, eleven DKIM selectors, MTA-STS enforcement, TLS-RPT reporting and BIMI — here's how each verdict is reached.

2MNY Admin • Oct 13, 2026 • 5 min read

Website Security

CSV Formula Injection: The Spreadsheet That Opens a Command Prompt

Your export endpoint writes user-controlled strings into CSV cells. When a cell starts with =, @, +, -, or a tab, Excel and friends treat it as code — and a crafted cell can chain DDE into a command prompt on the analyst's machine. Here's the two-sided detection: planted formula cells already present, and the reflection vector that lets attackers plant them — proven without sending a single formula.

2MNY Admin • Oct 13, 2026 • 4 min read

Product Updates

Live Secret Verification: Why Finding a Leaked API Key Is Only Half the Answer

A key-shaped string in your JavaScript might be a live credential — or a rotated fossil your team already killed last quarter. 2MNY now live-verifies detected secrets against their issuing provider with read-only checks, so reports tell you which keys actually work.

2MNY Admin • Oct 12, 2026 • 7 min read

Threat Intelligence

Ransomware Leak-Site Tracker: See Who's Being Named, and Check Your Own Domain

Modern ransomware is double extortion: steal data, then name the victim on a dark-web leak site with a countdown to publication. Our new free tracker maps these claims worldwide — and every 2MNY scan now checks your domain against the dataset automatically.

2MNY Admin • Oct 12, 2026 • 6 min read

Put the reading to work

Run a free scan and see which of the issues we write about are live on your website right now.

Start Free Scan