None of the findings from the tools mentioned here would break your site: your landing loads without security headers, an unpublished DMARC record, or a permissive CORS rule; that’s exactly why they get missed.
Today, Hackal Run includes four free checks you can point at your own site, no account or email needed. They are deliberately shallow, read-only, and polite. Four tools is only the starting set with more to come.
Run a check now.The first four checks
Security headers: Sends one request and reads returned headers: Strict-Transport-Security, Content-Security-Policy, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy, and the Secure, HttpOnly, and SameSite flags on cookies you set.
Email authentication: Looks up SPF, DMARC at _dmarc.yourdomain, MX records, and DKIM at a short list of common selectors. DKIM detection is best effort, because selectors are chosen by your mail provider.
CORS configuration: The most technical of the four, and the only one that does not apply to every site. It is worth running if yours serves an API, or if your frontend calls a backend on another origin. Sends a normal request and a preflight with probe origins, to your site root and a list of common API, account, and session paths. It looks for an Access-Control-Allow-Origin that names whichever site made the request, an allowlist that can be fooled by a lookalike domain, a wildcard combined with credentials, acceptance of the null origin, and a preflight more permissive than the plain response.
Exposed paths. Checks a fixed list of paths that are commonly left readable by accident: version control directories, environment and configuration files, database dumps and archives, server information pages, directory listings, and framework debug output. Every finding relies on a content signature, not just a status code.
Try it on a domain you own
Each tool takes a domain in the URL, so you can link straight to the tool with the domain prefilled:
https://hackal.run/headers/example.com
https://hackal.run/email/example.com
https://hackal.run/cors/example.com
https://hackal.run/exposed/example.com
What “shallow” actually means
The exposed paths check is the one people ask about, so here’s exactly what it does: It requests a randomly generated path first, to learn how your site answers a non-existent URL (plenty of sites return a 200 or 403 in lieu of a 404).
Then it requests a fixed list of paths, once each, and reports a finding only when the response both differs from the learned baseline and matches a content signature. A .env counts only if the body actually looks like environment variables. A backup.zip counts only if the bytes are a zip archive. /admin/ returning 403 on a site where every unknown path returns 403 tells us nothing, so we report nothing.
The list is a constant. There is no fuzzing, no enumeration, and no brute forcing. At the time of writing, the tools don’t probe vulnerabilities and don’t send anything but a GET. The CORS check reads response headers only, never response bodies, and sends no cookies or credentials, so a path like /api/users tells us how your server answers publicly but nothing about who your users are.
Every run is rate limited, request capped, and time bounded, and any one domain can only be checked so often.
What it does not do
Hackal Run is a spot check, not an audit. The tools don’t crawl your site, test authenticated areas, or look at anything below the surface. There’s also no data retention and findings are not logged.
When a result states nothing was found, read that as “nothing was found at the paths we tried.” The tools say so themselves: every exposed paths and CORS result ends with a note stating exactly what was checked.
That honesty is the point: A confident false negative is worse than no finding at all.
More checks are coming
Four simple tools is only where Hackal Run starts. The fifth is decided by you. A new check has to be passive, visible from the outside and answerable in one pass.
Is there a spot check that you’d like to see us automate? Tell us! hackal.io/contact
Where the platform comes in
The free checks answer the question “is anything obviously wrong today”. The Hackal platform continuously monitors rather than glance, across exposure detection, script integrity monitoring, domain threat detection, attack resistance testing, passive DAST, and TLS assessment, with findings turned into prioritized, plain-English fixes.
Get notified when the platform launches.Notes
Run these against sites you own or are authorized to test.
Some domains and TLDs are out of scope by policy, including government domains and major consumer mail providers. Email abuse@hackal.io if you’d like your domain to be barred from the free tools.
Found something wrong, or a result you think is a false positive? Let us know at hackal.io/contact.