osec.one: security tools for small and medium sites

Passwordless sign-in, captcha, bot gate, login protection, uptime and certificate monitoring, header scans, CSP reports and signup checks. No DNS move and no proxy in front of your site: paste a snippet or call the API. A security brand of Biz59 LLC, New York.

Tools

• osec Auth: Passwordless logins: email code, Google and Apple. Add sign-in to any site or app without storing a single password, and without setting up Google or Apple OAuth yourself.
• osec Scan: Security headers + TLS grade, A+ to F, with fixes. Paste a URL and get a grade for HTTPS, HSTS, CSP, clickjacking, cookies, TLS versions and certificate health, plus exposed admin, VPN and file-transfer login pages (MOVEit, GoAnywhere, Citrix, Fortinet...), with copy-paste nginx and Apache fixes.
• osec Monitor: Uptime, SSL certificate and domain expiry alerts. Certificates now expire within 200 days, and soon within 47. osec Monitor checks your site, your certificate and your domain registration, and emails you before anything lapses.
• osec CSP Reports: Know when an unknown script runs on your pages. Point your Content-Security-Policy reports at osec.one. We group them and email you when a new script or domain shows up: often the first sign of a card skimmer.
• osec Signup Checks: Breached-password and throwaway-email API. One API call tells you if a password is in a known breach (k-anonymity, we never see it) and if an email is disposable, has no mail server or is a role address.
• osec Login Protection: Rate limits and IP / domain rules for osec Auth. Sign-in rules that know about emails and codes, not just IPs: per-email and per-IP code limits per hour, wrong-code limits, IP allow and deny lists, allowed email domains and disposable-email blocking. No DNS move.
• osec Captcha: Invisible, private captcha. A drop-in reCAPTCHA swap. reCAPTCHA's free tier dropped to 10,000 checks a month. osec Captcha makes the visitor's browser solve a small proof-of-work puzzle instead: no image puzzles, no tracking cookies, no Google.
• osec Bot Gate: Slow down AI scrapers and bad bots without Cloudflare. A small middleware for your own server: visitors solve one invisible proof-of-work check, then browse freely for a week. Search engines pass. No DNS move, no proxy in front of your site.
• osec Fingerprint Lite: Visitor IDs for small sites, without the enterprise price. One script tag gives each browser a stable visitor ID, with no cookies. Use it for free-trial limits, bot hints and fraud checks. 500 identifications a day free; credits when you grow.
• Email security check: SPF, DMARC, DKIM, MTA-STS and BIMI for any domain. Enter a domain and see whether anyone can send mail as it. SPF, DMARC, DKIM, MTA-STS and TLS-RPT are checked against the rules Gmail and Yahoo enforce, with the exact DNS records to fix each gap.
• SSL & headers check: Certificate, TLS versions and security headers in one pass. Enter a domain to check its certificate (trust, chain, hostname, expiry, key and signature), TLS 1.0 to 1.3, CAA, the HTTPS redirect, HSTS and the security headers browsers act on, with nginx and Apache fixes.
• Pinned download: A SHA-256 and a verify-then-run snippet for any install script. Paste the public URL of an install script or binary that your pipeline or docs fetch with curl. Get its SHA-256 and a ready snippet for shell, GitHub Actions, GitLab CI or a Dockerfile that downloads the file, checks the hash and only then runs it.
• Action pin lookup: Commit SHAs for the GitHub Actions your workflows use. Paste the uses: lines from your GitHub workflows. Get each action pinned to the commit its tag points at today, as uses: owner/action@<sha> # v4.2.2 lines ready to paste, with a flag on branches and on version tags that have moved.
• Workflow risk check: Find the GitHub workflow patterns behind tj-actions and Ultralytics. Paste a public GitHub repository. We read its .github/workflows files and composite actions (action.yml) and flag pull_request_target jobs that run a pull request's code, outsider-controlled text and action inputs pasted into run: scripts, tokens with more rights than the job needs and actions not pinned to a commit, each with the fix to paste.

Live in three steps

1. Sign in with an email code, Google or Apple. The console opens.
2. Add a project (for sign-in) or a site key (for captcha, CSP reports, checks, bot gate).
3. Copy the snippet for your stack and paste it into your site.

Docs · Alternatives to reCAPTCHA and Cloudflare · Security and data

Case analyses and field notes

• Pin every GitHub Action to a commit in two minutes with the osec Action pin lookup: A uses: line with @v4 follows a tag that can be moved to other code, which is how tj-actions/changed-files leaked secrets in 2025. Paste your uses: lines into osec's free Action pin lookup, read the flags, paste back commit SHAs with version comments, and let Dependabot keep them current.
• Stop piping curl into a shell: pin an install script in two minutes: curl | sh runs whatever the server sends that day. Paste the install URL into osec's free Pinned download check, read the notes, and copy a download-verify-run snippet for shell, GitHub Actions, GitLab CI or a Dockerfile. Plus what to do when the hash changes.
• Dropbox Sign 2024: one automated service account opened the customer database: In April 2024 an intruder used a back-end service account of Dropbox Sign (formerly HelloSign) to reach data on every user: email addresses, plus hashed passwords, API keys, OAuth tokens and MFA details for some. No person's login was involved. Why non-human accounts end up with broad rights, how Dropbox Sign contained it, and a least-privilege checklist for the service accounts a small SaaS runs.
• CircleCI 2023: a session cookie from an engineer's laptop, and every customer told to rotate every secret: On 4 January 2023 CircleCI told every customer to rotate every secret they had stored there. Malware on one engineer's laptop had taken a single sign-on session that had already passed 2FA; the intruder used it to reach production, took customers' environment variables and keys, and the keys that decrypted them. What a CI provider holds for you, how the breach went step by step, and how to make your own rotate-everything day hours instead of weeks.
• SolarWinds 2020: the build server that added a backdoor to a signed update: In 2020 a small program on SolarWinds' build server swapped one source file while Orion was being compiled, so the signed update carried the SUNBURST backdoor to about 18,000 customers. The source code in the repository stayed clean. How SUNSPOT worked, how SUNBURST waited two weeks and hid in normal traffic, how FireEye found it from one extra MFA phone, and what build integrity means for a small software shop.
• 0ktapus 2022: text-message phishing that collected Okta logins and codes at Twilio, and why Cloudflare's security keys held: In summer 2022 the same text message reached staff at more than 130 companies and sent them to a copy of their Okta sign-in page. At Twilio, staff typed passwords and one-time codes and the attacker reached 209 customers, Signal and Okta users among them. At Cloudflare, three staff typed their password too, and hardware security keys refused the fake domain. Step by step, and the cheap way a small team gets the same result.
• Most "AI crawlers" on our server were fake: 14 days of nginx logs checked against the published IP lists: 63,603 requests called themselves GPTBot, ClaudeBot, PerplexityBot, Googlebot and friends over 14 days. 80% came from addresses the companies don't use, and most asked for .env files, .git/config and Terraform state. The numbers per name, what the fakes wanted, and how to check your own logs.
• Storm-0558 2023: one stolen signing key, forged sign-in tokens for 25 organisations' mail: In 2023 a China-based group signed its own Microsoft sign-in tokens with a consumer key from 2016, and Exchange Online accepted them for government and enterprise mailboxes. No password was guessed and no MFA prompt appeared. It was caught by the US State Department, reading an audit log that most customers didn't have because it cost extra. What a signing key is, why 'which key may sign for whom' matters, and which logs a small tenant should keep.
• Kaseya VSA 2021: one IT management tool, about 1,500 businesses encrypted in a weekend: On Friday 2 July 2021, REvil used unpatched flaws in Kaseya's on-premises VSA servers to send a fake 'hot-fix' to every PC those servers managed. About 60 IT providers and up to 1,500 of their small-business clients were encrypted before the holiday weekend began. How the push worked step by step, why the remote-management agent was the perfect delivery system, and the questions a small firm should ask the IT provider that holds admin on every machine.
• CitrixBleed 2 (2025): the same kind of memory leak two years later, and what changed in the response: In June 2025 a NetScaler gateway login request with one bare field, 'login' with no value, returned bytes of the device's memory, and with them other users' session tokens. It was the 2023 Citrix Bleed story again. Attacks began within days of the patch, the vendor said for weeks it had seen none, and the session-kill commands it published missed most session types. A side-by-side of 2023 and 2025, and the runbook a gateway owner needs before the third one.
• Is your own site showing visitors a fake CAPTCHA? What a ClickFix injection looks like from the owner's side: Thousands of hacked WordPress sites now greet visitors with a fake 'verify you are human' box that copies a PowerShell command and asks them to press Win+R. The owner usually never sees it. How the script gets in, the three signs osec Scan's clipboard-lure check looks for, what a finding and a 'have a look' mean, and the clean-up steps.
• Citrix Bleed 2023: session tokens leaked from the gateway, and why patching didn't log attackers out: CVE-2023-4966 let anyone ask a NetScaler gateway for its OpenID settings with an oversized Host header and get back memory holding live session cookies: no password, no MFA. LockBit affiliates used it against Boeing's distribution arm, and 35.9 million Xfinity customers were exposed. Why patched boxes stayed compromised until sessions were killed, and what that means for any login gateway, including your app's.