📡 Threat Pulse
Real detections from real BreachHunter scans, refreshed every 5 minutes and fully anonymized. Don't take our word for it — watch.
Last hour · LIVE
0
vulnerabilities detected
0
scans run
0
grade bands seen
No threats detected in this window — that's the point.
Last 24 hours · LIVE
0
vulnerabilities detected
0
scans run
0
grade bands seen
No threats detected in this window — that's the point.
Last 7 days · LIVE
0
vulnerabilities detected
0
scans run
0
grade bands seen
No threats detected in this window — that's the point.
Last all time · LIVE
37
vulnerabilities detected
4
scans run
1
grade bands seen
Top exposure classes
| Exposure class | Detections | Learn |
|---|---|---|
| Security header misconfiguration | 22 | how it's stopped → |
| Other exposure | 11 | how it's stopped → |
| Technology fingerprint exposure | 4 | how it's stopped → |
Latest detections
- Security header misconfiguration detected 9 d ago — how it's stopped →
- Security header misconfiguration detected 9 d ago — how it's stopped →
- Security header misconfiguration detected 9 d ago — how it's stopped →
- Security header misconfiguration detected 9 d ago — how it's stopped →
- Security header misconfiguration detected 9 d ago — how it's stopped →
- Security header misconfiguration detected 9 d ago — how it's stopped →
- Technology fingerprint exposure detected 9 d ago — how it's stopped →
- Security header misconfiguration detected 10 d ago — how it's stopped →
Methodology: what this feed shows — and what it hides
Shown: aggregate counts of completed scans, the distribution of 0–100 grades, counts of findings grouped into fixed exposure classes (e.g. "TLS/SSL misconfiguration", "Ghost file in web archive"), and the most recent detections as relative times ("12 min ago"). Every number is a direct COUNT(*) over real scan rows. The feed refreshes every 5 minutes; it carries the "LIVE" badge only when its data is 5 minutes old or less, otherwise it shows its actual refresh age.
Hidden — deliberately: which sites were scanned (no target names, not even truncated), which customer scanned them (no workspace or account identifiers), scan language, exact timestamps, file paths, URLs, evidence excerpts, and IP addresses. An exposure class seen in fewer than three customers' scans is bucketed as "Other exposure" so it can never identify anyone.
Why: customers scan their own sites. A transparency feed must never leak them — aggregate, anonymized, or quiet. When nothing happened, we say so: no synthesized activity, no inflated counts.
Every detection links to the guide that explains the defense. Browse all guides →