Security Documentation

Getting Started

Learn what StackShield does and how to get up and running in minutes.

Security Checks

Create and manage domain checks with customizable security tests.

Scans & Results

Run scans, understand results, and review individual test findings.

Issues & Tracking

Track, resolve, and export security issues across your domains.

Notifications

Configure email, Slack, Teams, and webhook alerts for your team.

Scheduling

Set up automated recurring scans on hourly, daily, weekly, or monthly schedules.

Teams & Settings

Manage team members, roles, and account settings.

Billing & Plans

Understand plans, features, usage limits, and manage your subscription.

CI/CD Integration

Trigger scans from GitHub Actions, GitLab CI, and any CI/CD pipeline.

Checks if Laravel Ignition error page is exposed in production.

Checks if Laravel Telescope debugging tool is exposed in production.

Checks if Laravel debug mode is enabled in production.

Verifies CSRF token implementation on forms and APIs.

Tests file upload endpoints for security vulnerabilities.

Validates session security settings and configuration.

Scans web servers for dangerous files, outdated software, and misconfigurations using Nikto. Requires domain verification.

Automated SQL injection detection and testing using SQLMap. Requires domain verification.

Identifies web technologies, frameworks, and their versions for vulnerability assessment using WhatWeb.

Scans WordPress sites for vulnerable plugins, themes, and core version issues using WPScan.

Scans web applications for XSS, XXE, SSRF, and other OWASP vulnerabilities using Wapiti. Requires domain verification.

Detects missing headers (CSP, HSTS, X-Frame-Options).

Checks SSL expiration, weak ciphers, and HSTS.

Detects public AWS S3, GCP, and DigitalOcean buckets.

Comprehensive network and port scanning with service version detection using Nmap.

Checks if the domain IP is listed in abuse databases.

Checks DNS configuration and security settings.

Detects the presence and type of Web Application Firewall protecting the target using wafw00f.

Tests if login page blocks repeated failed login attempts.

Detects weak JWT tokens (HS256, missing exp).

Identifies insecure CORS headers (Access-Control-Allow-Origin: *).

Checks if API endpoints implement proper rate limiting.

Checks if .env files are publicly accessible.

Scans for publicly accessible sensitive files (logs, .git).

Checks for exposed sensitive Laravel files (.git, logs, config).

Discovers hidden directories and files using dictionary-based brute forcing with Gobuster. Requires domain verification.

Detects unclaimed subdomains pointing to external services.

Checks email configuration for security best practices.

Comprehensive DNS enumeration and zone transfer testing using DNSRecon.

DNS reconnaissance and subdomain discovery using Fierce.