The morning after a deploy
Today's footprint against yesterday's: a new open route or a forgotten workers.dev address is on your list before a stranger finds it.
DEMO Open the Paxen app on sample data
An AI attacker that works for you.
Paxen probes your internet footprint every day like an AI agent swarm and hands you a plain-English, fix-first list.
About a minute. Public certificate and DNS records only. No account.
Northwind Clinic Software
northwind-demo.comDaily run finished 5:52am · 214 addresses checked · Set aside as noise: 188 · Yours to act on: 3
- Fix todayapi.northwind-demo.comPRPriya (engineering)A settings route hands out your saved webhook address to anyone who asks.
One action: require the key your other routes use, then replace the webhook address.
- Fix todaynorthwind-demo.com/assets/app.jsSASam (ops)A live payment key sits in a script anyone can download.
One action: rotate it into your vault; Paxen updates the app that uses it.
- This weekbooking.northwind.workers.devPRPriya (engineering)Your booking Worker also answers at a second address that skips your sign-in.
One action: turn the workers.dev address off.
2 of 2real bugs caught on pre-fix code
0false alarms on the fixed code
586addresses mapped in about two minutes
Dailyrerun, with what changed since yesterday
The problem
Exposure arrives with every deploy.
One person with an AI agent swarm can probe your whole internet footprint in under a day. Paxen gives solo builders and companies of 5 to 200 people the attacker's view every morning, written for a team with no security staff.
- A stranger can
find an open route that answers without a sign-in, a leftover admin page, or a second workers.dev address beside your domain.
- A stranger can
claim a dangling DNS record, send mail as you, or use a live token from a public page.
- A stranger can
feed instructions to an AI agent with broad permissions through an email, a web page or a chat.
How it works
Three steps to the attacker's view.
- 1
Enter your domain
Paxen reads certificate transparency records and DNS and maps what answers from the internet: free, about a minute, no account.
- 2
Prove you own it
Add one DNS TXT record at
_paxen.yourdomain.comto turn on the full active check set and a daily rerun with a diff of anything newly exposed. - 3
Connect and fix
Link Cloudflare, GitHub, Google and 1Password read-only, with every scope shown, then work down your ranked list one action at a time.
The product
Six jobs. One list.
Everything an attacker would try, checked every day and ranked into one plain-English list.
Every internet address, mapped every day.
Paxen maps every domain, subdomain, Cloudflare Worker, Pages site, tunnel and webhook you own, and takes an exposed address off the internet in one click, with an undo.
- Open routes, leftover admin pages and second workers.dev addresses
- Dangling DNS records a stranger could claim
- TLS, certificate expiry, and SPF, DKIM and DMARC
- One-click fix: Cloudflare Access, workers.dev off, or the record removed
Live keys found and rotated safely.
Paxen finds keys and tokens in repos, .env files, CI and public pages, and reports every match by its pattern name, never its value.
- Liveness check: which keys still work, and what each can do
- Guided rotation into 1Password, Doppler or Cloudflare secrets
- The app using the key updated in the same step
- Key age and owner, a nudge at 90 days, and an SSH key audit
Every dependency pinned, every campaign watched.
Paxen locks down third-party code by opening the pull request for you, and watches live supply-chain campaigns against your repositories.
- Pins GitHub Actions to commits, images to digests, MCP servers to versions
- Lockfile and known-vulnerability checks on every project
- Live campaigns matched to your repos within the hour
- New repository admins and pull requests from unknown accounts flagged
Every AI agent, and what it can do.
Paxen inventories every AI agent, assistant, scheduled task and MCP connector, with what each can read, send, pay and delete.
- Least-privilege tokens with an expiry date
- A plain log of every action and the permission it used
- Email, web and chat content marked as data, never as orders
- A check before any outward action after untrusted content
A weekly AI review of your own code.
Open-source analyzers and a frontier model read the risky paths every week: sign-in, webhooks and file parsers.
- Semgrep, CodeQL and osv-scanner, plus a frontier model
- Focus on the paths an attacker reaches first
- Fix pull requests written by one model family
- Every fix reviewed by a second model family
# risky paths read this week src/auth/session.ts model token never expires src/webhooks/stripe.ts semgrep signature checked after parse src/upload/csv.ts codeql clean package-lock.json osv 2 advisories, 1 reachable # fix pull requests #418 expire sessions after 12 hours written: GPT reviewed: Gemini ready #419 verify signature before parse written: Gemini reviewed: GPT ready
One morning briefing, ready to act on.
Paxen folds every module into one ranked list, a morning email, and records your customers and insurers can check.
- Morning email: what is new, what closed, what to do today
- Patch speed: days from a published fix to yours
- A weekly briefing on attacker activity that applies to you
- An evidence pack for insurers and customers, from the real state
The fix-first list
One list. One action per line.
Rules set the severity. A model on our own hardware sorts the routine findings, then GPT and Gemini rank and cross-check the list, so every line you read has one plain-English action and one named owner.
Open a line to see what Paxen saw. Sample data.
Fix todayYour staging admin page opens for anyone, with no sign-inThe one action: put it behind sign-in; one click adds Cloudflare Access. Owner: Priya
GET https://staging-admin.northwind-demo.com/admin
200 text/html · no sign-in · "Export appointments"
production admin: https://admin.northwind-demo.com 302 to sign-in
Fix todayA webhook prints its request log to anyone who asksThe one action: turn off the /log route; the webhook keeps working. Owner: Sam
GET https://hooks.northwind-demo.com/log
200 text/plain · no sign-in · last 200 requests
found email addresses, invoice numbers (values never stored)
This weekA Google service key sits in a repository fileThe one action: rotate it into your vault; Paxen updates the app that uses it. Owner: Marcus
github northwind/scheduler deploy/sa.json
found Google service account key (value never stored)
liveness works · scope: sends mail as any northwind-demo.com mailbox
WatchDMARC is set to report onlyThe one action: move the policy to quarantine after a week of clean reports. Owner: Sam
_dmarc.northwind-demo.com TXT "v=DMARC1; p=none"
The morning report
Know what changed since yesterday.
Your morning email shows what is newly exposed, what closed and the exact fixes for today. Paxen tracks your patch speed in days, from a published fix to yours, and once a week briefs you on attacker activity that applies to your stack. When a customer or insurer asks for proof, export the evidence pack built from your real state.
Paxen · Northwind Clinic SoftwareYour fix-first list for Thursday
3to fix
2closed
4 dayspatch speed
- New: a settings route answers without a sign-in
- New: a live payment key in a public script
- Closed: the staging admin page is off the internet
- This week: a campaign targeting a build tool you use
For your agents
An API and an MCP server for your agents.
Your own AI agents ask Paxen "what should I fix today?" and get the ranked list, each line with its one action and its owner.
# your agent asks call paxen.fix_first({ "domain": "northwind-demo.com", "limit": 3 }) # Paxen answers 1 fix_today settings route answers without sign-in owner=priya 2 fix_today live payment key in public script owner=sam 3 this_week workers.dev address beside booking owner=priya
curl https://api.paxensecurity.com/v1/fix-first \
-H "Authorization: Bearer $PAXEN_KEY" \
-d domain=northwind-demo.comWhen it matters
The mornings that matter.
Before a customer's security review
Export an evidence pack with your pinned dependencies, patch speed, TLS and email setup, and every closed finding.
When an insurer asks
Hand your underwriter a current inventory of domains, keys, pins and agent permissions, built from your real state.
A new hire gets admin
Contributor watch flags the new admin on your repository, and the agent inventory shows every token they can use.
A key lands in a public repo
Paxen names the key by pattern, checks whether it still works, and guides the rotation with the app updated in the same step.
Trust
You set the boundary. Every permission shows.
Ownership first
The free scan reads public DNS and certificate records. Active checks run on domains you prove with a DNS TXT record, re-checked before every run.
_paxen.yourdomain.com TXTSecrets stay where they live
Paxen checks key values in place and reports each match by pattern name, so values stay out of every report and screen.
pattern: stripe_live_secretRead-only, revocable, logged
Cloudflare, GitHub, Google and 1Password connect read-only, with every scope listed and one-click revoke. A one-click fix asks for the single permission it needs when you press it, and every action is logged.
scope: zone:read · workers:readProof
Tested on our own companies first.
Epiphani Studios built Paxen with our own companies as customer zero, against two real bugs from our systems on November 12, 2026: a call-recording callback that sent a provider credential to any address a caller named, and a settings route that handed out a saved webhook address. Paxen catches both on the code as it stood before the fix and reports nothing on the fixed code.
POST /api/twilio/recording RecordingUrl=paxensecurity.com/c/7f3a canary hit Authorization: Basic (length 92) FOUND a provider credential sent to a stranger's address GET /api/settings 200 "webhook": [Zapier hook address] FOUND a saved webhook address handed to anyone
POST /api/twilio/recording RecordingUrl=paxensecurity.com/c/7f3a 403 provider signature required · no canary hit clean GET /api/settings 401 sign-in required clean
How Paxen compares
Written for the owner, every day.
| Capability | Paxen | Aikido | Intruder | Coalition Control |
|---|---|---|---|---|
| Free first scan | Yes, no account | Yes | Yes | Yes, with an email |
| Ownership proof by DNS record before active tests | Yes | Yes | Account setup | Account setup |
| Plain-English list, one action and one owner per finding | Yes | Developer view | Ranked by exploit likelihood | Action plan and score |
| Inventory of AI agents with read, send, pay and delete | Yes | Not listed | Not listed | Not listed |
| Liveness check on every found key | Yes | Not listed | Not listed | Not listed |
| Pin actions, images and MCP servers by pull request | Yes | Not listed | Not listed | Not listed |
| API and MCP server for your own agents | Yes | Not listed | Not listed | Not listed |
Rival details read from each company's own pages on November 12, 2026 (linked above); "Not listed" means the capability was not on those pages.
Pricing
Start with your domain, free.
Your first scan takes about a minute and needs no account. Daily monitoring, the six modules and the connectors are paid plans.
First scan
$0 no account, no card
- Map of every address from public records
- Second addresses and email setup checked
- Results in about a minute
Daily plans
Plans by company size
- All six modules, every day, with the morning report
- Read-only connectors for Cloudflare, GitHub, Google, 1Password
- API and MCP server for your agents
Plan details arrive with your first daily report.
FAQ
Questions owners ask.
Straight answers on safety, data and cost. Anything else: security@paxensecurity.com.
Is the free scan safe for my site?
Yes. The free scan reads public certificate transparency records and DNS only, so your servers see no traffic from it. It takes about a minute and needs no account.
What does proving ownership change?
One DNS TXT record at _paxen.yourdomain.com proves you own the domain. It turns on the full active check set across your routes and pages, plus the daily rerun with a diff of anything newly exposed.
How often does it run?
Exposure mapping, active checks and your morning email run every day. Campaign watch matches new supply-chain campaigns to your repos within the hour, and the AI code review runs every week.
What does it cost to start?
The first scan is free and needs no account. Paid plans cover the daily rerun, the six modules and the connectors; join the list and the plan details arrive with your first daily report.
What happens to my data?
Connectors are read-only, with every scope listed and one-click revoke. Key values are checked where they live and never displayed, findings are kept so each morning can show what changed, and every action is logged.
How is this different from a vulnerability scanner?
Paxen works like an attacker across your whole footprint, every day, and writes for the owner: rules set severity, two model families cross-check the list, and every line carries one action and one named owner.
Can my own AI agents use it?
Yes. The Paxen API and MCP server let your agents ask "what should I fix today?" and pull the ranked list straight into their work.
What does the name mean?
Paxen comes from pax, Latin for peace: the peace of knowing your company is watched.
See what answers from your domain today.
Map your public footprint in about a minute, free, with no account.