See what an attacker already knows
about your domain.

Why no scanner sees this: Every one of those requests is authenticated, well-formed and returns 200 OK. From outside, it is indistinguishable from normal traffic, which is why no external scan will ever report it.

Why no scanner sees this: This lives entirely inside multi-step authenticated logic. A scanner cannot hold state across a reset email, so it cannot see any of it.

Why no scanner sees this: IAM policy is invisible from the internet. This requires reading your actual configuration from inside, which is why cloud reviews are scoped with read access, not run from outside.

Why no scanner sees this: Everything after step one happens inside your network. External checks stop at the front door, which is exactly where this chain starts getting interesting.

Why no scanner sees this: Nothing about your app binary is visible from your domain. This one needs the build in our hands.

Why no scanner sees this: We could confirm the DNS half of this from outside. Whether your people click, and what happens when they do, only a consented simulation answers.