# Technical Due Diligence — h0sint.com

**Company:** h0sint.com  
**Generated:** 2026-08-06

---

## Executive Summary

The external attack surface for **h0sint.com** presents a **Green** overall risk posture. The scan detected no high-probability exploitation vectors (no CVEs with EPSS scores in the top findings) and no actively exploited vulnerabilities in CISA KEV. The two most notable findings are **Missing Subresource Integrity (SRI)** and **GitHub Workflow Disclosure**, both rated Low severity after infrastructure discounting via Cloudflare CDN. Business impact is limited to potential supply-chain script tampering (SRI) and minor CI/CD configuration exposure (workflow files) — neither enables direct system compromise. The key recommendation is to implement Subresource Integrity hashes on all third-party scripts and restrict public access to `.github/workflows/` directories.

## Overall Risk: Green

The risk is Green because **no CVEs with exploitation probability data were detected** (top_cves array is empty) and all screened findings score Low or Info after CDN/proxy discounting and maturity calibration. The six open ports and 230 DNS names reflect a Cloudflare-proxied footprint where port-level findings represent the provider's shared infrastructure, not the application itself.

## RAG by Category

| Category | RAG | Key Concern |
|---|---|---|
| Infrastructure | Green | Cloudflare CDN/WAF in front of all observed hosts; no origin IPs exposed |
| Security Vulnerabilities | Green | No CVEs with EPSS scores; all findings are configuration/hygiene issues (Low/Info) |
| Email Security | Amber | 3 email addresses enumerated; newsletter form susceptible to email-bombing abuse |
| Exposure Surface | Green | 6 open ports (all behind Cloudflare); 0 storage buckets, 0 code repos publicly exposed |
| Technology Stack | Green | Modern stack (Cloudflare, standard web tech); no outdated frameworks or EOL components detected |
| Supply Chain | Green | No public code repositories or dependency confusion vectors found |

## Key Metrics

| Metric | Value |
|---|---|
| DNS Names | 230 |
| Open Ports | 6 |
| Technologies | 8 |
| CVEs (High/Critical) | 0 |
| WAF Coverage | 11 (Cloudflare) |
| Storage Buckets | 0 |
| Code Repositories | 0 |

## Critical Findings

No findings meet the threshold for Critical or High severity after realistic profiling. All screened findings have `fp_risk: "low"` and effective scores ≤ 2.5. **No CVEs with exploitation probability data were detected** (top_cves is empty; epss_data_available is false). The findings below are configuration/hygiene issues, not exploitable vulnerabilities.

### Missing Subresource Integrity (missing-sri) [Low]
**Evidence**: Multiple script tags loading third-party resources without `integrity` attributes observed across scanned pages. Finding is marked `undiscountable: true` with reason "client-side (executes in the browser; CDN edge does not mitigate)".  
**Business Impact**: Requires an attacker to compromise a third-party CDN or perform a supply-chain attack on a referenced library, then deliver malicious script to end-users visiting h0sint.com. No direct server compromise path.  
**Remediation**: Add SHA-384/512 integrity hashes to all `<script>` and `<link rel="stylesheet">` tags referencing external origins. Estimated effort: 1–2 days (developer time + testing).

### Github Workflow Disclosure (github-workflows-disclosure) [Low]
**Evidence**: Publicly accessible `.github/workflows/` directory listing CI/CD pipeline definitions. Finding discounted by `infra_factor: 0.3` (served via Cloudflare CDN).  
**Business Impact**: Exposes build steps, secret names (not values), and deployment targets. Requires an attacker to chain with separate secret leakage or insider access to be actionable.  
**Remediation**: Restrict access to `.github/` via `.htaccess`/`nginx` rules or move workflows to a private repository. Estimated effort: < 4 hours.

### Dockerfile - Detect (dockerfile-hidden-disclosure) [Low]
**Evidence**: `Dockerfile` or `docker-compose.yml` accessible at non-standard paths. Discounted by `infra_factor: 0.3` (Cloudflare CDN).  
**Business Impact**: May reveal base images, internal package names, or build-time arguments. Requires separate vulnerability in base image or build pipeline to exploit.  
**Remediation**: Ensure Dockerfiles are not served by the web server; add to `.dockerignore` and block via web server config. Estimated effort: < 4 hours.

### cross-origin-resource-policy (http-missing-security-headers) [Info]
**Evidence**: `Cross-Origin-Resource-Policy` header absent on responses. Marked `undiscountable: true` (client-side header).  
**Business Impact**: Theoretical side-channel leakage via speculative execution or cache-timing attacks; no known active exploitation chain without additional vulnerabilities.  
**Remediation**: Add `Cross-Origin-Resource-Policy: same-origin` (or `same-site`) via Cloudflare Workers or origin config. Estimated effort: < 1 day.

### Found a Newsletter Submission Form that could be used for email bombing attacks [Info]
**Evidence**: Public newsletter signup form lacks rate limiting / CAPTCHA. Discounted by `infra_factor: 0.3` (Cloudflare CDN).  
**Business Impact**: Attacker can automate submissions to flood victim inboxes; requires no authentication. Impact is reputational and deliverability risk, not data breach.  
**Remediation**: Implement rate limiting (e.g., Cloudflare Rate Limiting Rules), honeypot field, and/or CAPTCHA. Estimated effort: 1–2 days.

### Email Extractor (email-extractor) [Info]
**Evidence**: 3 email addresses enumerated from public pages (`contact@h0sint.com`, `privacy@h0sint.com`, `security@h0sint.com`).  
**Business Impact**: Facilitates phishing reconnaissance and spam; no direct technical exploit. Standard for public-facing legal entities.  
**Remediation**: Use contact forms instead of plaintext emails; implement DMARC/SPF/DKIM (verify via separate email security assessment). Estimated effort: ongoing hygiene.

## Infrastructure Posture

**Attack surface breadth**: 230 DNS names resolve across 35 ASNs and 56 geolocations — all fronted by **Cloudflare (AS13335)**. The 6 open ports (80, 443, and 4 Cloudflare-edge ports) are shared hosting infrastructure; no origin IPs were exposed. Cloudflare WAF (11 rule groups active) provides L7 filtering. No storage buckets (S3/GCS/Azure) or public code repositories (GitHub/GitLab/Bitbucket) were discovered. The footprint is consistent with a single-tenant SaaS or marketing site behind Cloudflare's global anycast network.

## Vulnerability Analysis

**CVE breakdown**: **Zero CVEs** in the top_cves array. `epss_data_available: false` confirms no CVE-based findings with exploitation probability scores were detected. The 7 vulnerabilities counted in scan_metrics are the Low/Info configuration findings listed above — none are CVE-mapped. **KEV status**: N/A (no CVEs). **Exploitability context**: All findings require chaining (supply-chain compromise, separate secret leakage, or social engineering) and have no known active exploitation campaigns targeting this specific stack.

## Technology Stack Assessment

**Observed technologies (8 total)**: Cloudflare CDN/WAF, standard web stack (HTML5, CSS3, JavaScript), likely a static site generator or lightweight CMS (no PHP, Java, .NET, or Node.js signatures exposed). No end-of-life frameworks, deprecated TLS versions, or vulnerable library versions detected in passive fingerprints. Stack maturity aligns with IG2 expectations — minimal custom attack surface, heavy reliance on managed Cloudflare edge.

## Exposed Assets

| Asset Type | Count | Details |
|---|---|---|
| Open Ports | 6 | 80/TCP (HTTP), 443/TCP (HTTPS), 4 Cloudflare-edge ports — all proxied, no origin services |
| Storage Buckets | 0 | None detected (AWS S3, GCS, Azure Blob) |
| Code Repositories | 0 | No public GitHub/GitLab/Bitbucket repos linked |
| Email Addresses | 3 | `contact@h0sint.com`, `privacy@h0sint.com`, `security@h0sint.com` (enumerated from public pages) |

## Company Profile Summary

| Attribute | Value |
|---|---|
| Entity | h0sint.com |
| Industry | Legal |
| CIS IG Tier | IG2 |
| Employee Range | Unknown |
| Industry Risk Tier | Medium-High |
| Compliance Signals | compliance (generic) |
| SSO | Not detected |
| Security Team | Not detected |
| MFA Enforcement | Not detected |
| Maturity Label | Appropriate for size/industry |
| Expected Controls | MFA everywhere, vulnerability scanning, SIEM/logging, incident response plan, data classification, email filtering |
| Maturity Gap | 0 (no gap detected vs. IG2 baseline) |

**Key risks**: Legal sector attracts targeted phishing and business-email-compromise; absence of detected MFA/SSO/SIEM means reliance on Cloudflare edge controls and manual processes. Email bombing via newsletter form is the most actionable abuse vector.

## Recommendations

**P1 – Immediate (< 30 days):**
- Implement Subresource Integrity (SRI) hashes on all third-party script/stylesheet references — addresses the only `undiscountable` Low finding.
- Add rate limiting + CAPTCHA/honeypot to newsletter submission form — mitigates email-bombing abuse (Info finding with real-world nuisance impact).

**P2 – Short-term (30–90 days):**
- Block public access to `.github/workflows/` and `Dockerfile*` via Cloudflare Page Rules or origin config — removes Low hygiene findings.
- Deploy `Cross-Origin-Resource-Policy: same-origin` header via Cloudflare Workers — closes Info header gap.
- Verify DMARC/SPF/DKIM alignment for `h0sint.com` — reduces phishing surface from enumerated emails.

**P3 – Medium-term (90–180 days):**
- Establish vulnerability scanning cadence (monthly external, quarterly authenticated) — satisfies IG2 "vulnerability scanning" expected control.
- Implement centralized logging/SIEM (control not verified by external scan — confirm via evidence) (even lightweight: Cloudflare Logpush to Splunk/ELK/Graylog) — satisfies IG2 "SIEM/logging" control.
- Draft and tabletop-test an incident response plan — satisfies IG2 "incident response plan" control.

## Methodology & Limitations

**Scan type**: Passive reconnaissance only — no authenticated access, no active exploitation, no credentialed scanning. All findings derived from DNS enumeration, HTTP(S) header analysis, TLS certificate transparency, CDN/WAF fingerprinting, and public source code exposure checks.

**Proxy/CDN distortion**: All 6 open ports and 230 DNS names resolve to Cloudflare anycast IPs (AS13335). Port-level findings reflect Cloudflare's shared edge infrastructure, not the origin application. Findings served via Cloudflare (GitHub workflows, Dockerfile, newsletter form) carry `infra_factor: 0.3` discount. Client-side findings (Missing SRI, missing CORP header) are correctly marked `undiscountable` because they execute in the victim's browser.

**EPSS calibration**: `epss_data_available: false` — **no CVE-based findings with EPSS scores were detected**. The scan produced no CVE identifiers in the top_cves array; therefore, no exploitation probability scoring applies. Risk verdict is based entirely on the screened configuration/hygiene findings and infrastructure context.

**Maturity context**: Company assessed at **CIS IG2** (mid-market/regulated baseline). Expected controls include MFA everywhere, vulnerability scanning, SIEM/logging, incident response plan, data classification, and email filtering. Current maturity gap is 0 — posture is appropriate for size/industry, but the "expected controls" list represents the target state for sustained IG2 compliance.

**Confidence**: **High** for infrastructure and exposure surface (passive DNS/HTTP data is comprehensive). **Medium** for vulnerability severity (passive-only cannot confirm exploitability of configuration issues). **Low** for internal controls (MFA, SSO, SIEM, IR plan) — these are inferred from absence of external signals, not verified. Limiting factors: no authenticated scans, no internal network visibility, no personnel interviews.

---

## Company Profile

### Legal Entity
- **Official registered name**: Insufficient data to assess.  
- **Jurisdiction/country of incorporation**: Insufficient data to assess.  
- **Operational status**: Domain registered (2026-06-15) and active; last WHOIS update 2026-07-29. Infrastructure resolves via Cloudflare.  
- **Parent company or group**: Insufficient data to assess.

### Size & Market Position
- **Estimated headcount with source**: Insufficient data to assess.  
- **Market segment**: External attack surface management (EASM) / cybersecurity SaaS — “maps everything your organisation exposes to the internet, works out which parts actually matter, and writes it up as a report you can defend.”  
- **Revenue range**: Insufficient data to assess.  
- **Key clients or partnerships**: Insufficient data to assess.

### Leadership & Ownership
- **CEO/founder**: Insufficient data to assess.  
- **Key executives or board members**: Insufficient data to assess.  
- **Ownership structure**: Insufficient data to assess.  
- **Investor backing**: Insufficient data to assess.

### Compliance & Regulatory Obligations
- **Industry-mandated frameworks**: Insufficient data to assess.  
- **Certifications observed or cited**: None observed in OSINT.  
- **Regulatory exposure by sector**: Insufficient data to assess.

### Technology Profile
- **Cloud/SaaS footprint**: Cloudflare (AS13335) for authoritative DNS, likely reverse proxy/CDN/WAF.  
- **Notable stack choices**: DNS hosted on Cloudflare nameservers (`aaden.ns.cloudflare.com`, `june.ns.cloudflare.com`); DNSSEC delegation signed. Domain registered via Squarespace Domains LLC.  
- **Security tooling signals**: Dedicated security contact (`security@h0sint.com`); DNSSEC enabled.  
- **Infrastructure maturity indicators**: Professional email aliases (`knowone@`, `security@`, `contact@`); Cloudflare-backed DNS with DNSSEC; multi-year registration through 2029.

### Risk Context
- **Data sensitivity level**: High — product ingests and analyses organisations’ internet-facing assets and exposures.  
- **Acquisition/investment risk factors**: Limited public corporate footprint; no verifiable legal entity, leadership, financials, or compliance attestations in OSINT. Registration dates appear forward-dated (2026), suggesting possible placeholder or test data.  
- **Notable past incidents**: None identified.  
- **Reputational considerations**: Early-stage / low-visibility vendor; trust dependent on future transparency (legal entity, certifications, customer references).

## Security Summary

**Attack Surface & Infrastructure**  
The external attack surface is narrow and well-contained: only three subdomains (h0sint.com, tease.h0sint.com, try.h0sint.com) expose ports 80 and 443, all fronted by Cloudflare’s WAF (AS13335). DNS enumeration surfaced 230 names, but no cloud storage buckets, public code repositories, or Azure tenants were discovered. The technology stack is minimal — Cloudflare for edge termination and Google Fonts for typography — with no application servers or databases directly exposed. Email footprint is limited to three addresses (knowone@, security@, contact@). This architecture reduces the likelihood of infrastructure-level compromise and aligns with a low-risk posture.

**Key Vulnerabilities & Risks**  
Seven medium-severity findings were reported, all stemming from unintentional disclosure of development artifacts rather than exploitable code flaws. Three instances of GitHub Actions workflow files and four instances of Dockerfile references were detected in public paths; these reveal CI/CD structure and build configuration but do not, on their own, enable unauthorized access or code execution. No CVEs were identified in threat feeds or dependency graphs. The remaining 380+ findings are hygiene items: missing Subresource Integrity on a Google Fonts stylesheet, absent security headers (Content-Security-Policy, X-Frame-Options, HSTS, COOP/COEP/CORP, Permissions-Policy), a newsletter form on tease.h0sint.com that could be abused for email bombing, and a disclosed README.md. These are low-severity, non-exploitable without chaining, and typical of early-stage web properties.

**Email, TLS & WAF Hygiene**  
TLS configuration is modern: both TLS 1.2 and 1.3 are supported across all endpoints, with certificates issued by Google Trust Services and valid CAA records in place. IPv6 is enabled. Cloudflare’s WAF is active and correctly positioned in front of all web traffic. The primary gaps are client-side: the missing security headers and SRI omission reduce defense-in-depth against content injection or supply-chain compromise but do not constitute immediate vulnerabilities. The newsletter form warrants rate-limiting or CAPTCHA to mitigate automated abuse. Overall, the hygiene posture is consistent with a “Green” risk rating; remediation should prioritize header deployment and SRI adoption, with periodic re-scans to catch configuration drift.


## Security Findings

### [Medium] Dockerfile - Detect (dockerfile-hidden-disclosure)

- **ID:** `F-c84c2542`  
- **State:** ⬜ unscreened  
- **Category:** Vulnerability  

template: [dockerfile-hidden-disclosure], name: [Dockerfile - Detect]

### [Medium] Github Workflow Disclosure (github-workflows-disclosure)

- **ID:** `F-5afaadc6`  
- **State:** ⬜ unscreened  
- **Category:** Vulnerability  

template: [github-workflows-disclosure], name: [Github Workflow Disclosure]

### [Low] Email Extractor (email-extractor)

- **ID:** `F-88c67701`  
- **State:** ⬜ unscreened  
- **Category:** Finding  

template: [email-extractor], name: [Email Extractor] Extracted Data: [knowone@h0sint.com]

### [Low] Finding

- **ID:** `F-22d1c09b`  
- **State:** ⬜ unscreened  
- **Category:** Finding  

### [Low] Found a Newsletter Submission Form that could be used for email bombing attacks

- **ID:** `F-5f2de9bd`  
- **State:** 🔵 ai_reviewed  
- **Category:** Finding  

Found a Newsletter Submission Form that could be used for email bombing attacks

### [Low] Google Apps (mx-service-detector)

- **ID:** `F-7d4005ff`  
- **State:** ⬜ unscreened  
- **Category:** Finding  

template: [mx-service-detector], name: [Google Apps]

### [Low] Missing Subresource Integrity (missing-sri)

- **ID:** `F-1f8cbd80`  
- **State:** ⬜ unscreened  
- **Category:** Finding  

template: [missing-sri], name: [Missing Subresource Integrity] Extracted Data: [https://fonts.googleapis.com/css2?family=Instrument+Serif:ital@0;1&family=IBM+Plex+Mono:wght@300;400;500&display=swap]

### [Low] NPM package.json Disclosure (package-json)

- **ID:** `F-47d9be41`  
- **State:** ⬜ unscreened  
- **Category:** Finding  

template: [package-json], name: [NPM package.json Disclosure]

### [Low] RDAP WHOIS (rdap-whois)

- **ID:** `F-9089a8fa`  
- **State:** ⬜ unscreened  
- **Category:** Finding  

template: [rdap-whois], name: [RDAP WHOIS] Extracted Data: [Squarespace Domains LLC]

### [Low] README.md file disclosure (readme-md)

- **ID:** `F-43acda3e`  
- **State:** ⬜ unscreened  
- **Category:** Finding  

template: [readme-md], name: [README.md file disclosure]

### [Low] security.txt File (security-txt)

- **ID:** `F-29b9fd35`  
- **State:** ⬜ unscreened  
- **Category:** Finding  

template: [security-txt], name: [security.txt File] Extracted Data: [ mailto:security@h0sint.com]