[{"data":1,"prerenderedAt":356},["ShallowReactive",2],{"blog-how-to/certificate-transparency-exposure":3},{"id":4,"title":5,"body":6,"category":327,"date":328,"dateModified":328,"description":329,"draft":330,"extension":331,"faq":332,"featured":330,"headerVariant":338,"image":339,"keywords":340,"meta":341,"navigation":344,"ogDescription":345,"ogTitle":339,"path":346,"readTime":347,"schemaOrg":348,"schemaType":349,"seo":350,"sitemap":351,"stem":352,"tags":353,"twitterCard":354,"__hash__":355},"blog/blog/how-to/certificate-transparency-exposure.md","Certificate Transparency: Why Nobody Needs Your URL to Find Your App (2026)",{"type":7,"value":8,"toc":310},"minimark",[9,13,16,19,34,39,47,50,59,67,71,78,81,92,95,104,108,111,114,121,124,128,173,186,206,219,232,236,239,242,245,279,298],[10,11,12],"p",{},"On 31 August 2026, METR published a security update describing, among other things, a compromise that began in March. The system involved was an agent orchestration dashboard on a researcher's personal EC2 instance. METR's own word for it is \"vibe-coded.\"",[10,14,15],{},"The instance was not left wide open. It was deliberately placed behind Google authentication. But, in METR's words, \"the vibe-coded app included a fail-open vulnerability that silently disabled authentication.\" The box also held an API key for METR's general-access account. An attacker prompted the agent to hand over that key, added an SSH key so they could come back, and over roughly three weeks burned through credits METR values at about $600,000. Those credits had been granted to METR for free, so this is the market value of the compute consumed rather than a cash loss.",[10,17,18],{},"The part worth your attention is not the theft. It is the first step, the one everybody skips past.",[20,21,22],"tldr",{},[10,23,24,25,29,30,33],{},"METR suspects the attacker found that dashboard by scanning ",[26,27,28],"strong",{},"certificate transparency logs"," for recently-registered sites with AI-related keywords. Every HTTPS hostname you deploy is published to a public, append-only log automatically, and researchers measured scanning probes arriving ",[26,31,32],{},"seconds"," after a certificate is logged. \"Nobody knows the URL\" has not been a security control for years. Search your own domain on crt.sh and see what is listed.",[35,36,38],"h2",{"id":37},"how-they-found-it","How they found it",[10,40,41,42,46],{},"METR is careful about this, and so should you be. They say they ",[43,44,45],"em",{},"suspect"," the attacker found the instance \"by looking through recently-registered websites (e.g. in certificate transparency lists) to find vibe-coded sites with high-signal keywords relating to LLMs or agents, for purposes of harvesting potentially exposed model provider API keys.\" That is a hypothesis in their postmortem, not a forensic finding.",[10,48,49],{},"It is a very plausible hypothesis, because the mechanism is real, public, and free.",[51,52,53],"definition-box",{},[10,54,55,58],{},[26,56,57],{},"Certificate Transparency (CT)"," is a system of public, append-only logs that record every TLS certificate a certificate authority issues. It exists for a good reason: after the DigiNotar breach in 2011, the industry needed a way to catch fraudulently issued certificates. Chrome and Safari now require certificates to appear in these logs, so in practice every HTTPS site is registered in a public list of hostnames the moment it gets a certificate.",[10,60,61,62,66],{},"You do not opt in. Deploy to Vercel, Netlify, Railway or Fly, get automatic HTTPS, and the hostname is published. Point a custom domain at it, and that gets published too. Nobody has to guess ",[63,64,65],"code",{},"dashboard-internal-v2.yourdomain.com",". It is in a feed.",[35,68,70],{"id":69},"somebody-is-reading-that-feed-within-seconds","Somebody is reading that feed within seconds",[10,72,73,74,77],{},"This has been measured. In ",[43,75,76],{},"Certifiably Vulnerable: Using Certificate Transparency Logs for Target Reconnaissance"," (Pletinckx, Nguyen, Fiebig, Kruegel and Vigna, IEEE EuroS&P 2023), the authors ran honeypot web servers for 200 days and watched what happened when they pushed a certificate to a CT log.",[10,79,80],{},"Their finding, in their own words: \"adding a certificate to a CT log leads to incoming network probes, just seconds after publishing the entry. This suggests that CT logs are used as input for web scans.\"",[10,82,83,84,87,88,91],{},"The cleanest result is the IPv6 experiment. An IPv6 address is not something you find by scanning: the address space is far too large to sweep. So an IPv6 host should get no unsolicited traffic at all unless somebody learns the name. The researchers received around ",[26,85,86],{},"2,700 packets"," aimed at the server whose certificate they had published, against ",[26,89,90],{},"zero packets"," for the control that was never logged.",[10,93,94],{},"There is no ambiguity in that comparison. The certificate was the only way anyone could have known the host existed.",[96,97,98],"warning-box",{},[10,99,100,103],{},[26,101,102],{},"The window is not \"eventually.\" It is seconds."," If your plan was to deploy something unfinished, poke at it for an afternoon, and add the auth check tomorrow, the scan arrives before you finish your coffee. This is also why \"it is only up for a few hours\" is not the mitigation it sounds like.",[35,105,107],{"id":106},"the-part-that-cuts-the-other-way","The part that cuts the other way",[10,109,110],{},"It would be easy to finish here with \"new deployments are the dangerous ones.\" The same paper says that is wrong, and the honest version is more useful.",[10,112,113],{},"Pletinckx and colleagues also checked whether freshly deployed sites actually contained more known vulnerabilities than sites that had simply renewed a certificate. They did not. On that measure the two groups looked alike.",[10,115,116,117,120],{},"The group that did stand out was different: sites with an ",[26,118,119],{},"expired"," certificate that were still deployed and serving traffic. Those tended to run more outdated software and carry more known CVEs. The pattern is intuitive once you see it. A site nobody has renewed a certificate for is a site nobody is maintaining.",[10,122,123],{},"So discovery is fast for everyone, while the worse odds sit with the thing you forgot about rather than the thing you shipped this morning. Both of those describe a lot of vibe-coded projects.",[35,125,127],{"id":126},"the-five-minute-check","The five-minute check",[129,130,132,137,156],"step",{"number":131},"1",[133,134,136],"h3",{"id":135},"list-every-hostname-you-have-ever-certified","List every hostname you have ever certified",[10,138,139,140,147,148,151,152,155],{},"Go to ",[141,142,146],"a",{"href":143,"rel":144},"https://crt.sh",[145],"nofollow","crt.sh"," and search your domain, including a leading ",[63,149,150],{},"%."," wildcard, like ",[63,153,154],{},"%.yourdomain.com",". You will get every certificate ever issued for it.",[10,157,158,159,162,163,162,166,162,169,172],{},"Read the whole list, not the entries you recognise. The ones that matter are the ones you forgot: ",[63,160,161],{},"staging.",", ",[63,164,165],{},"admin.",[63,167,168],{},"api-v1.",[63,170,171],{},"test.",", the preview deployment from a client project two years ago.",[129,174,176,180,183],{"number":175},"2",[133,177,179],{"id":178},"open-each-one-with-no-session","Open each one with no session",[10,181,182],{},"Private browser window, no cookies, no logged-in account. Then visit each hostname and see how far you get.",[10,184,185],{},"You are looking for anything that renders content before asking who you are. A dashboard that loads and then shows a login modal has already failed: the data came down the wire first.",[129,187,189,193,196,203],{"number":188},"3",[133,190,192],{"id":191},"prove-the-auth-actually-fails-closed","Prove the auth actually fails closed",[10,194,195],{},"This is what caught METR. Authentication was configured. It silently stopped applying.",[10,197,198,199,202],{},"A fail-open bug is one where the code that decides \"is this person allowed in\" throws, times out, or returns something unexpected, and the surrounding logic treats that as a pass instead of a block. It is a common shape in AI-generated auth middleware, because the happy path is what gets written and the error branch gets a ",[63,200,201],{},"catch"," that logs and continues.",[10,204,205],{},"Read your auth middleware and find the error branch. If an exception in the identity check lets the request through, that is the bug.",[129,207,209,213,216],{"number":208},"4",[133,210,212],{"id":211},"take-the-keys-off-the-box","Take the keys off the box",[10,214,215],{},"The dashboard being reachable is bad. The dashboard holding a live model-provider API key is what turned it into a $600,000 line item. An agent that can be prompted will eventually be prompted to read its own configuration.",[10,217,218],{},"Do not put a production key on a machine whose only protection is a login screen you wrote in an afternoon.",[129,220,222,226,229],{"number":221},"5",[133,223,225],{"id":224},"shut-down-what-you-are-not-using","Shut down what you are not using",[10,227,228],{},"The expired-certificate finding above is the argument for this one. Every abandoned deployment is a permanently listed hostname running whatever was current the day you stopped paying attention.",[10,230,231],{},"Delete them. Not \"take them offline later.\" Delete them.",[35,233,235],{"id":234},"what-metr-did-about-it","What METR did about it",[10,237,238],{},"Worth noting, because they self-disclosed when they did not have to, and their remediation list is a reasonable template. They formalised a security review process for researchers deploying anything publicly, added spend alerts to API keys where the provider supports it, expanded monitoring while cutting noise alerts, rotated credentials, and tightened the policy on putting company credentials on non-company infrastructure.",[10,240,241],{},"They also say that to the best of their knowledge no sensitive data was accessed. The failure was a side project that bypassed policy, not a collapse of their actual data controls.",[10,243,244],{},"The reason this story is worth your time is not that METR was careless. It is that an organisation whose entire job is evaluating AI systems for dangerous behaviour still ended up with a vibe-coded dashboard, a fail-open auth bug and a live API key on the same box. If it can happen there, the odds that your weekend project got it right are not good.",[246,247,248,255,261,267,273],"faq-section",{},[249,250,252],"faq-item",{"question":251},"How did someone find my app if I never shared the URL?",[10,253,254],{},"Almost certainly through Certificate Transparency logs. Every time a certificate authority issues a TLS certificate, the hostname goes into public append-only logs that anyone can read and subscribe to. Your staging subdomain, your internal dashboard and your half-finished side project all appear there the moment they get HTTPS. Researchers who ran honeypots for 200 days found network probes arriving just seconds after they published a certificate to a log.",[249,256,258],{"question":257},"Can I opt out of Certificate Transparency?",[10,259,260],{},"Not in any practical way. Chrome and Safari require certificates to be logged, so a certificate that is not in a public log will not be trusted by most browsers. Some organisations use wildcard certificates so that individual hostnames do not appear separately, which hides the specific name but not the domain. The realistic answer is to assume every hostname is public and put a real access control in front of anything sensitive.",[249,262,264],{"question":263},"Does this mean newly deployed sites get attacked more than older ones?",[10,265,266],{},"Not according to the research, and this is the part people get backwards. The EuroS&P 2023 study found that freshly deployed websites were not more likely to contain a known CVE than sites that had just renewed a certificate. The group that stood out was sites with an expired certificate that were still running: those tended to have more outdated software and more known vulnerabilities. Fast discovery is real, but the neglected long-lived deployment is the bigger risk.",[249,268,270],{"question":269},"What is the fastest way to see what I have exposed?",[10,271,272],{},"Search your domain on a CT log aggregator such as crt.sh. Look for every hostname listed, not just the ones you remember. Staging environments, preview deployments, admin subdomains and abandoned experiments all show up. For each one, open it in a private browser window with no session and see how far you get before something asks you to log in.",[249,274,276],{"question":275},"Is hiding the URL ever a reasonable security measure?",[10,277,278],{},"As a layer on top of real access control, sure. On its own, no. An unguessable URL protects you only until the hostname is logged, which happens automatically when the certificate is issued. Treat obscurity as something that buys you nothing and build the auth check as though the address were printed on a billboard.",[280,281,282,288,293],"related-articles",{},[283,284],"related-card",{"description":285,"href":286,"title":287},"The bug class that defeated METR's Google login, in the library most vibe-coded apps use","/blog/vulnerabilities/next-auth-v5-fail-open","next-auth v5 Auth Bypass: Is Your App Failing Open?",[283,289],{"description":290,"href":291,"title":292},"What to do in the first hour after a model provider key gets out, and why the cap does not save you","/blog/how-to/ai-api-key-stolen","Your OpenAI or Claude API Key Was Stolen and the Spend Limit Didn't Stop It",[283,294],{"description":295,"href":296,"title":297},"Putting a real access check in front of the dashboard the log just advertised","/blog/how-to/protect-routes","How to Protect Routes and API Endpoints",[299,300,303,307],"cta-box",{"href":301,"label":302},"/","Start Free Scan",[35,304,306],{"id":305},"see-what-your-deployment-exposes","See What Your Deployment Exposes",[10,308,309],{},"Our scanner looks at your live app the way an automated scan would: what loads before authentication, which endpoints answer without a session, and what your frontend hands over to anyone who asks.",{"title":311,"searchDepth":312,"depth":312,"links":313},"",2,[314,315,316,317,325,326],{"id":37,"depth":312,"text":38},{"id":69,"depth":312,"text":70},{"id":106,"depth":312,"text":107},{"id":126,"depth":312,"text":127,"children":318},[319,321,322,323,324],{"id":135,"depth":320,"text":136},3,{"id":178,"depth":320,"text":179},{"id":191,"depth":320,"text":192},{"id":211,"depth":320,"text":212},{"id":224,"depth":320,"text":225},{"id":234,"depth":312,"text":235},{"id":305,"depth":312,"text":306},"how-to","2026-09-07","You did not share the link, so nobody can find it. That is not how it works. Every HTTPS hostname you deploy is published to a public log, and scanners read that log within seconds.",false,"md",[333,334,335,336,337],{"question":251,"answer":254},{"question":257,"answer":260},{"question":263,"answer":266},{"question":269,"answer":272},{"question":275,"answer":278},"yellow",null,"certificate transparency, how attackers find my app, unlisted deployment security, crt.sh check my domain, staging subdomain exposed, vibe coded app exposed",{"trendTrigger":342,"trendDate":343},"METR security update disclosing a March 2026 compromise of a vibe-coded agent dashboard","2026-08-31",true,"Every HTTPS hostname you deploy gets published to a public append-only log. Researchers measured probes arriving seconds later. Here is how to see what you have exposed.","/blog/how-to/certificate-transparency-exposure","9 min read","[object Object]","BlogPosting",{"title":5,"description":329},{"loc":346},"blog/how-to/certificate-transparency-exposure",[],"summary_large_image","XnWLtlfV-S7honDDSFU8qNVHHXiZJQcfsjpcy_dH3dw",1789672859644]