Scan at scaleSites leaking a private key in their Web Bot Auth directory
Sites leaking a private key in their Web Bot Auth directory
A site-wide report: one row per host, over the web_bot_auth rows the crawl emitted.
What this report returns
A Web Bot Auth directory must contain public keys only; these sites' published JWKS includes PRIVATE key material (a JWK d/p/q/... member), which means anyone who fetched the file can sign requests as the site's bots.
Fix immediately: remove the private members from the published JWK, then rotate the compromised key pair; treat the old key as burned.
The columns it shows
Every defect this technology can carry is a column in the grid, worst first, so nothing is hidden behind a filter you have to know to apply.
- Host
host - Web Bot Auth Private Key Exposed
webBotAuthPrivateKeyExposed - Web Bot Auth Findings
webBotAuthFindings - Ruleset Version
rulesetVersion - Security Check Status
securityCheckStatus - Related Security Frameworks
securityFrameworkReferences
About Web Bot Auth directory
Public keys letting verified agents prove who they are.
Read how Web Bot Auth directory is checked, including the specification it is validated against and a worked correct and broken example.
Running it
This report comes with Agentic Readiness in Lumar and appears on every crawl of any project that has it turned on. See the whole set, or check a single URL with the scanner on this site, which runs the same code with no account.