Scan at scaleSites leaking a private key in their Web Bot Auth directory
Sites leaking a private key in their Web Bot Auth directory
A site-wide report: one row per host, over the web_bot_auth rows the crawl emitted.
What this report returns
A Web Bot Auth directory must contain public keys only; these sites' published JWKS includes PRIVATE key material (a JWK d/p/q/... member), which means anyone who fetched the file can sign requests as the site's bots.
Fix immediately: remove the private members from the published JWK, then rotate the compromised key pair; treat the old key as burned.
The columns it shows
Every defect this technology can carry is a column in the grid, worst first, so nothing is hidden behind a filter you have to know to apply.
- Host
host - Web Bot Auth Private Key Exposed
webBotAuthPrivateKeyExposed - Web Bot Auth Findings
webBotAuthFindings
About Web Bot Auth directory
Public keys letting verified agents prove who they are.
Read how Web Bot Auth directory is checked, including the specification it is validated against and a worked correct and broken example.
Running it
This report ships in the Lumar agent-readiness container and appears on any project it is linked to, on every crawl. See the whole set, or check a single URL with the scanner on this site, which runs the same code with no account.