# Sites leaking a private key in their Web Bot Auth directory

A site-wide report: one row per host, over the web\_bot\_auth rows the crawl emitted.

## What this report returns

A Web Bot Auth directory must contain public keys only; these sites' published JWKS includes PRIVATE key material (a JWK d/p/q/... member), which means anyone who fetched the file can sign requests as the site's bots.

Fix immediately: remove the private members from the published JWK, then rotate the compromised key pair; treat the old key as burned.

## The columns it shows

Every defect this technology can carry is a column in the grid, worst first, so nothing is hidden behind a filter you have to know to apply.

-   Host`host`
-   Web Bot Auth Private Key Exposed`webBotAuthPrivateKeyExposed`
-   Web Bot Auth Findings`webBotAuthFindings`
-   Ruleset Version`rulesetVersion`
-   Security Check Status`securityCheckStatus`
-   Related Security Frameworks`securityFrameworkReferences`

## About Web Bot Auth directory

Public keys letting verified agents prove who they are.

[Read how Web Bot Auth directory is checked](https://agentic-readiness.lumar.io/docs/trust/web-bot-auth), including the specification it is validated against and a worked correct and broken example.

## Running it

This report comes with Agentic Readiness in Lumar and appears on every crawl of any project that has it turned on. [See the whole set](https://agentic-readiness.lumar.io/scan-at-scale), or check a single URL with the [scanner on this site](https://agentic-readiness.lumar.io/), which runs the same code with no account.

[Get Lumar pricing →](https://www.lumar.io/pricing/)