Blog
Blog
Güvenlik ve uyum dokümanları
Security and compliance docs
İş dilinde rehberler ve özellik dokümanları — risk, öncelik, aksiyon.
Business guides and feature docs — risk, priority, action.
-
How Guardbee works: add a brand, scan, and report
Define a brand, choose security modules, run scans, and use BeeAI for business-language reporting. Getting-started guide with live…
-
Website security scanning: what Guardbee checks
HTTPS, SSL, security headers, cookies, sensitive paths, forms, and more. A business-friendly guide to Guardbee website security scanning.
-
BeeAI security copilot: explain findings in business language
BeeAI explains Guardbee findings with business impact, priority, and action language. Product guide for the security copilot.
-
Subdomain takeover risk: dangling DNS and claimable hosting
Dangling CNAMEs and abandoned hosting records create brand-spoofing risk. Documentation for Guardbee subdomain takeover checks.
-
Discovery Surface: robots.txt, sitemap.xml, security.txt, and Technology Fingerprinting
Discovery surface analysis: robots.txt, sitemap.xml, security.txt, and technology fingerprinting. Guardbee reports the same passive signals an attacker can…
-
Third-Party Scripts and JavaScript Supply Chain Security
Explore third-party JavaScript, CDN, npm, SRI, and CSP risks. Learn how JavaScript supply chain attacks work and how…
-
Form security and open redirects: CSRF, autocomplete, and redirect risk
CSRF, autocomplete, and open redirects: how Guardbee’s form security scanning works and why these risks should be evaluated…
-
API security scanning: CORS, JWT, GraphQL, and response leaks
CORS, JWT, GraphQL, and API response leakage: how Guardbee’s API security scanning works, how it maps to OWASP…
-
KVKK and privacy scanning: notices, cookie consent, and VERBİS signals
Privacy notices, cookie consent, tracker disclosure, VERBİS, cross-border transfer, and form consent. Comprehensive documentation for Guardbee KVKK modules.
-
AI security scanning: inventory, prompt injection, and data leakage
AI chat widgets, model endpoints, prompt-injection signals, and LLM data leakage. Detailed documentation for Guardbee AI security features.
-
Network and infrastructure security: ports, WAF/CDN, cloud exposure
Open-port signals, WAF/CDN detection, cloud storage exposure, and Firebase config. A business guide to Guardbee network and infrastructure…
-
Why AI security is now a board-level topic
AI assistants embedded on your site create a new attack and data-leakage surface.
-
DNS and Email Security: Your First Line of Defense Against Brand Spoofing
How SPF, DKIM, DMARC and related DNS records protect your brand from spoofing — and what Guardbee checks.
-
Exposed .env and .git: quiet data disasters
Misconfigured servers can expose source code or secrets to the internet — often unnoticed.
-
Cookie security and privacy: trust meets compliance
Insecure cookies enable session risk; transparent consent reduces legal and reputation exposure.
-
Security headers: invisible risks with real cost
Headers like CSP, HSTS, and X-Frame-Options reduce clickjacking and script injection risk.
-
HTTPS and SSL: the first layer of customer trust
Encryption is not just a technical detail — it is a business requirement for trust and conversion.
-
Reverse Shield: what a shipped app gives a reverse engineer
An MCP server that audits a shipped web, Electron, Android, native, or .NET build for what a reverse…
-
OWASP Scan: MCP security scan
One OWASP MCP Top 10 scan. Runs the Guardbee auditors against a path or a live tools/list, maps…
-
Context Oversharing Auditor: MCP security scan
Audits agent and MCP source for context oversharing. Flags unrestricted session or memory dumps and context shared across…
-
Unbounded Consumption Auditor: MCP security scan
Scans LLM and agent code for unbounded consumption. Flags missing output-token limits, missing timeouts, unbounded tool-call loops, and…
-
Slopsquat Scanner: MCP security scan
Checks dependencies declared in package.json, requirements.txt, and pyproject.toml against the real npm and PyPI registries. Flags names that…
-
A2A Auditor: MCP security scan
Scans Agent2Agent implementations for unauthenticated push-notification webhooks, Agent Cards that require no authentication, and credentials embedded in public…
-
Threat Rules: MCP security scan
Bridge to Agent Threat Rules. Detects prompt injection, tool poisoning, and MCP attacks at runtime, and points each…
-
MCP Config Auditor: MCP security scan
Audits Cursor, Claude, Windsurf, and VS Code MCP configs plus agent SKILL.md files. Flags unpinned packages, secrets, wildcard…
-
Audit Gap Auditor: MCP security scan
Audits MCP server source for missing audit and telemetry. Flags absent tool-call trails, raw arguments in logs, a…
-
Toxic Flow Auditor: MCP security scan
Audits an MCP tool catalog for toxic flows, the lethal trifecta of untrusted content, sensitive data, and exfiltration…
-
Elicitation Auditor: MCP security scan
Scans MCP server code for elicitation anti-patterns in the 28 July 2026 spec. Flags form mode that asks…
-
MCP OAuth Auditor: token passthrough & audience risks
Scan MCP server auth code for token passthrough, missing audience validation, discovery SSRF, PKCE, redirect checks, and hardcoded…