Bastion

Methodology

How Bastion works

Bastion only looks at what any visitor to your site can already see, using a small number of ordinary page requests.

What it checks

  • Verifies you own the domain (DNS TXT record or well-known file) before every audit
  • Checks HTTPS, certificate trust and HTTP→HTTPS redirects
  • Reviews security headers: HSTS, CSP, frame protection, nosniff, referrer and permissions policies
  • Inspects cookie Secure, HttpOnly and SameSite flags
  • Detects advertised software versions (e.g. PHP, Apache, nginx, OpenSSL, WordPress)
  • Matches versions to the U.S. National Vulnerability Database, flagging CISA known-exploited flaws
  • Flags end-of-life software that will never receive security patches
  • Looks for a handful of commonly exposed files (.git, .env, phpinfo) with single requests
  • Produces an AI risk analysis from Dr. Z focused on zero-day exposure and priorities

What it never does

  • Attempt exploits or send attack payloads
  • Guess passwords or test logins
  • Crawl, fuzz or brute-force paths
  • Generate load or run denial-of-service style tests
  • Audit any domain whose ownership isn't verified
  • Replace a review of backend access controls and database policies

Known flaws, from PHP to Equifax

When a site advertises its software version, Bastion compares it with published vulnerability records — so a newly announced PHP flaw, or a Struts-class issue like the one behind the Equifax breach (CVE-2017-5638), shows up as soon as it's in the database. Sites that hide their versions are rewarded: attackers can't target what they can't see.

Zero-day exposure

A true zero-day can't be detected from outside. Bastion instead measures exposure: unsupported software, version banners, missing defense layers like CSP, and no disclosure contact. Dr. Z then explains which parts of your stack are most likely to be hit next and how to limit the blast radius.