The dashboard blind-spot
// why an external scan matters// THE DASHBOARD SHOWS (WHAT YOU CONFIGURED)
Your CloudFront behaviours, WAF association, origin access control, S3 Block Public Access settings, API Gateway authorizers, Lambda resource policies and ALB security groups — as configured in the AWS console.
// IT CAN'T SEE (NEWSCAN DOES)
Whether an attacker can reach the same application around CloudFront, whether a named storage endpoint actually lists or reads data anonymously, whether HTTP still serves the distribution, and whether CloudFront reports a cache hit for content marked private.
What NewScan records
// proven, then reproducedCloudFront origin reachable directly
HIGHA supplied or caller-enabled discovered S3 website, ALB, API Gateway or Lambda URL serves the same application without CloudFront headers. Edge WAF, rate limits, geo restrictions and signed-viewer policies can then be bypassed at the origin.
Public cloud-storage bucket or object
HIGHAn S3 listing document proves the bucket is world-listable; an HTTP 200 non-error body proves a supplied or listed object is world-readable. Sensitive files receive a content-verified finding.
CloudFront viewer permits plaintext HTTP
MEDIUMThe distribution answers HTTP 200 with CloudFront evidence rather than redirecting to HTTPS or refusing it.
CloudFront cache hit for content marked private
LOWRecorded as an observation, not a cross-user leak finding. The scan will not send a victim-polluting request; promotion needs a two-user proof.
What is never flagged
// the false-positive contractA scanner earns its place by what it stays quiet about. These are guarantees, each one asserted by a test that fails the build if it regresses — not best-effort tuning.
A CloudFront header or an AWS product name alone
Infrastructure inventory, not a vulnerability. Other AWS services are recorded only from an exact endpoint shipped by the application.
A public static asset in S3
Expected for many sites. NewScan requires a real listing, a confirmed object read, or a content-verified sensitive file before it records exposure.
WAF, OAC, IAM, API Gateway, Lambda or ALB dashboard settings
They are not externally observable with enough certainty. NewScan does not invent a posture finding from a service fingerprint.
An AppSync endpoint URL
Inventory only. The existing GraphQL checks own introspection, authorization, injection, SSRF and other GraphQL findings once the endpoint is scanned in scope.
How it's proved
// tests/integration/cloudfront_checks.py + cloud_checks.pyKey-free controls prove that an unrelated origin, a cache miss, a private bucket, an absent bucket and an error-shaped object response all stay silent. The positive arms require CloudFront response evidence plus same-app correlation, or a provider-specific storage listing/object response.
// FINGERPRINT FIRST
The check is silent unless the product is confirmed by two independent signals. A single, spoofable marker confirms nothing.
// REPRODUCE BEFORE RECORD
Every finding is re-run by our own detector before it is written down. A model's self-assessment is discarded, not merged.
// SEVERITY THAT MAPS
One calibrated severity per finding, translated into PCI DSS, SOC 2, ISO 27001, HITRUST, HIPAA and NIST 800-53 ratings with remediation SLAs.
Run it against your own AWS
NewScan is free and self-hosted — bring your own key. Every check on this page runs in the deterministic floor with no model and no provider key at all, so scanning your own AWS surface is local to you and depends on no hosted resource.