composio.dev

18-check dossier · scoreboard above, section details below

embed badge

Markdown

[![Domain posture](https://www.domainposture.com/d/composio.dev/badge.svg)](https://www.domainposture.com/d/composio.dev)

HTML

<a href="https://www.domainposture.com/d/composio.dev"><img src="https://www.domainposture.com/d/composio.dev/badge.svg" alt="Domain posture" /></a>

Scanning…

dns

info

Open standalone →

resolving…

mx

info

Open standalone →

resolving mx…

spf

info

Open standalone →

resolving spf…

dmarc

info

Open standalone →

resolving dmarc…

dkim

info

Open standalone →

probing dkim selectors…

tls

info

Open standalone →

fetching tls cert…

redirects

info

Open standalone →

tracing redirects…

headers

info

Open standalone →

fetching headers…

cors

info

Open standalone →

sending preflight…

web-surface

info

Open standalone →

inspecting web surface…

dnssec

info

Open standalone →

checking dnssec…

mta-sts

info

Open standalone →

checking mta-sts…

tls-rpt

info

Open standalone →

checking tls-rpt…

whois

info

Open standalone →

resolving whois…

ct-log

info

Open standalone →

querying CT logs…

AI & content posture

ai-crawlers

info

Open standalone →

checking ai-crawler policy…

llms-txt

info

Open standalone →

checking llms.txt…

security-txt

info

Open standalone →

checking security.txt…

additional context — IP + user-agent lookups

lookups that complement a dossier — useful when investigating a finding, but not part of the dossier engine itself.

IP lookup — geolocation, ASN, ISP for any IP address surfaced by the DNS or redirect sections.
user-agent parser — the browser/OS/device the request came from.
single-record DNS lookup — drill into one record type at a time.

Free beta

Unlock your full scan (free beta)

Add one DNS TXT record to prove you own the domain, then we run a deeper active scan — exposed secrets and config — and send you a private report. Free beta, no payment.

Finds exposed .env / .git / backups and other sensitive files
Verified by a DNS TXT record, so only you can run it on your domain
A private report emailed straight to you

Unlock full scan

composio.dev

18-check dossier · scoreboard above, section details below

Get the report →

embed badge

Markdown

[![Domain posture](https://www.domainposture.com/d/composio.dev/badge.svg)](https://www.domainposture.com/d/composio.dev)

HTML

<a href="https://www.domainposture.com/d/composio.dev"><img src="https://www.domainposture.com/d/composio.dev/badge.svg" alt="Domain posture" /></a>

A-

Audit-ready · 6 minor advisories

Aggregate grade across 18 checks. Auditors typically flag any High-severity finding.

Pass: 12
Warn: 6
Fail: 0

What an auditor would flag first

low
SPF
~all softfail — enforcement deferred to DMARC
SOC 2 CC6.7ISO 27001 A.8.20
low
TLS certificate
cert expires in 71 days
SOC 2 CC6.1ISO 27001 A.8.24
low
Security headers
5 security header(s) missing
SOC 2 CC6.6ISO 27001 A.8.23

Need this as an artifact your auditor can verify?

Your composio.dev scan flagged 6 low findings. The signed report covers the apex plus up to 100 CT-discovered subdomains, Ed25519-signed and ISO-timestamped, delivered in 10–30 minutes.

Signed or refunded within 30 days — the same evidence a consultant bills $500+ in hours to assemble.

Get the report →See methodology See a sample$29

Scanning…

18-check summary

DNS recordsA/AAAA records present
MX5 MX record(s) present
SPF~all softfail — enforcement deferred to DMARC
DMARCp=reject — strict policy
DKIM2 valid DKIM selector(s)
TLS certificatecert expires in 71 days
Redirect chainHTTPS served correctly
Security headers5 security header(s) missing
CORSCORS allows all origins (wildcard)
Web surfaceHTTPS surface reachable (robots ✓, sitemap ✓, title ✓)
MTA-STSnot applicable: no _mta-sts TXT record
TLS-RPTnot applicable: no TLSRPT record
DNSSECDNSSEC not configured — no DS or DNSKEY records found
WHOISdomain registered until 2030-04-02
Certificate Transparencycheck failed: crt.sh: AbortError: This operation was aborted; certspotter: Error: certspotter http 429
AI crawlersno AI-crawler policy declared — GPTBot, Claude, Perplexity default to allowed
llms.txtpublishes llms.txt — an AI-agent content index
security.txtno security.txt — researchers have no published way to report issues

dns

info

Open standalone →

A/AAAA records present

Why it matters: Without authoritative A or AAAA records on the apex, the domain is unreachable. Missing baseline DNS shows up in vendor reviews as evidence of unmanaged infrastructure (SOC 2 CC6.6).

A: ttl=221 104.18.20.5
ttl=221 104.18.21.5
AAAA: ttl=300 2606:4700::6812:1405
ttl=300 2606:4700::6812:1505
NS: ttl=86400 serenity.ns.cloudflare.com.
ttl=86400 simon.ns.cloudflare.com.
SOA: ttl=1800 serenity.ns.cloudflare.com. dns.cloudflare.com. 2413726217 10000 2400 604800 1800
CAA: ttl=300 0 issue "amazontrust.com"
ttl=300 0 issue "comodoca.com"
ttl=300 0 issue "digicert.com; cansignhttpexchanges=yes"
ttl=300 0 issue "letsencrypt.org"
ttl=300 0 issue "pki.goog; cansignhttpexchanges=yes"
ttl=300 0 issue "ssl.com"
ttl=300 0 issuewild "amazon.com"
ttl=300 0 issuewild "comodoca.com"
ttl=300 0 issuewild "digicert.com; cansignhttpexchanges=yes"
ttl=300 0 issuewild "letsencrypt.org"
ttl=300 0 issuewild "pki.goog; cansignhttpexchanges=yes"
ttl=300 0 issuewild "ssl.com"
TXT: ttl=300 "MS=ms54189639"
ttl=300 "facebook-domain-verification=wwfei7uqypr4ew83od4an7qvh1afgk"
ttl=300 "fbf29c5c338e548fdeec9da0792d027c570f74c15d555ed6336f794ad2f30901"
ttl=300 "google-site-verification=7AGinsmiV08rB0FYyiaxOTO6FF6DsJY96x0PMGhdPA8"
ttl=300 "google-site-verification=GT9V4OvLP9TGJdADBF4fQOsk0UllZiHS7fvs1yGlUmw"
ttl=300 "google-site-verification=JAd01sAq3rDHs3ClItjrHZJWGkL3G2yDNfxZhpzl3WQ"
ttl=300 "google-site-verification=ZbLAosDUbPz5USgsdkiQbYuYHqwVtSx_3BOprVyb-gU"
ttl=300 "google-site-verification=lO_YvnNsuZoPl0kLMocQzRs7ZcHoK-dvA2o__g4Kah4"
ttl=300 "google-site-verification=ms1btpSGsMFfSvNaQWTUPcUT9C_5_S3QA1_N0knOXH0"
ttl=300 "hubspot-developer-verification=NWUxNTEzYTUtZDdkNi00OTliLTkzYzUtZjAyZGE5YTViZDg0"
ttl=300 "notion-domain-verification=lYyljweLk96oydSL4NyZulW1dLTM1SnEyS1ti8jHLYm"
ttl=300 "openai-domain-verification=dv-d6luEi066K8VedloSbdNoDuI"
ttl=300 "slack-domain-verification=Mz7QBBFknEXMxDAV0nImb9enCIktLG5YQRZy69e1"
ttl=300 "tiktok-developers-site-verification=FpHYyysTCkGuhFgAZfFVXGePuKHghurF"
ttl=300 "turbopuffer-domain-verification-gbdk89=UTHpusfpMuBRPyJCGkFjFVAtc"

fetched 2026-09-02T07:05:01.389Z

dns

info

Open standalone →

resolving…

mx

info

Open standalone →

5 MX record(s) present

Why it matters: MX records direct inbound mail. Misconfiguration silently breaks email delivery and lets attackers stand up parallel MX hosts for spoofing campaigns (ISO 27001 A.8.21).

pri=1 aspmx.l.google.com.
pri=5 alt1.aspmx.l.google.com.
pri=5 alt2.aspmx.l.google.com.
pri=10 alt3.aspmx.l.google.com.
pri=10 alt4.aspmx.l.google.com.

fetched 2026-09-02T07:05:01.392Z

mx

info

Open standalone →

resolving mx…

spf

low

Open standalone →

~all softfail — enforcement deferred to DMARC

Why it matters: SPF tells receiving servers which hosts may send mail for the domain. Without it, any sender can forge the envelope-from — the primary mechanism behind business-email-compromise (SOC 2 CC6.7).

Recommendations

Softfail is fine when DMARC is enforced (p=quarantine/reject); switch to -all for SPF-level hardening if you don't rely on mail forwarding

v=spf1 include:_spf.google.com ~all

v=spf1
include:_spf.google.com
~all

fetched 2026-09-02T07:05:01.413Z

spf

info

Open standalone →

resolving spf…

dmarc

info

Open standalone →

p=reject — strict policy

Why it matters: DMARC binds SPF and DKIM into an enforceable policy (quarantine or reject) and surfaces spoofing attempts via aggregate reports. `p=none` or absent means spoofing succeeds silently (SOC 2 CC6.7).

v=DMARC1; p=reject; rua=mailto:[email protected],mailto:[email protected]; fo=1;

v=: DMARC1
p=: reject
rua=: mailto:[email protected],mailto:[email protected]
fo=: 1

fetched 2026-09-02T07:05:01.426Z

dmarc

info

Open standalone →

resolving dmarc…

dkim

info

Open standalone →

2 valid DKIM selector(s)

Why it matters: DKIM signs outbound mail so receivers can detect tampering. Missing selectors or rotated-away keys break DMARC alignment and let receivers downgrade trust (ISO 27001 A.8.24).

google:: v=DKIM1; k=rsa; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAszSAtKayfUAmC8ybdDo2QvTn6/ecJszR9134pN5RuJcGNb4BJXlbmYahfoDaS2rK9yQ4oGhhF+jMHaj961TKJDNIiBiORT11h0tjRsxKi7n9gpB923s13Uf6raNyavwv1qMgmyJb2HEkkUlYmlyQ5vH0tRho0j8JKJJItqYRyXRZ5qpSxxr9HIc/efSc9eFuPEVBA1ruSFrCQ6+z1DPIHrR0kKUkdihprAh3xvtWRgXQoejfMRx5/TdzAFbeoQj61/p+xQw+K2HyCljI+BUUIF9qCh7WsKn/MrhAqokHYryUbR+CiYpzli9LDY76tNA5al8H6Z5q6d8PDdKfyCnscQIDAQAB
resend:: p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC+cQkb/OdrCRphEIt10vMZfQx69edGZ+L+EMRYrNMmxf+MN2hN0LbA4bW2LQHXP4v0/E3LagaJEoip9Z9n+IhR3uEOFfqHdmITkxYal95vvoaJulw1BEyft+63W30PWSIHc5gY/sMVTLkZ/HgNQJI5hzSvsSPTYlKdT5uaXolsCwIDAQAB

fetched 2026-09-02T07:05:01.495Z

dkim

info

Open standalone →

probing dkim selectors…

tls

low

Open standalone →

cert expires in 71 days

Why it matters: A valid current TLS certificate is the baseline for data in transit. Expiry, weak chain, or hostname mismatch break HTTPS and fail PCI 4.2.1 / SOC 2 CC6.1.

Recommendations

Schedule certificate renewal — consider enabling auto-renewal

subject cn:: composio.dev
issuer:: WE1 / Google Trust Services
valid:: Aug 14 12:50:21 2026 GMT → Nov 12 13:50:08 2026 GMT
authorized:: yes
sha256:: E1:68:4A:A7:84:A9:CE:FA:8F:B8:70:AC:CA:1E:A6:16:AB:EE:62:E0:77:71:3A:E1:96:CE:84:71:C8:F4:4D:60
sans: composio.dev
seg-cdn.composio.dev

fetched 2026-09-02T07:05:01.440Z

tls

info

Open standalone →

fetching tls cert…

redirects

info

Open standalone →

HTTPS served correctly

Why it matters: Bare HTTP requests must redirect to HTTPS without dropping the user mid-chain. Plain-text fallback or open redirects fail PCI 4.2.1 and feed phishing chains (SOC 2 CC6.6).

final status: 200 · 1 hop

[200] https://composio.dev/

fetched 2026-09-02T07:05:01.685Z

redirects

info

Open standalone →

tracing redirects…

headers

low

Open standalone →

5 security header(s) missing

Why it matters: Security headers — HSTS, CSP, X-Frame-Options, Referrer-Policy — defend against XSS, clickjacking, and downgrade attacks. Absent headers map directly to OWASP ASVS V14 findings (ISO 27001 A.8.23).

Recommendations

Add response header — Content-Security-Policy: default-src 'self' (tune per app)
Add response header — X-Frame-Options: DENY (or SAMEORIGIN if framing is intended)
Add response header — X-Content-Type-Options: nosniff
Add response header — Referrer-Policy: strict-origin-when-cross-origin
Add permissions-policy response header

final url: https://composio.dev/

security headers

strict-transport-security: max-age=63072000
content-security-policy: —
x-frame-options: —
x-content-type-options: —
referrer-policy: —
permissions-policy: —

other headers

access-control-allow-origin: *
age: 44927
cache-control: public, max-age=0, must-revalidate
cf-cache-status: DYNAMIC
cf-ray: a34aa9f85a0908fe-BOM
connection: keep-alive
content-disposition: inline
content-encoding: gzip
content-type: text/html; charset=utf-8
date: Wed, 02 Sep 2026 07:05:01 GMT
server: cloudflare
transfer-encoding: chunked
vary: rsc, next-router-state-tree, next-router-prefetch, next-router-segment-prefetch, accept-encoding
x-matched-path: /
x-nextjs-prerender: 1
x-nextjs-stale-time: 300
x-vercel-cache: HIT
x-vercel-id: bom1::fttgt-1788332701496-d0d831fd9484

fetched 2026-09-02T07:05:01.622Z

headers

info

Open standalone →

fetching headers…

cors

low

Open standalone →

CORS allows all origins (wildcard)

Why it matters: Overly permissive CORS (wildcard with credentials, or reflected origin) lets any origin read authenticated responses from this domain. OWASP A05 misconfiguration territory (NIST AC-4).

Recommendations

Restrict Access-Control-Allow-Origin to specific trusted origins if this API is not fully public

origin: https://domainposture.com
method: GET
preflight status: 204

access-control-* headers

access-control-allow-origin: *
access-control-allow-methods: OPTIONS, GET, HEAD
access-control-allow-headers: —
access-control-allow-credentials: —
access-control-max-age: —
access-control-expose-headers: —

fetched 2026-09-02T07:05:01.678Z

cors

info

Open standalone →

sending preflight…

web-surface

info

Open standalone →

HTTPS surface reachable (robots ✓, sitemap ✓, title ✓)

Why it matters: Public files — robots.txt, sitemap.xml, head meta — are what attackers see first during reconnaissance. Misadvertised paths, stale sitemaps, and verbose generators leak more than intended (ISO 27001 A.8.9).

robots.txt

present

User-Agent: *
Allow: /
Disallow: /design-audit

Sitemap: https://composio.dev/sitemap.xml
Sitemap: https://composio.dev/toolkits/sitemap.xml
Sitemap: https://composio.dev/toolkits/framework-sitemap.xml

sitemap.xml

present — 380 url(s)

head

title: Composio
description: Just-in-time tool calls, secure delegated auth, sandboxed environments, and parallel execution across 1,000+ apps.

social

og:title: Composio
og:description: Just-in-time tool calls, secure delegated auth, sandboxed environments, and parallel execution across 1,000+ apps.
og:url: https://composio.dev
og:type: website
twitter:card: summary_large_image
twitter:title: Composio
twitter:description: Just-in-time tool calls, secure delegated auth, sandboxed environments, and parallel execution across 1,000+ apps.

fetched 2026-09-02T07:05:01.809Z

web-surface

info

Open standalone →

inspecting web surface…

dnssec

low

Open standalone →

DNSSEC not configured — no DS or DNSKEY records found

Why it matters: DNSSEC cryptographically signs DNS responses, blocking cache-poisoning attacks. US federal civilian agencies are required to enable it under OMB M-22-09 (NIST SC-20).

Recommendations

Enable DNSSEC in your DNS provider's control panel and add the resulting DS record at your registrar

enabled: no
DS records: —
DNSKEY records: —

fetched 2026-09-02T07:05:01.593Z

dnssec

info

Open standalone →

checking dnssec…

mta-sts

info

Open standalone →

not applicable: no _mta-sts TXT record

Why it matters: MTA-STS forces inbound SMTP to use TLS and refuse downgraded connections. Without it, an in-path attacker can strip TLS and read mail in plaintext (SOC 2 CC6.7).

no _mta-sts TXT record

mta-sts

info

Open standalone →

checking mta-sts…

tls-rpt

info

Open standalone →

not applicable: no TLSRPT record

Why it matters: TLS-RPT publishes a reporting address for SMTP-TLS failures. Without it, downgrade attacks on inbound mail go unnoticed (SOC 2 CC7.2).

no TLSRPT record

tls-rpt

info

Open standalone →

checking tls-rpt…

whois

info

Open standalone →

domain registered until 2030-04-02

Why it matters: Registrar and expiry tell auditors the domain is owned, current, and not about to lapse. An expired or about-to-expire domain fails business-continuity evidence (SOC 2 A1.2).

registrar: GoDaddy.com, LLC
created: 2023-04-02T07:10:15.352Z
expires: 2030-04-02T07:10:15.352Z
statuses: client delete prohibited, client renew prohibited, client transfer prohibited, client update prohibited

fetched 2026-09-02T07:05:02.455Z

whois

info

Open standalone →

resolving whois…

ct-log

info

Open standalone →

check failed: crt.sh: Error: crt.sh http 502; certspotter: Error: certspotter http 429

Why it matters: Every certificate issued for this domain is published in Certificate Transparency logs — including subdomains you may have forgotten. Unknown subdomains in CT are pre-disclosed attack surface (ISO 27001 A.8.16).

crt.sh: Error: crt.sh http 502; certspotter: Error: certspotter http 429

ct-log

info

Open standalone →

querying CT logs…

AI & content posture

ai-crawlers

info

Open standalone →

no AI-crawler policy declared — GPTBot, Claude, Perplexity default to allowed

Why it matters: Whether a domain has told the major AI crawlers (GPTBot, ClaudeBot, Google-Extended, PerplexityBot, and others) anything in robots.txt. With no policy declared, those agents default to crawling the site for model training and answer-engine retrieval. This is a content-governance stance, not a vulnerability — an audit records the declared position so a buyer knows whether the vendor has made a deliberate choice about AI access to its content.

Recommendations

Declare an AI-crawler stance in robots.txt (e.g. `User-agent: GPTBot` / `Disallow: /`) if you want to opt out of AI training and answer engines

robots.txt present

GPTBot: unspecified
ClaudeBot: unspecified
Google-Extended: unspecified
PerplexityBot: unspecified
CCBot: unspecified
meta-externalagent: unspecified

fetched 2026-09-02T07:05:01.730Z

ai-crawlers

info

Open standalone →

checking ai-crawler policy…

llms-txt

info

Open standalone →

publishes llms.txt — an AI-agent content index

Why it matters: Whether a domain publishes an llms.txt — an emerging convention that gives AI agents a curated markdown index of the site's content, the way robots.txt and sitemap.xml guide search crawlers. Its presence signals a site that intentionally guides AI agents rather than leaving them to scrape blindly. Informational in an audit: it shows AI-readiness maturity, not a security control.

first line: # Composio - The Skill Layer of AI
size: 4827 bytes

fetched 2026-09-02T07:05:02.032Z

llms-txt

info

Open standalone →

checking llms.txt…

security-txt

low

Open standalone →

no security.txt — researchers have no published way to report issues

Why it matters: Whether a domain publishes a security.txt (RFC 9116) at /.well-known/security.txt — the standard, machine-readable channel that tells security researchers how to report a vulnerability. Without one, a researcher who finds an issue has no published route to disclose it responsibly, so reports get dropped or go public. A published disclosure contact is a baseline expectation in a security review, which is why its absence is flagged.

Recommendations

Publish /.well-known/security.txt (RFC 9116) with a `Contact:` field so vulnerability reports have a route

no security.txt (http 404)

security-txt

info

Open standalone →

checking security.txt…

additional context — IP + user-agent lookups

lookups that complement a dossier — useful when investigating a finding, but not part of the dossier engine itself.

IP lookup — geolocation, ASN, ISP for any IP address surfaced by the DNS or redirect sections.
user-agent parser — the browser/OS/device the request came from.
single-record DNS lookup — drill into one record type at a time.

Free beta

Unlock your full scan (free beta)

Add one DNS TXT record to prove you own the domain, then we run a deeper active scan — exposed secrets and config — and send you a private report. Free beta, no payment.

Finds exposed .env / .git / backups and other sensitive files
Verified by a DNS TXT record, so only you can run it on your domain
A private report emailed straight to you

Unlock full scan