SWOGE Security

Defensive bug bounty & OSINT — read-only, authorized targets only.

These tools only read: public OSINT, already-collected exposure data, on-chain contract source. No active scanning, no exploitation, no credential attacks. A target must be in a bug-bounty program scope, or you must tick the box that attests you are authorized to assess it. Ticking it does not grant permission — you are responsible.

Your network, from the outside

One click reads your own public IP exposure (ports, CVEs, device type) from already-collected data — no scan, no authorization needed (it is your connection). A web page can't scan the LAN you're on; this is the honest, legal view.

Contract pre-audit

Paste Solidity source. A static assist (access control, reentrancy, rounding, oracle), precision-first — a lead to verify, never a verdict. Nothing leaves as an action.

Solidity source

Dependency vulnerabilities

Known CVEs for a package version, from OSV.dev (public database, like NVD). No target is contacted.

Ecosystem Package Version (optional)

Targeted tools — authorization required

For the three below, either the target is in a program scope you enter, or you tick the attestation.

Loading the exact authorization statement…

Your name / handle (logged with the attestation)

…or a program scope (comma-separated), if the target is in a bug-bounty program

Authorized recon (passive)

Public OSINT on a domain or on-chain address — DNS, RDAP, certificate transparency, the target's own pages (robots.txt respected). Read-only.

Domain or on-chain address

Can I sell? (Robinhood Chain)

Simulates a real buy + sell round trip on-chain for a token — the thing GoPlus leaves as « tax unknown » on this chain. Read-only. Shows the round-trip cost, the pool, the liquidity and whether the LP is burned.

Token contract (0x…)

Passive exposure (IP)

Open ports & known CVEs an IP already exposes, read from Shodan InternetDB — already collected, no packet is sent to the target. This is the safe stand-in for a port scan. It also guesses the device type (website, router, mail server, camera, PC, phone behind NAT…) from the passive data.

IPv4 address

Dark-web monitoring (.onion)

Read a public .onion page to check your own exposure (your contract address, domain, leaked credentials). Read-only (GET). This is not a free-roam browser, and it is off unless a Tor daemon is configured server-side.

http:// <host>.onion/…

Not available here, by design: SQL injection, password cracking of others' hashes, port scanning that sends packets, or any active intrusion — no checkbox unlocks those.