Submit the domain
Every request starts with domain validation, normalization, and input controls before any public fetch begins. Invalid, private-address, localhost, and suspicious targets are rejected up front.
How it works
How KMayer Exposure Lens AI moves from passive-first review to a governed deeper lane.
Every anonymous request starts in passive_public. Private results unlock after email verification, and the same product family deepens only when ownership, engagement, and approved evidence sources are in place.
Queue the passive_public review
The default entry lane collects public DNS, HTTPS reachability, TLS basics, mail-authentication posture, visible headers, trust files, indexing signals, and a tightly capped set of same-host public pages.
Verify the request email
A one-time verification link is sent to the request email so the private result cannot be opened casually if the opaque URL is forwarded or discovered out of context.
Open the private results
After verification, the unlocked page can show the executive summary, technical highlights, risk themes, recommended next steps, and the trust or business context available for the current review.
Activate authorized_deep only when eligible
The deeper lane is governed. It applies only when verified ownership, an active authorized engagement, and the right approvals exist for the reviewed domain or account.
Deepen continuity where it helps
When the governed lane is active, read-only connectors, approved trusted exports, monitoring, history, and deeper explainability can extend the evidence without changing the passive public boundary.
Included
What the product is designed to surface
- Public passive evidence from DNS, mail posture, HTTPS and TLS, visible headers, trust files, indexing signals, and a capped set of same-host public pages.
- Private results with executive summary, technical highlights, risk themes, recommended next steps, and the trust or business context the current review supports.
- When eligible, authorized_deep can add read-only connectors, approved trusted exports, and monitoring or history context without widening the anonymous public lane.
Excluded
What the product deliberately does not do
- No brute-force subdomain enumeration, hidden-path discovery, port scanning, exploit behavior, or authenticated testing in the public lane.
- No anonymous access to authorized_deep, and no connector or upload evidence without explicit authorization and approval gates.
- No promise of complete asset visibility: the product begins as an external visibility review, not a full security assessment or offensive test.
Results and privacy
Private delivery, governed deeper activation, and noindex handling are built in.
Each review runs asynchronously, then the completed results stay behind a private route that requires both an opaque URL token and a one-time email verification step. The public informational pages remain indexable, but private results stay non-indexed and excluded from sitemap discovery.
passive_public is the default entry lane. authorized_deep applies only when verified ownership, active engagement, and approved evidence sources are in place, and read-only connectors or trusted exports deepen evidence only in that governed lane. Monitoring and history can continue after the initial review when that continuity is enabled.
