Threat detection

The SimplyScan Security Engine applies fixed rules to request events: credential stuffing, brute force, scraping, sensitive-path scanning, enumeration and prompt-injection markers. Pro Monitoring also checks scripts, DNS, lookalikes and new exposures daily. Certificate Transparency requires service configuration. Baselines learn the first successful observation and alert on subsequent changes.

1. Verify and create a key

Add your app under Uptime. Verify domain ownership in your dashboard. Open Threats, select the app and create an ingest key. Save it as SIMPLYSCAN_INGEST_KEY in your server environment. It is shown once. Keep it out of browser bundles and version control.

2. Install your server helper

Download simplyscan-beacon.mjs and the adapter for your stack into the same server directory:

• Supabase Edge Functions / Deno: wrap your handler with withSimplyScan(handler, trustedClientIp) and pass that to Deno.serve. EdgeRuntime.waitUntil flushes the batch.
• Node / Express: app.use(simplyscanMiddleware) before your routes. It records final response statuses and flushes every five seconds.
• Next.js middleware: install as middleware.ts and adjust the helper import. Middleware sees its own response status only: wrap your auth route handler to record its final 401/200 and pseudonymous account ID for credential-stuffing detection.

3. Select safe evidence

Send method, pathname, status and a trusted client IP. Configure your host’s trusted proxy boundary first: arbitrary forwarded headers can be spoofed. Optional fields are user agent, a pseudonymous account ID and an explicitly selected prompt excerpt (256 characters). Never send passwords, cookies, authorization headers, full bodies or query strings. Do not pass a request object to record(). Use flush() in your platform’s background-task hook; for long-lived servers flush on a timer and graceful shutdown.

beacon.record({ method: 'POST', path: '/auth/login', status: 401,
  ip: trustedClientIp, userId: pseudonymousAccountId });
await beacon.flush();

Monitoring REST API, local-code MCP and owner database checks

Limits and privacy

Each request holds 1–100 events and at most 64 KiB. Ingest allows 60 batches per key and 120 per source IP per minute. Raw evidence has a 2 MiB per-app budget and expires after 20 minutes (cleanup every five minutes); aggregate alerts expire after 30 days and are capped to 512 per app. Failed or oversized telemetry is dropped without blocking your app. Events from inactive subscriptions are rejected. Threat details are private and never included in public status pages.

What an alert means

A script, DNS or certificate change is a signal to review, not proof of compromise. Script files are SHA-256 hashed; third-party scripts are tracked by origin. Failed or truncated checks preserve the previous baseline. Lookalike checks cover up to 40 deterministic candidates, not every possible domain. Alerts go to your account email and enabled Slack, GitHub and Linear integrations. One type/actor receives at most one notification batch in 24 hours.

Supabase auth-log connection appears only after the official OAuth integration is configured. No management token belongs in browser code.