Skip to main content
Periphery is a search console over web applications that anyone can reach on hosting and platform providers such as Vercel, Netlify, Lovable, Railway, and Heroku. For each application it records what an anonymous visitor sees, and lets you search across all of it.

​
What a record holds

Each indexed application, an app in Periphery, is one hostname on a provider suffix, such as acme-dashboard.vercel.app. Its record holds:
  • The page title, the visible text, and a screenshot.
  • The HTTP status the app last answered with.
  • The favicon and its hash, for finding clones.
  • Email addresses found on the page.
  • Strings shaped like API keys or secrets found in the page source, and whether they were verified as live.
  • When the app was first and last seen.
Everything comes from public URLs, fetched without authentication. Periphery never bypasses access controls or exploits anything; it records what is already visible.

​
Who it is for

  • Security teams checking what their organisation has left exposed on platforms outside the corporate perimeter.
  • Researchers looking for a pattern across many apps: a leaked key type, a phishing kit, a vulnerable template.
  • Platform operators who want to see what is running under their suffixes.

​
Three ways in

The console

Search, filter, and open app pages in the browser at console.periphery.exposed.

The API

The same search and app records as JSON, on the Plus plan.

The MCP server

Claude, ChatGPT or your own agent searches and reads app records for you, on the Plus plan.

​
Start here

Sign in

Google or a magic link. No invitation needed.

Your first search

Type a domain and read the results.

Understand a result

Separate attribution signals, snapshot evidence, and current state before you act.

Respond to a finding

Triage an unexpected app, exposed credential, or possible clone.