A precise question, a focused answer
Separate searches for websites, email domains, and exact emails. Include subdomains only when you need them.
EXPOSURE INTELLIGENCE. VERIFIED SCOPE.
Exposed credentials.A clear next move.
Know when your organization’s credentials surface. Investigate the exposure, find the affected accounts, and put the right information in your team’s hands.
For security teams. Only the domains you verify.
Built for authorized defense
DNS-verified domains
Private team workspace
Alerts where you work
Your domains.
Your team. In control.
From proof of ownership to an actionable finding. A focused workflow for the security and IT teams responsible for protecting your organization.
Verify your domains
Publish a DNS TXT record for each domain you own. Search and monitoring unlock once it checks out.
DNS TXT ownership checkFind what’s exposed
Search a domain and its subdomains, a single host, an email domain, or one work email.
Search, investigate, exportTell the right people
New matches are grouped into short digests and sent to wherever your team already works.
Email, chat, and webhooks
02 / YOUR EXPOSURE COMMAND CENTERYour exposure picture.
PRODUCT PREVIEW Fictional example data. Your workspace is scoped to your verified domains.
Your exposure picture.
Finally, in focus.
See what surfaced, who’s affected, and where to investigate next. One organization dashboard, built around the domains you’ve verified.
ORGANIZATION OVERVIEW
Explore search Dashboard
Full history, rebuilt every night · example snapshot
New this week 28 33% more than last week4 in the last 24 hours
Total exposures2,3801,840 on your sites · 540 elsewhere
Affected people212distinct employee accounts
Affected hosts37your sites and subdomains
Third-party siteswhere your people’s logins leaked
86New · 30 days292 in 90 days
104Exposed accountsat your email domains
540EXPOSURE ACTIVITY
From the overview to the evidence.
Weekly new exposures, last 52 weeks
1 YEARWhen records first entered the index
Oct 20Oct 12
790 new in the last yearBusiest week: Aug 31 (29)
Where exposures were found
ALL TIMEYour websites and your people’s accounts on other sites
- Your sites
- 1,84077.3%
Credentials exposed on your organization’s websites.
- Your people, elsewhere
- 54022.7%
Accounts at your verified email domains, exposed on other sites.
Each exposure is counted in one group. This breakdown covers the full indexed history.
Most affected hosts
- login.example.com82 accounts420
- mail.example.com61 accounts310
- vpn.example.com39 accounts180
Most exposed people
- [email protected]6 sites14
- [email protected]4 sites9
PASSWORD PATTERNS
From indexed recordsSignals worth a closer look.
32 people reuse one password across different sites
8 passwords are shared by two or more of your people
119 exposed passwords are shorter than 8 characters (5% of all)
Where your people’s logins leaked
Third-party sites, by number of your people exposed there
- collaboration.example56 exposures24
- storage.example32 exposures18
- design.example21 exposures12
Findings are limited to verified scope. First indexed is not the breach date; a record does not confirm that a credential is still valid.
- 01
Understand the change
Newly indexed exposures alongside last week’s figures, with a clear snapshot update time.
- 02
See the bigger picture
A full year of weekly activity, separating your websites from employee accounts on other sites.
- 03
Focus your investigation
Move from affected hosts and people directly into a scoped search of the underlying records.
- 04
Spot password patterns
Understand reuse, shared passwords, and short passwords found in indexed exposure records.
03 / FROM SIGNAL TO EVIDENCE
Get straight to the records that matter.
Start broad with a domain. Narrow to a host or a person. Everything stays inside your organization’s verified domains.
v. RESEARCH WORKSPACE INTERACTIVE PREVIEW
One search. A wider view.
TRY IT BELOWA wider view of every host beneath a domain.4 RECORDS
| HOSTNAME | ACCOUNT | PASSWORD | FIRST INDEXED ↓ | Host type |
|---|---|---|---|---|
| login.example.com | [email protected] | Sunflower!2024 | Oct 04, 2026 | Subdomain |
| mail.example.com | [email protected] | mchen#Q3pass | Oct 03, 2026 | Subdomain |
| vpn.example.com | [email protected] | Vpn-access-77 | Oct 02, 2026 | Subdomain |
| portal.example.com | [email protected] | Portal2026$ | Oct 01, 2026 | Subdomain |
FICTIONAL SAMPLE RECORDS PRIVATE INDEX IN THE FULL CONSOLE
Try it. This preview uses fictional example.com records and never touches the real index.
Details you can act on
See the available URLs, accounts, and passwords for your domains. Copy a value or export the matching records to CSV.
An alert only helps if it reaches someone.
Connect the tools your team already watches. Pick a destination to see exactly what lands there.
# sec-alerts
Posted to the channel you connect — a summary, a few example accounts, and a workspace link. Never passwords.
- Each destination retries on its own
- Send a test before relying on it
- Rules for a host, domain, email, account, or URL
BUILT AROUND YOUR ORGANIZATION VERIFIED ORGANIZATIONS
One plan, shaped around your organization.
A private workspace we set up for your team, limited to the domains you prove you own. Tell us about your organization and we’ll tailor it with you.
Organization plan
For security and IT teams that need to know when their organization’s credentials surface, and want the right people told.
Tailored pricingBased on your domains and the size of your team.
Let’s find your fitOr write to [email protected]
A workspace for your team
- Admin and Viewer roles for your team
- Admins manage domains, teammates, and notifications
- Disable a user to end their sessions immediately
Scope you control
- As many owned domains as you need
- DNS TXT verification for each domain
- Searches, exports, and alerts stay inside it
Investigation
- An exposure dashboard with weekly trends
- Five precise search modes
- Full credential records and CSV export
Continuous monitoring
- Grouped email reports per domain
- Rules by host, domain, email, account, or URL
- Slack, Teams, Discord, and signed webhooks with retries
Getting started
Contact us
Tell us about your team and the domains you’re responsible for.
We set you up
We create your workspace and first admin account. You add your team.
You verify
Publish one DNS TXT record per domain you own.
You’re live
Search, export, and route new exposures to your team.
LET’S TALKYour next move
Your next move
starts here.
Tell us what you’re protecting. We’ll show you how Vuxep can help you understand your organization’s credential exposure.
- 01
A conversation about your scope
Your domains, your team, and the questions you need answered.
- 02
A guided product walkthrough
See the dashboard, investigations, and alert workflow in context.
- 03
A plan that fits
Discuss pricing and get help with workspace setup and domain verification.
Prefer a direct conversation?[email protected]
GOOD QUESTIONSBefore you
Before you
get started.
Straight answers about access, scope, and alerts.
Ask us something elseHow do we get access?
Vuxep is available on the organization plan. Email [email protected] and we’ll walk you through it, set up your workspace and first admin account, and help you verify your domains with a DNS TXT record. There is no public sign-up.
How do team permissions work?
Your first user is automatically an organization admin. Admins manage teammates, verify domains, and configure notifications. Viewers can use the dashboard, search verified data, and read organization settings without editing them. Admins can change roles or remove teammates, but cannot remove themselves.
What can our team investigate?
Websites, subdomains, company email domains, or an exact work email within your verified domains. Review the full available credential records and export your findings to CSV. Domains and identities you don’t own stay outside your workspace.
What does the dashboard show?
Your dashboard brings together exposure totals, affected people and hosts, a 52-week trend, password reuse indicators, and a breakdown by verified domain. Full-history snapshots are rebuilt nightly, with the update time displayed. A recent-record preview is available while the full dashboard is being built. First indexed is the date a record entered the index, not the date of a breach.
Where can notifications go?
Email, Slack, Discord, Microsoft Teams, or any HTTPS webhook. Your administrator connects each destination to a verified domain or a targeted rule. Chat alerts carry a short summary, a few example accounts, and a workspace link — never passwords. Signed webhooks stay machine-readable: a count and a workspace link, no accounts or passwords.
Can we choose exactly what triggers an alert?
Yes. Target an exact hostname, a website domain and its subdomains, a registered domain, an email domain, an individual email, an account, or a URL. Give each rule its own recipient, pause it, or turn off broad domain reports and keep only targeted rules.
Will every record send a separate message?
No. New matches are grouped into short digests before delivery. Notifications run in the background after records are saved, with automatic retries. Processing backlogs and provider availability can affect delivery time.
Does first indexed mean the date of a breach?
No. It records when a credential first entered the index, not when it was stolen or exposed. A finding also doesn’t prove a credential still works. Treat it as evidence for an investigation, not a confirmed incident.