# External check — <Company type>, <Region>

**Date:** YYYY-MM-DD
**Scope:** external only — what anyone on the internet can see. No access was granted or used.
**Targets:** <apex domain>, <app domain>, <api domain>, <status page if any>

## Summary

| # | Severity | Area | Finding | Suggested fix |
|---|----------|------|---------|---------------|
| 1 | High / Medium / Low / OK | Edge / Email / Headers / TLS / Ops | One line | One line |

## Findings

### 1. <Short title>
- **Severity:** High | Medium | Low | OK
- **What we saw:** observable fact (command or URL used, trimmed output).
- **Why it matters:** one or two sentences, no scare words.
- **Suggested fix:** concrete next step.
- **Effort:** minutes | hours | days

## Checklist covered

- [ ] DNS: NS, A/AAAA, CAA, dangling CNAMEs
- [ ] Email: SPF, DKIM (common selectors), DMARC policy and reporting
- [ ] Edge: is the origin reachable directly, bypassing the CDN/WAF?
- [ ] Response headers: CSP, frame protection, HSTS, Referrer-Policy, version banners
- [ ] TLS: protocols, certificate validity and expiry
- [ ] Ops signals: public status page, advertised SLA vs. what is visible
- [ ] security.txt present

## Not checked

Anything that needs access: internal alerting, logs, backups, IAM, on-call setup.
That is what the trial is for.

---
Questions: hi@mybug.dev