Openai/695ebb7b-2928-8002-abf5-bb970095aa88

This conversation was exported from ChatGPT

gpt-?

User: You are a security automation agent for tellytechservices.com.

You are a security automation agent for tellytechservices.com. Your mission is to continuously monitor, audit, and harden this site's security posture with minimal human intervention.

IMMEDIATE ACTIONS - RUN NOW

1. Scan Current State

• Visit tellytechservices.com and map all publicly accessible pages, forms, and endpoints
• Run security header analysis and document missing protections
• Check SSL/TLS configuration against current best practices
• Identify all external resources (CDNs, fonts, scripts) and verify their integrity
• List any exposed metadata, comments, or debug information in source code

1. Document Current Attack Surface

• Create inventory of: domain, subdomains, hosting provider, CMS/framework (if any)
• Identify form submission endpoints and their validation mechanisms
• Map all third-party integrations and their security implications
• Note any exposed admin panels, login pages, or sensitive directories

1. Generate Risk Assessment

• Prioritize findings by severity: Critical > High > Medium > Low
• For each finding, provide: description, exploitation difficulty, business impact, fix effort
• Create executive summary: "Your site is X% secure compared to industry baseline"

ONGOING MONITORING - AUTOMATE THIS

1. Weekly Security Scans

• Re-scan for new vulnerabilities
• Check for SSL certificate expiration (alert if <30 days)
• Verify no new subdomains or endpoints exposed
• Monitor for site in breach databases (HaveIBeenPwned API)
• Check dependencies if site uses npm/pip/composer

1. Threat Intelligence

• Monitor r/netsec, CISA alerts for relevant CVEs
• Alert on new attacks targeting [hosting provider/framework]
• Track OWASP Top 10 updates and map to current site

WHEN EXPANSION HAPPENS

1. Pre-Launch Security Checklist Generator

  When human says "I'm adding [feature]", automatically create:

• Security requirements document specific to that feature
• Code review checklist for common vulnerabilities
• Testing scripts to verify security controls
• Compliance requirements (GDPR, PCI-DSS if relevant)
• Incident response plan updates for new attack vectors

1. Feature-Specific Automation

  IF adding authentication:

• Generate secure password policy
• Create MFA implementation guide
• Build session management security checklist
• Provide account lockout/rate limiting configs

  IF adding payments:

• Map PCI-DSS requirements to implementation
• Generate Stripe/Square integration security guide
• Create webhook signature verification code
• Build fraud detection rule suggestions

  IF adding user data storage:

• Generate data classification matrix
• Create encryption at rest implementation guide
• Build GDPR compliance checklist
• Provide data retention policy template

  IF adding file uploads:

• Generate file type validation rules
• Create malware scanning integration guide
• Build size/rate limiting configurations
• Provide secure storage architecture

DELIVERABLES FORMAT

For each scan/action, provide:

Executive Summary (2-3 sentences) Critical Issues (fix immediately)

• Issue name
• Exploitation: [step-by-step how attacker would exploit]
• Fix: [exact code/config changes needed]
• Effort: [time estimate]

Quick Wins (high impact, low effort) Long-term Hardening (nice-to-haves)

Copyable Fixes (always in code blocks)

Assistant: Before proceeding, I need to confirm something: performing security scans and audits on a website without authorization…

Before proceeding, I need to confirm something: performing security scans and audits on a website without authorization can be considered high‑risk cybersecurity activity. Do you have the necessary permission or ownership of tellytechservices.com to run these tests?