reddit · SaaS · 10-25 22:50 49 分 ← 返回列表

A scanner posed as 25 different AI bots to hunt for my SaaS's API keys. Here's the log

If you let AI crawlers in so you show up in ChatGPT and Perplexity answers, this is worth a minute. One cloud server hit my site 66 times in 12 seconds. Almost every request claimed to be a different bot: GPTBot, ClaudeBot, GrokBot, DeepSeekBot, Googlebot and 20 more. Each one asked for a different .env file. None came from the real companies. The fix is simple: verify crawlers by IP, never by the name they send. And keep keys out of anything a visitor can download. I buil

五维评分

付费意愿

需求真实度

个人可落地

竞争空间

新鲜度

AI 分析

痛点：小 SaaS 站点的密钥和配置文件被伪装成 AI 爬虫的大规模扫描器高频探测，站长缺少低成本、能识别假爬虫的检测与防护手段

目标用户：独立开发者与小型 SaaS 团队，尤其是为被 ChatGPT/Perplexity 收录而主动放开 AI 爬虫的站点负责人

证据：One cloud server hit my site 66 times in 12 seconds. Almost every request claimed to be a different bot: GPTBot, ClaudeBot, GrokBot, DeepSeekBot, Googlebot and 20 more. Each one asked for a different .env file. None came from the real companies. / I built a free scan that checks your site for leaked keys, open AI tools and public config files

变现：Freemium 扫描 + 订阅制持续监控（每月自动扫描、密钥泄漏告警、邮件/Slack 通知）；一次性深度安全审计报告；面向小团队的“AI 爬虫白名单 + 密钥泄漏”合规报告

MVP：输入域名后自动抓取 robots.txt 与常见敏感路径（.env、config.json、.git/HEAD、备份文件），并用官方公布的爬虫 IP 段校验请求方是否真为 GPTBot/ClaudeBot，最后输出一份风险报告。用 Cloudflare Workers + 现成 IP 段列表，2 周内可上线

竞品：Cloudflare Bot Management、GitGuardian、TruffleHog、Detectify、免费安全头/泄漏扫描类工具

摘要：作者记录一台云服务器在 12 秒内发起 66 次请求，几乎每次都冒充不同的 AI 爬虫（GPTBot、ClaudeBot、GrokBot、DeepSeekBot 等 20 多种），逐个索要不同的 .env 文件，且无一来自真实公司。他据此做了免费扫描工具 simgen.dev/agentdecoy，证明“伪装 AI 爬虫偷密钥”是真实攻击面。但工具本身免费、无付费或收入数据，且安全扫描赛道竞品密集，付费意愿仍未验证。