Hey,
AI has changed the way we work quite a lot. We’re more productive than ever, but at the same time it’s becoming harder to keep track of where company data actually ends up.
I’ve personally come across situations like these:
- someone prepares a client proposal and uploads internal files directly into an AI tool,
- an internal PDF is left somewhere under wp-uploads and eventually gets indexed by Google,
- working notes from NotebookLM or files on Google Drive turn out to be publicly accessible,
- an API key is hardcoded in source code and ends up in a public repository.
They’re just small mistakes that anyone can make.
That’s why I’ve been working on a project called Outwards — a tool for monitoring publicly exposed confidential company data.
The idea is that a company first verifies that it actually owns the domain. Then Outwards builds a map of its public assets: domains, repositories, accounts, documents and other related resources.
After that, it looks at the company from the outside and checks things like:
AI tools - whether AI models or publicly shared AI conversations can surface information about the company that probably shouldn’t be easy to find.
Search engines - whether Google or Bing are indexing internal documents, employee data, contracts, email addresses or other sensitive material.
Public repositories - whether API keys, credentials, config files or other secrets were accidentally committed to public code.
Cloud files - whether Google Drive files, shared documents, boards or similar resources are publicly accessible.
If something is found, the user gets an alert, an explanation of the risk, and guidance on how to remove or secure it.
In practice, I think of it as continuous OSINT performed on your own company - trying to find the problem before someone else does.
I’ve opened an early waitlist and I’m currently looking for feedback:
What do you think about the idea? Would you see a real use case for something like this in software companies?
Top comments (0)