DEV Community: DAPDEV

How to Spy on Your Competitors' Tech Stack (Ethically)

DAPDEV — Sat, 28 Feb 2026 12:44:51 +0000

Ever wondered what framework your competitor is using? Or what analytics tool that fast-growing startup runs?

Every website leaks signals about its technology stack — through HTTP headers, JavaScript globals, meta tags, DNS records, and more.

Here's how to detect it programmatically.

The Manual Way (Tedious)

You could open DevTools and look for clues:

X-Powered-By: Express in response headers
<meta name="generator" content="WordPress"> in HTML
window.__NEXT_DATA__ in the console

But this is slow and incomplete. You'd miss DNS-level signals (like Cloudflare), TLS certificate details, or deeply embedded analytics scripts.

The API Way (Fast)

I built TechDetect API — a single endpoint that scans all these layers automatically.

curl "https://techdetect.dapdev.tech/detect?url=https://vercel.com"

Real response:

{
  "url": "https://vercel.com",
  "technologies": [
    {"name": "Next.js", "categories": ["JavaScript Framework"], "confidence": 0.7, "detected_by": ["headers", "html"]},
    {"name": "Vercel", "categories": ["CDN", "Hosting", "PaaS"], "confidence": 0.3, "detected_by": ["headers"]},
    {"name": "SendGrid", "categories": ["Email"], "confidence": 0.2, "detected_by": ["dns"]},
    {"name": "Let's Encrypt", "categories": ["SSL"], "confidence": 0.1, "detected_by": ["tls"]}
  ],
  "meta": {
    "scan_time_ms": 391,
    "layers_used": ["http", "html", "dns", "tls"]
  }
}

In under 400ms, we know Vercel uses Next.js (detected in both headers and HTML), hosts on their own CDN, uses SendGrid for email (found via DNS), and uses Let's Encrypt for TLS.

What Can You Learn?

1. Framework Choices

Is your competitor on Next.js, Nuxt, or a custom SPA? This tells you about their engineering priorities.

2. Infrastructure

Cloudflare vs AWS CloudFront vs Vercel — each choice reveals cost and performance tradeoffs.

3. Email & Communication

SendGrid, Mailgun, Amazon SES — their email provider shows up in DNS records.

4. SSL Provider

Let's Encrypt vs DigiCert vs Cloudflare — detected from TLS certificate inspection.

Practical Example: Competitive Analysis Script

import httpx

API_URL = "https://techdetect.dapdev.tech/detect"
competitors = [
    "https://stripe.com",
    "https://vercel.com",
    "https://linear.app",
    "https://notion.so",
]

for url in competitors:
    resp = httpx.get(API_URL, params={"url": url})
    data = resp.json()
    techs = data.get("technologies", [])
    scan_ms = data.get("meta", {}).get("scan_time_ms")

    print(f"\n{url} ({scan_ms}ms)")
    for tech in techs:
        cats = ", ".join(tech["categories"])
        sources = ", ".join(tech["detected_by"])
        print(f"  {tech['name']} [{cats}] (via {sources})")

Output:

https://stripe.com (1477ms)
  Next.js [JavaScript Framework] (via html)
  Nginx [Web Server] (via headers)
  DigiCert [SSL] (via tls)

https://vercel.com (391ms)
  Next.js [JavaScript Framework] (via headers, html)
  Vercel [CDN, Hosting, PaaS] (via headers)
  SendGrid [Email] (via dns)
  Let's Encrypt [SSL] (via tls)

How Detection Works

TechDetect scans 4 layers simultaneously:

Layer	What it checks	Example findings
HTTP	Response headers, server headers	Nginx, Express, Cloudflare
HTML	Meta tags, script patterns, DOM	Next.js, React, WordPress
DNS	MX, TXT, CNAME records	SendGrid, Google Workspace
TLS	Certificate issuer, SAN entries	Let's Encrypt, DigiCert, AWS

141+ technologies across 15 categories — all in a single API call.

Try It

The API is available on RapidAPI with a free tier:

TechDetect API on RapidAPI →

Also available as:

PyPI package — pip install techdetect
npm package — npm install techdetect
Apify Actor

Built by DAPDEV — developer tools for the modern web.

How to Track What Billionaire Investors Are Buying (Using SEC EDGAR Data)

DAPDEV — Sat, 28 Feb 2026 12:39:40 +0000

Warren Buffett just filed his latest 13F. Cathie Wood reshuffled her portfolio. A CEO quietly sold $50M worth of shares.

All of this is public data — the SEC requires it. But actually getting to it programmatically? That's where most people give up.

SEC EDGAR's website is a maze of SGML files, inconsistent formatting, and nested folders. I spent weeks parsing it and built an API so others don't have to. Here's what I learned and how to use it.

What Are 13F Filings?

Every institutional investment manager with over $100M in assets must file a 13F-HR with the SEC each quarter. This filing lists every equity position they hold — stock name, number of shares, and market value.

This is how you find out what Berkshire Hathaway, Bridgewater, or Renaissance Technologies actually own.

The Problem with Raw EDGAR Data

If you go to sec.gov/cgi-bin/browse-edgar and try to pull 13F data, you'll find:

Filings are in XML/SGML with inconsistent schemas across years
No unified search across companies and filing types
Holdings are buried in informationtable.xml files
No simple way to compare quarter-over-quarter changes
Rate limits that will throttle you after a few requests

I ended up building a pipeline that ingests all of this into ClickHouse and exposes it through a clean REST API.

Searching for Companies

First, find the company you want to track. Every company in EDGAR has a CIK (Central Index Key):

curl "https://edgar.dapdev.tech/companies/search?query=Tesla"

{
  "results": [
    {
      "cik": 1318605,
      "name": "Tesla, Inc.",
      "ticker": "TSLA"
    }
  ],
  "total": 1,
  "query": "Tesla"
}

Pulling 13F Holdings (The Good Stuff)

Once you have the CIK, you can pull their latest 13F holdings. Here's Berkshire Hathaway's portfolio:

curl "https://edgar.dapdev.tech/holdings/13f/1067983"

{
  "cik": 1067983,
  "company_name": "BERKSHIRE HATHAWAY INC",
  "report_date": "2026-02-17",
  "total_value_usd": 66858093626,
  "total_holdings": 42,
  "holdings": [
    {
      "name_of_issuer": "OCCIDENTAL PETE CORP",
      "value_usd": 10894391643,
      "shares": 264941431,
      "share_type": "SH"
    },
    {
      "name_of_issuer": "CHUBB LIMITED",
      "value_usd": 10689854998,
      "shares": 34249183,
      "share_type": "SH"
    },
    {
      "name_of_issuer": "KRAFT HEINZ CO",
      "value_usd": 7896644337,
      "shares": 325634818,
      "share_type": "SH"
    }
  ]
}

Berkshire's top 3 positions: Occidental Petroleum ($10.9B), Chubb ($10.7B), and Kraft Heinz ($7.9B). 42 total holdings worth $66.8 billion. This is live data from their latest filing.

Searching Filings by Type

You can search for specific filing types across any company:

curl "https://edgar.dapdev.tech/filings/search?query=Berkshire+Hathaway&type=13F&limit=5"

This returns recent 13F-HR filings with accession numbers. You can then use the accession number to get the full filing detail.

Tracking Insider Trades

SEC Form 4 filings disclose when company insiders (officers, directors, 10%+ shareholders) buy or sell shares. This is often a leading signal:

curl "https://edgar.dapdev.tech/insider/0000320193"

This returns all recent insider transactions for Apple (CIK 320193) — who traded, what they traded, how many shares, and whether it was a buy or sell.

Building Something Useful: A Python Portfolio Tracker

Here's a practical example — a script that tracks quarterly changes in any fund's portfolio:

import httpx

API = "https://edgar.dapdev.tech"
HEADERS = {"X-RapidAPI-Key": "your-key-here"}

def get_portfolio(cik: int) -> dict:
    """Get latest 13F holdings for a fund."""
    resp = httpx.get(f"{API}/holdings/13f/{cik}", headers=HEADERS)
    resp.raise_for_status()
    return resp.json()

def top_positions(portfolio: dict, n: int = 10) -> None:
    """Print top N positions by value."""
    holdings = sorted(
        portfolio["holdings"],
        key=lambda h: h["value_usd"],
        reverse=True
    )
    total = portfolio["total_value_usd"]
    print(f"\n{portfolio['company_name']} - {portfolio['report_date']}")
    print(f"Total portfolio: ${total:,.0f}")
    print(f"{'Position':<30} {'Value':>15} {'% of Portfolio':>15}")
    print("-" * 62)
    for h in holdings[:n]:
        pct = (h["value_usd"] / total) * 100
        print(f"{h['name_of_issuer']:<30} ${h['value_usd']:>14,.0f} {pct:>14.1f}%")

# Berkshire Hathaway
portfolio = get_portfolio(1067983)
top_positions(portfolio)

Output:

BERKSHIRE HATHAWAY INC - 2026-02-17
Total portfolio: $66,858,093,626
Position                              Value   % of Portfolio
--------------------------------------------------------------
OCCIDENTAL PETE CORP            $10,894,391,643           16.3%
CHUBB LIMITED                   $10,689,854,998           16.0%
KRAFT HEINZ CO                   $7,896,644,337           11.8%
MOODYS CORP                      $6,448,842,688            9.6%
ALPHABET INC                     $5,585,842,446            8.4%
VISA INC                        $2,910,002,197            4.4%

Who Uses This Data?

Retail investors tracking what the "smart money" is doing
Quant funds using institutional holdings as features in their models
Financial journalists covering portfolio changes
Compliance teams monitoring insider activity
Fintech apps building portfolio analytics dashboards

Available Endpoints

Endpoint	Description
`GET /companies/search`	Search companies by name or ticker
`GET /companies/{cik}`	Get company profile
`GET /filings/search`	Search filings by company and type
`GET /filings/{accession}`	Get full filing detail
`GET /holdings/13f/{cik}`	Latest 13F holdings
`GET /holdings/13f/{cik}/history`	Historical 13F filings
`GET /insider/{cik}`	Insider trading activity

The API is available on RapidAPI with a free tier.

Why I Built This

SEC EDGAR is one of the richest free data sources in finance, but the raw data format makes it painful to work with. Commercial alternatives like Bloomberg Terminal or FactSet cost thousands per month.

I wanted something in between — structured, searchable, API-accessible SEC data for developers building financial tools. The backend uses ClickHouse for fast analytical queries across millions of filings.

If you're building anything finance-related and need SEC data, give it a try. Happy to answer questions in the comments.

How I Built a Chrome Extension That Reveals Any Website's Tech Stack in One Click

DAPDEV — Sat, 28 Feb 2026 01:01:11 +0000

Ever land on a website and wonder — what's powering this thing? Is that Next.js or Nuxt? Are they running Cloudflare or AWS? What analytics are they using?

I found myself doing this constantly. Inspecting source code, checking HTTP headers, reading meta tags. Every time I visited a competitor's site, a client's project, or just something that loaded fast and looked good, I wanted to know the stack behind it.

So I built a Chrome extension that answers all of those questions with a single click. Here's exactly how I did it, and how you can build one too.

Why I Needed This

As a developer, knowing what technologies a website uses is genuinely useful:

Competitive analysis — see what frameworks your competitors chose and why
Learning — discover new tools by seeing them in production on real sites
Sales qualification — if you sell Shopify services, you need to know who runs Shopify
Security audits — identify outdated CMS versions or vulnerable libraries
Curiosity — sometimes you just want to know

There are browser extensions that do some of this, but I wanted something that could detect 141+ technologies across 15 categories — not just the obvious ones like jQuery or WordPress, but CDNs, analytics platforms, hosting providers, security headers, and more.

That's when I found the TechDetect API, which does all the heavy lifting through a simple REST endpoint.

The API: One Endpoint, Full Tech Stack

The TechDetect API has a dead-simple interface. You send a GET request with the target URL, and it returns every technology it can identify:

GET https://techdetect.dapdev.tech/detect?url=https://example.com

The response looks like this:

{
  "technologies": [
    {
      "name": "React",
      "version": "18.2.0",
      "confidence": 100,
      "categories": ["JavaScript frameworks"]
    },
    {
      "name": "Cloudflare",
      "confidence": 100,
      "categories": ["CDN"]
    },
    {
      "name": "Google Analytics",
      "confidence": 95,
      "categories": ["Analytics"]
    }
  ]
}

Each detected technology comes with a confidence score, version (when detectable), and categories. That's everything you need to build a useful extension popup.

Building the Chrome Extension

The extension uses Manifest V3 (Chrome's current extension platform) and has four core files:

techdetect-chrome-extension/
├── manifest.json      # Extension configuration
├── popup.html         # The popup UI
├── popup.js           # API calls and rendering logic
├── popup.css          # Dark theme styling
├── options.html       # Settings page for API key
├── options.js         # Settings logic
├── background.js      # Service worker
└── icons/             # Extension icons

Step 1: The Manifest

The manifest is straightforward. We need activeTab to read the current tab's URL, and storage to save the API key:

{
  "manifest_version": 3,
  "name": "TechDetect - Website Technology Detector",
  "version": "1.0.0",
  "description": "Detect the technology stack of any website with a single click.",
  "permissions": ["activeTab", "storage"],
  "action": {
    "default_popup": "popup.html",
    "default_icon": {
      "16": "icons/icon16.png",
      "48": "icons/icon48.png",
      "128": "icons/icon128.png"
    }
  },
  "options_page": "options.html",
  "background": {
    "service_worker": "background.js"
  }
}

Notice we're only requesting two permissions — activeTab and storage. No broad host permissions, no content script injection. This keeps the extension lightweight and trustworthy.

Step 2: The Popup Logic (popup.js)

This is where the magic happens. When the user clicks the extension icon, we:

Get the current tab's URL
Fetch the API key from Chrome storage
Call the TechDetect API
Render the results as cards with confidence bars

Here's the core detection function:

const detect = async () => {
  hideAll();
  show(statusEl);

  try {
    const apiUrl = `https://techdetect.dapdev.tech/detect?url=${encodeURIComponent(currentUrl)}`;
    const response = await fetch(apiUrl, {
      method: "GET",
      headers: {
        "X-API-Key": apiKey,
      },
    });

    if (!response.ok) {
      throw new Error(`API returned ${response.status}: ${response.statusText}`);
    }

    const data = await response.json();
    const technologies = data.technologies || data.results || data || [];

    hideAll();

    if (!Array.isArray(technologies) || technologies.length === 0) {
      show(emptyEl);
      return;
    }

    renderResults(technologies);
    show(resultsEl);
  } catch (err) {
    hideAll();
    show(errorEl);
    errorMsg.textContent = err.message || "Failed to detect technologies.";
  }
};

A few things worth pointing out:

We encodeURIComponent the target URL to handle special characters
The API key is sent via the X-API-Key header
We handle multiple possible response shapes (data.technologies, data.results, or the raw array) for flexibility
Error handling shows a retry button so users can try again without reopening the popup

Step 3: Rendering the Results

Each technology gets rendered as a card with the name, version, categories, and a color-coded confidence bar:

function renderResults(techs) {
  techs.sort((a, b) => (b.confidence || 0) - (a.confidence || 0));

  let html = `
    <div class="results-header">
      <h2>Detected Technologies</h2>
      <span class="results-count">${techs.length} found</span>
    </div>
  `;

  for (const tech of techs) {
    const name = tech.name || tech.technology || "Unknown";
    const version = tech.version || "";
    const confidence = Math.round(tech.confidence || 0);
    const categories = tech.categories || tech.category || [];
    const catArray = Array.isArray(categories) ? categories : [categories].filter(Boolean);

    let confClass = "high";
    if (confidence < 50) confClass = "low";
    else if (confidence < 80) confClass = "medium";

    const catHtml = catArray
      .map(c => `<span class="category-tag">${escapeHtml(String(c))}</span>`)
      .join("");

    html += `
      <div class="tech-card">
        <div class="tech-name">
          ${escapeHtml(name)}
          ${version ? `<span class="tech-version">v${escapeHtml(version)}</span>` : ""}
        </div>
        ${catHtml ? `<div class="tech-categories">${catHtml}</div>` : ""}
        <div class="confidence-bar-container">
          <span class="confidence-label">Confidence</span>
          <div class="confidence-bar">
            <div class="confidence-fill confidence-${confClass}" 
                 style="width: ${confidence}%"></div>
          </div>
          <span class="confidence-value ${confClass}">${confidence}%</span>
        </div>
      </div>
    `;
  }

  resultsEl.innerHTML = html;
}

The confidence bar uses three color tiers:

Green (80-100%): High confidence detection
Yellow (50-79%): Medium confidence
Red (below 50%): Low confidence, possibly heuristic-based

Step 4: The Settings Page

Users need a place to enter their API key. The options page handles this with Chrome's storage.sync API, which syncs the key across all their Chrome instances:

saveBtn.addEventListener("click", async () => {
  const key = apiKeyInput.value.trim();
  if (!key) {
    showToast("Please enter an API key.", "error");
    return;
  }

  await chrome.storage.sync.set({ apiKey: key });
  showToast("API key saved successfully!", "success");
});

Step 5: Guard Rails

The popup also handles edge cases — you can't detect technologies on chrome:// internal pages or when no URL is available:

if (!currentUrl || currentUrl.startsWith("chrome://") || currentUrl.startsWith("chrome-extension://")) {
  hideAll();
  show(errorEl);
  errorMsg.textContent = "Cannot detect technologies on this page.";
  return;
}

What the Extension Detects

The TechDetect API identifies technologies across 15 categories, including:

Category	Examples
JavaScript frameworks	React, Vue, Angular, Next.js, Nuxt
CMS	WordPress, Drupal, Ghost, Webflow
E-commerce	Shopify, WooCommerce, Magento
CDN	Cloudflare, Fastly, AWS CloudFront
Analytics	Google Analytics, Hotjar, Mixpanel
Hosting	Vercel, Netlify, AWS, Heroku
CSS frameworks	Tailwind CSS, Bootstrap, Bulma
Security	HSTS, Content Security Policy
Fonts	Google Fonts, Adobe Fonts
Tag managers	Google Tag Manager, Segment
Advertising	Google Ads, Facebook Pixel
Marketing automation	HubSpot, Mailchimp, Intercom
Server-side	Nginx, Apache, Node.js, PHP
Caching	Varnish, Redis
Build tools	Webpack, Vite

With 141+ technologies in the database, it catches things you would never spot manually — like specific CDN configurations or security headers that indicate the underlying infrastructure.

Try It Yourself

The extension is open source. You can clone it, install it as an unpacked extension, and start using it in under a minute:

git clone https://github.com/dapdevsoftware/techdetect-chrome-extension.git

Then in Chrome:

Go to chrome://extensions/
Enable "Developer mode"
Click "Load unpacked" and select the cloned folder
Click the TechDetect icon on any website

Getting an API Key

The extension requires an API key to authenticate with the TechDetect API. You can get one through RapidAPI where the API is listed for production use.

Beyond the Extension: Other Ways to Use the API

The Chrome extension is just one way to use the TechDetect API. Depending on your workflow, you might prefer:

Direct API calls — integrate technology detection into your own tools, dashboards, or CI pipelines with a simple GET request to https://techdetect.dapdev.tech/detect?url=...
Apify Actor — run bulk technology detection on hundreds of URLs at once using Apify's cloud infrastructure, great for lead generation and market research
RapidAPI — use the managed API listing on RapidAPI for metered access with built-in rate limiting and API key management

Lessons Learned Building This

A few things I picked up building this extension:

Manifest V3 service workers are not persistent. Unlike Manifest V2 background pages, the service worker in V3 can be terminated at any time. Keep your background logic minimal — mine just sets a default API key on first install.
chrome.storage.sync is your friend. It syncs data across all of a user's Chrome instances automatically. Perfect for API keys and user preferences.
Always encodeURIComponent user-supplied URLs. URLs can contain characters that break query strings. This is easy to forget and painful to debug.
Dark themes work well for developer tools. Developers spend hours staring at screens. A well-designed dark UI with proper contrast makes the extension feel native and comfortable.
Minimal permissions build trust. Only request activeTab and storage — never ask for blanket access to all URLs. Users (rightfully) scrutinize extension permissions.

Wrapping Up

Building a Chrome extension that detects website technology stacks turned out to be surprisingly straightforward — mostly because the hard part (actually detecting the technologies) is handled by the API. The extension itself is just a thin client: get the URL, call the API, render the results.

If you want to check it out:

Source code: github.com/dapdevsoftware/techdetect-chrome-extension
Bulk detection on Apify: apify.com/dapdev/website-technology-detector
API on RapidAPI: Available on RapidAPI for production use with managed API keys

The whole thing is open source, so fork it, modify it, or use it as a starting point for your own developer tools. If you build something cool with the TechDetect API, I'd love to hear about it in the comments.

How to Detect What Technology Stack Any Website Is Using (Programmatically)

DAPDEV — Fri, 27 Feb 2026 21:20:00 +0000

You're doing competitive analysis on a competitor's site. Or you're qualifying sales leads and need to know which prospects run Shopify. Or you're on a security audit and need to confirm which CMS versions are deployed across a client's domain portfolio.

In all of these cases, you need to answer the same question: what technology is this website actually running?

This post walks through how to detect website tech stacks — from manual approaches using raw HTTP inspection, to automated detection using an API. By the end you'll have working Python code for both approaches.

The Manual Approach: What Browsers Know That You Don't See

Before reaching for any tool, it helps to understand what signals technology leaves behind. There are four main layers to inspect.

1. HTTP Response Headers

Servers often leak stack information directly in response headers. A quick curl -I can reveal a surprising amount:

import httpx

def check_headers(url: str) -> dict:
    resp = httpx.get(url, follow_redirects=True, timeout=10)
    interesting = {}

    header_signals = {
        "x-powered-by": "runtime/framework",
        "server": "web server",
        "x-generator": "CMS",
        "x-drupal-cache": "Drupal",
        "x-shopify-stage": "Shopify",
        "x-wix-request-id": "Wix",
    }

    for header, label in header_signals.items():
        if header in resp.headers:
            interesting[label] = resp.headers[header]

    return interesting

print(check_headers("https://example.com"))

Common findings: X-Powered-By: PHP/8.1.2, Server: nginx, X-Generator: WordPress 6.4.

2. HTML Source Patterns

The page HTML itself is full of fingerprints — meta tags, script paths, CSS class names, and comment blocks:

import re
import httpx

def check_html(url: str) -> list[str]:
    resp = httpx.get(url, follow_redirects=True, timeout=10)
    html = resp.text
    detected = []

    patterns = {
        "WordPress": [
            r'/wp-content/',
            r'/wp-includes/',
            r'<meta name="generator" content="WordPress',
        ],
        "Shopify": [
            r'cdn\.shopify\.com',
            r'Shopify\.theme',
        ],
        "Next.js": [
            r'__NEXT_DATA__',
            r'/_next/static/',
        ],
        "Nuxt.js": [
            r'__NUXT__',
            r'/_nuxt/',
        ],
        "Wix": [
            r'static\.parastorage\.com',
            r'X-Wix-Meta-Site-Id',
        ],
    }

    for tech, fingerprints in patterns.items():
        if any(re.search(p, html) for p in fingerprints):
            detected.append(tech)

    return detected

3. DNS Records

DNS records can reveal infrastructure choices — CDN providers, email providers, and hosting platforms often leave clear trails:

import dns.resolver

def check_dns(domain: str) -> dict:
    results = {}

    try:
        cname = dns.resolver.resolve(domain, 'CNAME')
        results['cname'] = [str(r) for r in cname]
    except Exception:
        pass

    try:
        mx = dns.resolver.resolve(domain, 'MX')
        mx_hosts = [str(r.exchange) for r in mx]
        if any('google' in h for h in mx_hosts):
            results['email'] = 'Google Workspace'
        elif any('outlook' in h or 'microsoft' in h for h in mx_hosts):
            results['email'] = 'Microsoft 365'
    except Exception:
        pass

    return results

4. TLS Certificate Details

The TLS certificate's Subject Alternative Names (SANs) can reveal CDN providers and related domains:

import ssl
import socket

def check_tls(domain: str) -> dict:
    ctx = ssl.create_default_context()
    with ctx.wrap_socket(socket.socket(), server_hostname=domain) as s:
        s.connect((domain, 443))
        cert = s.getpeercert()

    info = {
        "issuer": dict(x[0] for x in cert["issuer"]),
        "subject": dict(x[0] for x in cert["subject"]),
        "san": [v for _, v in cert.get("subjectAltName", [])],
    }
    return info

Cloudflare-issued certs, for example, are a dead giveaway that a site is behind Cloudflare's CDN.

The Problem With DIY Detection

Writing these checks yourself is instructive, but there are serious maintenance problems with the DIY approach:

Fingerprint databases go stale fast. New frameworks ship constantly. WordPress updates its patterns. Next.js changes its build output. Your regex collection will bit-rot within months.

Edge cases are everywhere. Sites behind CDNs mask headers. Headless CMS setups don't emit typical CMS fingerprints. Some sites serve different content to bots vs. browsers.

Coverage gaps. The four layers above catch the obvious cases. But what about detecting that a site uses Segment vs. Heap for analytics? Or Intercom vs. Drift for live chat? Or that their checkout is actually Stripe.js hosted on their own domain? Each of those requires its own fingerprint logic.

You'd be rebuilding Wappalyzer — which, notably, was archived in 2023 after being acquired. The commercial alternative, BuiltWith, runs $295/month at minimum. Neither is practical for a side project or small team.

Using an API Instead

The Technology Detection API on RapidAPI handles fingerprint maintenance, framework coverage, and edge cases for you. It checks headers, HTML content, DNS, scripts, cookies, and meta tags across hundreds of technologies in a single call.

Install the Python client:

pip install techdetect

Then detect the tech stack of any URL:

from techdetect import TechDetectClient

client = TechDetectClient(api_key="your_rapidapi_key")

result = client.detect("https://shopify.com")

for tech in result.technologies:
    print(f"{tech.name} ({tech.category}): confidence {tech.confidence}%")

Real Output on Real Sites

Here's what you actually get back for a few popular sites.

A WordPress site:

{
  "url": "https://techcrunch.com",
  "technologies": [
    { "name": "WordPress", "category": "CMS", "confidence": 99 },
    { "name": "PHP", "category": "Programming Language", "confidence": 95 },
    { "name": "Cloudflare", "category": "CDN", "confidence": 97 },
    { "name": "Google Analytics 4", "category": "Analytics", "confidence": 91 }
  ]
}

A Shopify store:

{
  "url": "https://allbirds.com",
  "technologies": [
    { "name": "Shopify", "category": "Ecommerce", "confidence": 100 },
    { "name": "Shopify Plus", "category": "Ecommerce", "confidence": 85 },
    { "name": "Klaviyo", "category": "Email Marketing", "confidence": 92 },
    { "name": "Cloudflare", "category": "CDN", "confidence": 97 }
  ]
}

Pricing Reality Check

If you're doing this at any kind of scale, here's what the options actually cost:

Tool	Price	Notes
BuiltWith	$295/month	Full database access; no API on lower tiers
Wappalyzer	~$250/month	Archived in 2023; APIs shutting down
SimilarTech	$199/month	Bulk-only; no per-URL API
DIY (self-maintained)	Engineering time	Stale within months
Technology Detection API	$9/month	2,000 lookups/month on Pro plan

For a side project, internal tool, or early-stage startup, the math is straightforward.

Source Code

The full Python client, including async support and rate limiting, is on GitHub: github.com/dapdevsoftware/techdetect-python

pip install techdetect

API docs and a free tier (no credit card required) are available at RapidAPI. The free plan covers enough requests to prototype and validate your use case before committing to anything.

If you're building something with this — a lead gen tool, a competitive intelligence dashboard, a CMS auditor — drop a comment below. Happy to talk through the architecture.

Build a Sales Lead Qualification Tool with Technology Detection

DAPDEV — Fri, 27 Feb 2026 21:19:11 +0000

If you sell software, the technology your prospects use matters more than almost any other qualifying signal. A company running Shopify is a categorically different buyer than one running a custom Rails app. A team using HubSpot is further down the sales maturity curve than one using a spreadsheet.

This is called technographic data — knowing what technology stack a prospect uses — and it's how companies like Clearbit and ZoomInfo justify their price tags. The insight is simple: technology choices predict buying behavior, budget range, and fit for your product better than company size or industry alone.

This post shows you how to build a basic version of this yourself, using the Technology Detection API and about 100 lines of Python.

The Use Case: Qualifying Leads by Tech Stack

Let's make this concrete. Say you've built a Shopify plugin — maybe it handles subscription billing, or adds a custom reviews widget, or integrates with a specific 3PL. Your ideal customer is any store running Shopify.

The problem is that most lead lists don't come pre-tagged with "runs Shopify." You get a CSV of domains from a scrape, a trade show contact list, a LinkedIn export — and you have to figure out which ones are actually Shopify stores.

Manually checking 500 URLs is an afternoon of tedious work. Writing your own detector means maintaining fingerprint patterns as Shopify updates its platform. An API call per URL solves the problem cleanly.

Here's the basic pattern:

from techdetect import TechDetectClient

client = TechDetectClient(api_key="your_rapidapi_key")

def is_shopify(url: str) -> bool:
    result = client.detect(url)
    return any(
        t.name == "Shopify" and t.confidence >= 80
        for t in result.technologies
    )

print(is_shopify("https://allbirds.com"))   # True
print(is_shopify("https://techcrunch.com")) # False

That's it. Now let's scale it up.

Bulk Scanning a Lead List

Assume you have a CSV of prospect domains — call it leads.csv — with a domain column. Here's a script that scans all of them, tags each with their detected tech stack, and writes results to a new CSV.

import csv
import time
from techdetect import TechDetectClient

client = TechDetectClient(api_key="your_rapidapi_key")

TARGET_TECH = "Shopify"
CONFIDENCE_THRESHOLD = 80

def detect_with_retry(url: str, retries: int = 2):
    for attempt in range(retries + 1):
        try:
            return client.detect(url)
        except Exception as e:
            if attempt < retries:
                time.sleep(2 ** attempt)
            else:
                raise e

input_file = "leads.csv"
output_file = "leads_tagged.csv"

with open(input_file, newline="") as infile, open(output_file, "w", newline="") as outfile:
    reader = csv.DictReader(infile)
    fieldnames = reader.fieldnames + ["is_target", "detected_technologies", "confidence"]
    writer = csv.DictWriter(outfile, fieldnames=fieldnames)
    writer.writeheader()

    for row in reader:
        domain = row["domain"].strip()
        url = domain if domain.startswith("http") else f"https://{domain}"

        try:
            result = detect_with_retry(url)
            target_tech = next(
                (t for t in result.technologies if t.name == TARGET_TECH),
                None
            )
            row["is_target"] = "yes" if (target_tech and target_tech.confidence >= CONFIDENCE_THRESHOLD) else "no"
            row["detected_technologies"] = ", ".join(t.name for t in result.technologies)
            row["confidence"] = target_tech.confidence if target_tech else 0
        except Exception as e:
            row["is_target"] = "error"
            row["detected_technologies"] = str(e)
            row["confidence"] = 0

        writer.writerow(row)
        print(f"{domain}: {row['is_target']}")

Run this against a 500-row lead list overnight, and you wake up to a pre-qualified CSV you can import directly into your CRM.

Building a Lead Scoring System

Binary filtering (Shopify / not Shopify) is just the start. The more interesting approach is lead scoring — ranking leads by how well their tech stack matches your ideal customer profile.

The intuition: a Shopify store using Stripe, Klaviyo, and Google Analytics is more sophisticated — and likely higher-revenue — than one using only basic Shopify with no third-party tooling.

Here's a simple scoring model:

from techdetect import TechDetectClient

client = TechDetectClient(api_key="your_rapidapi_key")

# Define scoring rules: (technology_name, points, reason)
SCORE_RULES = [
    ("Shopify",          30, "core platform match"),
    ("Shopify Plus",     25, "high-revenue indicator"),
    ("Stripe",           10, "payment sophistication"),
    ("Klaviyo",          10, "email marketing investment"),
    ("Google Analytics", 5,  "tracking maturity"),
    ("Hotjar",           8,  "CRO investment"),
    ("Yotpo",            8,  "reviews platform — growing brand"),
    ("Recharge",         15, "subscription billing — recurring revenue"),
    ("Gorgias",          10, "customer support investment"),
    ("Loop Returns",     10, "returns management — scale indicator"),
]

def score_lead(url: str) -> dict:
    result = client.detect(url)
    tech_names = {t.name for t in result.technologies}

    score = 0
    matched_signals = []

    for tech_name, points, reason in SCORE_RULES:
        if tech_name in tech_names:
            score += points
            matched_signals.append(f"+{points} {tech_name} ({reason})")

    tier = (
        "hot"  if score >= 60 else
        "warm" if score >= 35 else
        "cold" if score >= 15 else
        "disqualified"
    )

    return {
        "url": url,
        "score": score,
        "tier": tier,
        "signals": matched_signals,
        "all_technologies": [t.name for t in result.technologies],
    }

# Example
result = score_lead("https://somestore.com")
print(f"Score: {result['score']} — {result['tier'].upper()}")
for signal in result["signals"]:
    print(f"  {signal}")

A store scoring 60+ (Shopify Plus + Recharge + Klaviyo + Gorgias) is a high-intent, high-budget lead. One scoring 15 (bare Shopify, nothing else) might be too early-stage to convert.

The Cost Math

This kind of enrichment used to require either a Clearbit subscription ($X,XXX/month) or a ZoomInfo seat (similar ballpark). For a developer at a small SaaS company, those price points are hard to justify before you've validated the channel.

Here's what this approach costs with the Technology Detection API:

Volume	Plan	Cost
Up to 100 URLs/month	Free tier	$0
Up to 2,000 URLs/month	Pro	$9/month
Up to 10,000 URLs/month	Ultra	~$29/month

Scanning 2,000 leads per month for $9 is a reasonable budget for almost any growth experiment. If you close even one deal from a batch of enriched leads, the ROI is obvious.

Next Steps

The script above is a starting point. A few directions worth extending:

Add CRM integration — POST scored leads directly to a HubSpot or Pipedrive custom property instead of writing a CSV
Schedule it as a cron job — Run the scan weekly against new leads as they enter your pipeline
Expand the scoring model — Add negative signals (e.g., "uses WooCommerce" scores negative if you only support Shopify)
Filter by geography — Combine with a WHOIS or IP geolocation lookup to target specific markets

The Python client and full source: github.com/dapdevsoftware/techdetect-python

Get an API key (free, no credit card required): Technology Detection API on RapidAPI

If you build something with this — especially if you adapt the scoring model for a specific niche — I'd be curious to hear what signals turned out to be most predictive.

How Marketing Agencies Can Use Technology Detection to Win More Clients

DAPDEV — Fri, 27 Feb 2026 20:57:57 +0000

Most agencies walk into pitch meetings with generic proposals. Here's how to walk in knowing exactly what a prospect is running — and exactly what they need.

The Problem

You're pitching a new client. You know their industry, you've looked at their website, maybe you've read their blog. But do you know:

What CMS they're using? (WordPress with 30 plugins? Webflow? Custom?)
Do they have analytics set up? (Google Analytics? Nothing?)
Are they using a CDN? (Cloudflare? None — meaning their site is probably slow)
What marketing tools are already installed? (HubSpot? Mailchimp? Nothing?)

Knowing this before the call completely changes the conversation.

Technology Detection as a Sales Weapon

I built a workflow using the Technology Detection API that scans prospect websites before every pitch. It detects 141+ technologies across 15 categories.

Here's a Python script that generates a pre-call brief:

import requests
import json

RAPIDAPI_KEY = "YOUR_RAPIDAPI_KEY"

def scan_prospect(url):
    resp = requests.get(
        "https://technology-detection-api.p.rapidapi.com/detect",
        params={"url": url},
        headers={
            "x-rapidapi-host": "technology-detection-api.p.rapidapi.com",
            "x-rapidapi-key": RAPIDAPI_KEY,
        },
    )
    resp.raise_for_status()
    data = resp.json()
    technologies = data.get("technologies", [])

    # Organize by category
    categories = {}
    for tech in technologies:
        cat = tech.get("category", "Other")
        name = tech.get("name") or tech.get("technology", "Unknown")
        if cat not in categories:
            categories[cat] = []
        categories[cat].append(name)

    print(f"\n{'='*50}")
    print(f"  PRE-CALL BRIEF: {url}")
    print(f"{'='*50}\n")

    for cat, techs in sorted(categories.items()):
        print(f"  {cat}: {', '.join(techs)}")

    # Flag opportunities
    tech_names = [t.get("name", "").lower() for t in technologies]
    print(f"\n  --- TALKING POINTS ---")

    if not any("analytics" in t.get("category", "").lower() for t in technologies):
        print("  > No analytics detected — pitch analytics setup")

    if not any("cdn" in t.get("category", "").lower() for t in technologies):
        print("  > No CDN detected — pitch performance optimization")

    if "wordpress" in tech_names:
        print("  > WordPress detected — pitch maintenance/security/migration")

    if not any(t in tech_names for t in ["hubspot", "mailchimp", "klaviyo", "sendgrid"]):
        print("  > No email marketing tool detected — pitch email automation")

    return data

# Scan before your next pitch
scan_prospect("https://prospect-website.com")

Competitive Benchmarking

Even more powerful: scan the top 10 competitors in your client's space.

def competitive_benchmark(urls):
    all_techs = {}
    for url in urls:
        try:
            resp = requests.get(
                "https://technology-detection-api.p.rapidapi.com/detect",
                params={"url": url},
                headers={
                    "x-rapidapi-host": "technology-detection-api.p.rapidapi.com",
                    "x-rapidapi-key": RAPIDAPI_KEY,
                },
            )
            resp.raise_for_status()
            techs = resp.json().get("technologies", [])
            for t in techs:
                name = t.get("name") or t.get("technology", "Unknown")
                if name not in all_techs:
                    all_techs[name] = 0
                all_techs[name] += 1
        except Exception as e:
            print(f"Error scanning {url}: {e}")

    print(f"\n  TECHNOLOGY ADOPTION ACROSS {len(urls)} COMPETITORS")
    print(f"  {'='*45}")
    for tech, count in sorted(all_techs.items(), key=lambda x: x[1], reverse=True):
        pct = count / len(urls) * 100
        bar = "#" * int(pct / 5)
        print(f"  {tech:.<30} {count}/{len(urls)} ({pct:.0f}%) {bar}")

competitors = [
    "https://competitor1.com",
    "https://competitor2.com",
    "https://competitor3.com",
]
competitive_benchmark(competitors)

This tells you things like: "7 out of 10 competitors use Cloudflare, but your client doesn't" or "Everyone has Google Analytics except your client." These become concrete, data-backed recommendations in your proposal.

What This Does for Your Close Rate

When you walk into a call and say:

"I noticed you're running WordPress 5.x with no CDN. Your page load time is probably 4-5 seconds. Your top 3 competitors are all on Cloudflare with sub-2-second loads. We can fix that in a week."

...that's a completely different conversation than "We do web optimization."

Specificity wins deals.

Getting Started

The Technology Detection API has a free tier (50 requests/month) and paid plans starting at $9/month for 2,000 scans.

For an agency scanning 20-30 prospects per month plus competitor analysis, the free tier might be enough to start. The $9 plan covers most small agencies easily.

Python wrapper on GitHub: techdetect-python

How do you research prospects before pitching? I'd love to hear what other tools or workflows agencies are using for competitive intelligence.

Build a Hedge Fund Portfolio Tracker with Python and SEC EDGAR Data

DAPDEV — Fri, 27 Feb 2026 20:56:55 +0000

Want to know what Warren Buffett is buying? Or what Citadel just dumped from their portfolio?

Every institutional investor managing more than $100 million is required to file a 13F form with the SEC every quarter, disclosing their equity holdings. This data is completely public — but working with EDGAR's raw filings is a nightmare.

In this tutorial, we'll build a Python tool that tracks institutional holdings programmatically.

The Problem with Raw EDGAR Data

If you've ever tried to pull data from SEC EDGAR, you know the pain:

CIK numbers instead of company names
Inconsistent XML/SGML formats across different filings
Rate limiting (10 requests per second)
No clean API — just raw filing documents

We'll skip all of that by using the SEC EDGAR Financial Data API which handles the parsing and gives us clean JSON responses.

Setup

Get your API key from RapidAPI (free tier: 100 requests/month), then:

pip install requests tabulate

Step 1: Search for an Institutional Investor

import requests

RAPIDAPI_KEY = "YOUR_RAPIDAPI_KEY"
BASE_URL = "https://sec-edgar-financial-data-api.p.rapidapi.com"
HEADERS = {
    "x-rapidapi-host": "sec-edgar-financial-data-api.p.rapidapi.com",
    "x-rapidapi-key": RAPIDAPI_KEY,
}

def search_company(query):
    resp = requests.get(
        f"{BASE_URL}/companies/search",
        params={"query": query},
        headers=HEADERS,
    )
    resp.raise_for_status()
    results = resp.json()
    for company in results[:5]:
        print(f"{company['name']} (CIK: {company['cik']})")
    return results

companies = search_company("Berkshire Hathaway")

Step 2: Get 13F Holdings

from tabulate import tabulate

def get_holdings(cik):
    resp = requests.get(
        f"{BASE_URL}/companies/{cik}/holdings",
        headers=HEADERS,
    )
    resp.raise_for_status()
    data = resp.json()

    holdings = data.get("holdings", [])
    total_value = sum(h.get("value", 0) for h in holdings)

    print(f"\nTotal Portfolio Value: ${total_value / 1e9:.1f}B")
    print(f"Number of Positions: {len(holdings)}\n")

    # Top 10 by value
    top = sorted(holdings, key=lambda h: h.get("value", 0), reverse=True)[:10]
    table = []
    for h in top:
        name = h.get("nameOfIssuer", "Unknown")
        value = h.get("value", 0)
        pct = (value / total_value * 100) if total_value else 0
        shares = h.get("sharesOrPrincipalAmount", 0)
        table.append([name, f"${value / 1e9:.1f}B", f"{pct:.1f}%", f"{shares:,}"])

    print(tabulate(table, headers=["Company", "Value", "% Portfolio", "Shares"]))
    return holdings

# Berkshire Hathaway's CIK
holdings = get_holdings("1067983")

Output:

Total Portfolio Value: $267.4B
Number of Positions: 42

Company              Value     % Portfolio    Shares
-------------------  --------  -------------  -----------
Apple Inc.           $91.2B    34.1%          400,000,000
Bank of America      $29.5B    11.0%          680,233,587
American Express     $26.8B    10.0%          151,610,700
Coca-Cola            $23.6B    8.8%           400,000,000
Chevron              $17.4B    6.5%           118,610,534

Step 3: Track Multiple Funds

# Well-known institutional investors
FUNDS = {
    "Berkshire Hathaway": "1067983",
    "Bridgewater Associates": "1350694",
    "Renaissance Technologies": "1037389",
    "Citadel Advisors": "1423053",
    "Two Sigma": "1179392",
}

def compare_funds():
    print("=" * 60)
    print("  INSTITUTIONAL HOLDINGS COMPARISON")
    print("=" * 60)

    for name, cik in FUNDS.items():
        print(f"\n{chr(9472) * 40}")
        print(f"  {name}")
        print(f"{chr(9472) * 40}")
        try:
            get_holdings(cik)
        except Exception as e:
            print(f"  Error: {e}")

compare_funds()

Step 4: Find Consensus Picks

One of the most interesting analyses — which stocks are multiple top funds buying?

from collections import Counter

def find_consensus_picks(fund_ciks, min_funds=3):
    all_holdings = {}

    for name, cik in fund_ciks.items():
        try:
            resp = requests.get(
                f"{BASE_URL}/companies/{cik}/holdings",
                headers=HEADERS,
            )
            resp.raise_for_status()
            data = resp.json()
            for h in data.get("holdings", []):
                ticker = h.get("nameOfIssuer", "Unknown")
                if ticker not in all_holdings:
                    all_holdings[ticker] = []
                all_holdings[ticker].append({
                    "fund": name,
                    "value": h.get("value", 0),
                    "shares": h.get("sharesOrPrincipalAmount", 0),
                })
        except Exception as e:
            print(f"Error fetching {name}: {e}")

    # Filter for stocks held by multiple funds
    consensus = {
        k: v for k, v in all_holdings.items()
        if len(v) >= min_funds
    }

    print(f"\n{= * 60}")
    print(f"  CONSENSUS PICKS (held by {min_funds}+ funds)")
    print(f"{= * 60}\n")

    for stock, funds in sorted(
        consensus.items(),
        key=lambda x: len(x[1]),
        reverse=True,
    ):
        total = sum(f["value"] for f in funds)
        fund_names = ", ".join(f["fund"] for f in funds)
        print(f"  {stock}")
        print(f"    Held by {len(funds)} funds | Total value: ${total / 1e9:.1f}B")
        print(f"    Funds: {fund_names}\n")

    return consensus

consensus = find_consensus_picks(FUNDS, min_funds=2)

What You Can Build From Here

This foundation enables several interesting applications:

Quarter-over-quarter tracking — diff holdings between filings to see what funds added, reduced, or exited
Alert system — get notified when a specific fund makes a new position or exits one
Sector analysis — aggregate holdings by sector to see where institutional money is flowing
Correlation with price — check if stock prices move after 13F disclosures (they often do)

API Reference

The SEC EDGAR Financial Data API provides these endpoints:

Endpoint	Description
`/companies/search`	Search SEC filers by name
`/companies/{cik}/holdings`	Get 13F institutional holdings
`/companies/{cik}/filings`	Get filing history (10-K, 10-Q, 8-K)

Free tier: 100 requests/month. Pro: $19/month for 5,000 requests.

Full Python wrapper on GitHub: edgar-python

Not financial advice. 13F data is delayed (filed 45 days after quarter end) and only covers long equity positions. It doesn't show short positions, options, or fixed income.

What institutional data do you track? Drop a comment — I'm curious what other data sources people are combining with 13F data.

Automate Website Security Audits with Technology Detection in Python

DAPDEV — Fri, 27 Feb 2026 20:06:57 +0000

Knowing what technologies a website runs is the first step in any security assessment. Outdated CMS versions, exposed server headers, legacy JavaScript libraries — these are all attack vectors, and they're all detectable.

In this tutorial, we'll build a Python tool that scans any website, identifies its technology stack, and flags potential security concerns based on what it finds.

Why Technology Detection Matters for Security

Most security audits start with reconnaissance. Before testing for vulnerabilities, you need to know what's running. A site using WordPress 5.x has a different risk profile than one running Next.js on Vercel.

Manually checking this is tedious. Browser extensions work for one site at a time but don't scale. We'll automate it with an API that detects 141+ technologies programmatically.

Setup

We'll use the Technology Detection API on RapidAPI.

Subscribe to get your API key, then install dependencies:

pip install requests

Step 1: Detect Technologies on a Target

import requests

RAPIDAPI_KEY = "YOUR_RAPIDAPI_KEY"

def detect_technologies(url):
    resp = requests.get(
        "https://technology-detection-api.p.rapidapi.com/detect",
        params={"url": url},
        headers={
            "x-rapidapi-host": "technology-detection-api.p.rapidapi.com",
            "x-rapidapi-key": RAPIDAPI_KEY,
        },
    )
    resp.raise_for_status()
    return resp.json()

result = detect_technologies("https://example.com")
technologies = result.get("technologies", [])
print(f"Detected {len(technologies)} technologies")
for tech in technologies:
    name = tech.get("name") or tech.get("technology", "Unknown")
    category = tech.get("category", "Unknown")
    version = tech.get("version", "")
    ver_str = f" v{version}" if version else ""
    print(f"  [{category}] {name}{ver_str}")

This gives you a structured inventory of everything running on the target — CMS, server software, JavaScript libraries, analytics, CDN, and more.

Step 2: Define Security Rules

Now let's build a rules engine that flags technologies with known security implications:

# Technologies and patterns that warrant attention in a security audit
SECURITY_RULES = [
    {
        "match": lambda t: t.get("name", "").lower() == "wordpress",
        "severity": "medium",
        "message": "WordPress detected — verify version is current and plugins are updated. WordPress sites are the #1 target for automated attacks.",
    },
    {
        "match": lambda t: t.get("name", "").lower() == "jquery"
            and t.get("version", "").startswith(("1.", "2.")),
        "severity": "high",
        "message": "Outdated jQuery version detected ({version}). jQuery < 3.5.0 has known XSS vulnerabilities (CVE-2020-11022).",
    },
    {
        "match": lambda t: t.get("name", "").lower() == "jquery"
            and t.get("version", "").startswith("3."),
        "severity": "low",
        "message": "jQuery 3.x detected. Verify it's 3.5.0+ to avoid known XSS issues.",
    },
    {
        "match": lambda t: t.get("category", "").lower() == "cms",
        "severity": "medium",
        "message": "CMS detected: {name}. Ensure it's running the latest version with security patches applied.",
    },
    {
        "match": lambda t: t.get("name", "").lower() in ("php", "apache", "nginx")
            and t.get("version"),
        "severity": "medium",
        "message": "Server software version exposed: {name} {version}. Consider hiding version headers to reduce information leakage.",
    },
    {
        "match": lambda t: t.get("name", "").lower() in (
            "google analytics", "facebook pixel", "hotjar", "mixpanel"
        ),
        "severity": "info",
        "message": "Third-party tracker detected: {name}. Verify it's included in your privacy policy and cookie consent.",
    },
    {
        "match": lambda t: t.get("name", "").lower() == "bootstrap"
            and t.get("version", "").startswith(("2.", "3.")),
        "severity": "low",
        "message": "Outdated Bootstrap version ({version}). Older versions have known XSS vulnerabilities in tooltips/popovers.",
    },
    {
        "match": lambda t: t.get("name", "").lower() == "angular"
            and t.get("version", "").startswith("1."),
        "severity": "high",
        "message": "AngularJS 1.x detected. This version is end-of-life and no longer receives security patches.",
    },
]

Step 3: Run the Audit

Apply the rules against detected technologies and generate findings:

def run_security_audit(url):
    print(f"
{'='*60}")
    print(f"  SECURITY AUDIT: {url}")
    print(f"{'='*60}
")

    data = detect_technologies(url)
    technologies = data.get("technologies", [])

    if not technologies:
        print("  No technologies detected.")
        return []

    print(f"  Detected {len(technologies)} technologies
")

    findings = []
    for tech in technologies:
        for rule in SECURITY_RULES:
            if rule["match"](tech):
                name = tech.get("name") or tech.get("technology", "Unknown")
                version = tech.get("version", "N/A")
                message = rule["message"].format(
                    name=name, version=version
                )
                finding = {
                    "severity": rule["severity"],
                    "technology": name,
                    "version": version,
                    "message": message,
                }
                findings.append(finding)

    # Sort by severity
    severity_order = {"high": 0, "medium": 1, "low": 2, "info": 3}
    findings.sort(key=lambda f: severity_order.get(f["severity"], 99))

    if findings:
        for f in findings:
            icon = {
                "high": "[HIGH]",
                "medium": "[MED] ",
                "low": "[LOW] ",
                "info": "[INFO]",
            }.get(f["severity"], "[???]")
            print(f"  {icon} {f['message']}")
    else:
        print("  No security findings based on detected technologies.")

    print(f"
  Total findings: {len(findings)}")
    return findings

findings = run_security_audit("https://example.com")

Step 4: Batch Audit Multiple Sites

If you manage multiple websites or are auditing a client's portfolio:

import time

def batch_audit(urls):
    all_findings = {}
    for url in urls:
        try:
            findings = run_security_audit(url)
            all_findings[url] = findings
        except Exception as e:
            print(f"
  Error scanning {url}: {e}")
            all_findings[url] = []
        time.sleep(1)

    # Summary
    print(f"
{'='*60}")
    print(f"  BATCH AUDIT SUMMARY")
    print(f"{'='*60}")
    for url, findings in all_findings.items():
        high = sum(1 for f in findings if f["severity"] == "high")
        medium = sum(1 for f in findings if f["severity"] == "medium")
        domain = url.replace("https://", "").rstrip("/")
        print(f"  {domain}: {high} high, {medium} medium, "
              f"{len(findings)} total")

    return all_findings

sites = [
    "https://example.com",
    "https://yoursite.com",
    "https://clientsite.com",
]
batch_audit(sites)

Step 5: Export as JSON Report

For documentation or integration with other security tools:

import json
from datetime import datetime

def export_report(url, findings, filename=None):
    report = {
        "target": url,
        "scan_date": datetime.utcnow().isoformat(),
        "total_findings": len(findings),
        "severity_counts": {
            "high": sum(1 for f in findings if f["severity"] == "high"),
            "medium": sum(1 for f in findings if f["severity"] == "medium"),
            "low": sum(1 for f in findings if f["severity"] == "low"),
            "info": sum(1 for f in findings if f["severity"] == "info"),
        },
        "findings": findings,
    }

    if filename is None:
        domain = url.replace("https://", "").replace("/", "_").rstrip("_")
        filename = f"audit_{domain}_{datetime.now().strftime('%Y%m%d')}.json"

    with open(filename, "w") as f:
        json.dump(report, f, indent=2)

    print(f"
  Report exported to {filename}")
    return filename

export_report("https://example.com", findings)

Extending the Audit

This foundation can be extended in several practical ways:

Version database — maintain a mapping of technologies to their latest versions and flag anything outdated automatically
CVE lookup — cross-reference detected technology versions against the NIST NVD API for known vulnerabilities
Scheduled scans — run audits on a cron schedule and alert when a site's technology stack changes unexpectedly
CI/CD integration — add a post-deploy step that scans your own site and fails the pipeline if high-severity findings appear

Wrapping Up

Technology detection is a practical starting point for security reconnaissance. By combining the Technology Detection API with a simple rules engine, you get an automated audit tool that flags real concerns in seconds.

This doesn't replace a full penetration test, but it's a fast way to surface the low-hanging fruit — outdated libraries, exposed server versions, and forgotten third-party scripts.

Subscribe on RapidAPI and start scanning.

What security checks would you add to the rules engine? Share your ideas in the comments.

Python Script to Monitor When Billionaires Change Their Stock Portfolios

DAPDEV — Fri, 27 Feb 2026 20:06:53 +0000

Every quarter, hedge funds and institutional investors managing over $100M are required to disclose their stock holdings to the SEC via 13F filings. This is public data — and it reveals exactly what Warren Buffett, Ray Dalio, Michael Burry, and thousands of other big players are buying and selling.

In this tutorial, we'll build a Python script that monitors these filings and detects portfolio changes — new positions, exits, and significant increases or decreases.

How 13F Filings Work

The SEC requires institutional investment managers to file Form 13F quarterly. Each filing lists every equity position the fund holds, including the number of shares and market value. By comparing consecutive filings, you can see exactly what changed.

The catch? The SEC's EDGAR system is notoriously difficult to work with — inconsistent formats, XML parsing, rate limiting, and CIK number lookups. We'll skip all that pain by using an API that handles it for us.

Setup

We'll use the SEC EDGAR Financial Data API on RapidAPI, which provides clean, structured access to 13F holdings for 10,000+ companies.

Subscribe to the API to get your key, then:

pip install requests

Step 1: Find an Investor's CIK Number

Every SEC filer has a CIK (Central Index Key). Let's search for one:

import requests

RAPIDAPI_KEY = "YOUR_RAPIDAPI_KEY"
BASE_URL = "https://sec-edgar-financial-data-api.p.rapidapi.com"
HEADERS = {
    "x-rapidapi-host": "sec-edgar-financial-data-api.p.rapidapi.com",
    "x-rapidapi-key": RAPIDAPI_KEY,
}

def search_company(query):
    resp = requests.get(
        f"{BASE_URL}/companies/search",
        params={"query": query},
        headers=HEADERS,
    )
    resp.raise_for_status()
    return resp.json()

results = search_company("Berkshire Hathaway")
for company in results.get("companies", [])[:5]:
    print(f"{company['name']} — CIK: {company['cik']}")

This gives you the CIK for any filer. Berkshire Hathaway's CIK is 0001067983.

Step 2: Fetch 13F Holdings

Now pull the actual portfolio holdings:

def get_holdings(cik):
    resp = requests.get(
        f"{BASE_URL}/holdings/13f/{cik}",
        headers=HEADERS,
    )
    resp.raise_for_status()
    return resp.json()

holdings = get_holdings("0001067983")  # Berkshire Hathaway

# Show top 10 positions by value
positions = holdings.get("holdings", [])
positions_sorted = sorted(positions, key=lambda x: x.get("value", 0), reverse=True)

print(f"Total positions: {len(positions)}")
print(f"
Top 10 Holdings:")
for pos in positions_sorted[:10]:
    name = pos.get("name", "Unknown")
    value = pos.get("value", 0)
    shares = pos.get("shares", 0)
    print(f"  {name}: ${value:,.0f} ({shares:,.0f} shares)")

Step 3: Detect Portfolio Changes

The real value comes from comparing two quarters. Here's a function that diffs two sets of holdings and highlights what changed:

def detect_changes(current_holdings, previous_holdings):
    current = {h["cusip"]: h for h in current_holdings}
    previous = {h["cusip"]: h for h in previous_holdings}

    changes = {
        "new_positions": [],
        "exited_positions": [],
        "increased": [],
        "decreased": [],
    }

    # New positions (in current but not previous)
    for cusip in current:
        if cusip not in previous:
            changes["new_positions"].append(current[cusip])

    # Exited positions (in previous but not current)
    for cusip in previous:
        if cusip not in current:
            changes["exited_positions"].append(previous[cusip])

    # Changed positions
    for cusip in current:
        if cusip in previous:
            curr_shares = current[cusip].get("shares", 0)
            prev_shares = previous[cusip].get("shares", 0)
            if prev_shares == 0:
                continue
            pct_change = ((curr_shares - prev_shares) / prev_shares) * 100

            if pct_change > 5:  # increased by more than 5%
                changes["increased"].append({
                    **current[cusip],
                    "prev_shares": prev_shares,
                    "pct_change": pct_change,
                })
            elif pct_change < -5:  # decreased by more than 5%
                changes["decreased"].append({
                    **current[cusip],
                    "prev_shares": prev_shares,
                    "pct_change": pct_change,
                })

    return changes

Step 4: Generate a Report

Let's put it all together with a clean report:

def print_report(investor_name, changes):
    print(f"
{'='*60}")
    print(f"  PORTFOLIO CHANGES: {investor_name}")
    print(f"{'='*60}")

    if changes["new_positions"]:
        print(f"
  NEW POSITIONS ({len(changes['new_positions'])})")
        for pos in changes["new_positions"]:
            print(f"    + {pos['name']}: {pos.get('shares', 0):,.0f} shares "
                  f"(${pos.get('value', 0):,.0f})")

    if changes["exited_positions"]:
        print(f"
  EXITED POSITIONS ({len(changes['exited_positions'])})")
        for pos in changes["exited_positions"]:
            print(f"    - {pos['name']}: sold all "
                  f"{pos.get('shares', 0):,.0f} shares")

    if changes["increased"]:
        print(f"
  INCREASED ({len(changes['increased'])})")
        for pos in sorted(changes["increased"],
                         key=lambda x: x["pct_change"], reverse=True)[:10]:
            print(f"    ^ {pos['name']}: +{pos['pct_change']:.1f}% "
                  f"({pos['prev_shares']:,.0f} -> {pos.get('shares', 0):,.0f})")

    if changes["decreased"]:
        print(f"
  DECREASED ({len(changes['decreased'])})")
        for pos in sorted(changes["decreased"],
                         key=lambda x: x["pct_change"])[:10]:
            print(f"    v {pos['name']}: {pos['pct_change']:.1f}% "
                  f"({pos['prev_shares']:,.0f} -> {pos.get('shares', 0):,.0f})")

Step 5: Monitor Multiple Funds

Track a watchlist of investors and check them all at once:

watchlist = {
    "Berkshire Hathaway": "0001067983",
    "Bridgewater Associates": "0001350694",
    "Citadel Advisors": "0001423053",
    "Renaissance Technologies": "0001037389",
}

def monitor_watchlist(watchlist):
    for name, cik in watchlist.items():
        print(f"
Fetching data for {name}...")
        try:
            data = get_holdings(cik)
            holdings = data.get("holdings", [])
            total_value = sum(h.get("value", 0) for h in holdings)
            print(f"  Positions: {len(holdings)}")
            print(f"  Total reported value: ${total_value:,.0f}")
        except Exception as e:
            print(f"  Error: {e}")

monitor_watchlist(watchlist)

Ideas to Extend This

Scheduled monitoring — run it as a cron job and send email or Slack alerts when new filings appear
Consensus picks — find stocks that multiple top funds are all buying simultaneously
Historical tracking — store quarterly snapshots in a database and chart position sizes over time
Sector analysis — categorize holdings by sector to see if big money is rotating into tech, energy, healthcare, etc.

Important Note

13F filings are reported with a ~45-day delay after each quarter ends. This isn't real-time data — it's a quarterly snapshot. But it's still incredibly valuable for understanding what the smartest money in the world is doing with their portfolios.

Wrapping Up

With the SEC EDGAR Financial Data API and a bit of Python, you can programmatically track portfolio changes for any institutional investor filing 13F reports. No more manually navigating the SEC website or parsing raw XML.

Subscribe on RapidAPI and start tracking the funds you care about.

Which investor would you track first? Let me know in the comments.

Reverse Engineer Any SaaS Company's Tech Stack in 10 Seconds

DAPDEV — Fri, 27 Feb 2026 20:06:50 +0000

Ever wonder what tech stack your competitors are running? Whether it's their frontend framework, CDN provider, analytics platform, or CMS — you can detect all of it programmatically in seconds.

In this tutorial, I'll show you how to build a Python script that reverse-engineers the technology stack of any SaaS company's website. We'll detect 141+ technologies including frameworks, CMS platforms, hosting providers, CDNs, and analytics tools.

Why Reverse-Engineer Tech Stacks?

There are solid reasons to detect what technologies a website is running:

Competitive analysis — understand what tools your competitors rely on
Sales prospecting — qualify leads based on the technologies they use (e.g., find companies running Shopify or WordPress)
Market research — track technology adoption trends across an industry
Due diligence — evaluate a company's technical maturity before investing or partnering

Doing this manually with browser extensions is slow and doesn't scale. Let's automate it.

Setup

We'll use the Technology Detection API on RapidAPI. It takes a URL and returns every detectable technology on that site.

First, subscribe to the API on RapidAPI to get your API key.

Install requests if you haven't already:

pip install requests

Basic Detection: One Website

Let's start with a simple script that detects the tech stack of a single website:

import requests
import json

RAPIDAPI_KEY = "YOUR_RAPIDAPI_KEY"

def detect_tech_stack(url):
    response = requests.get(
        "https://technology-detection-api.p.rapidapi.com/detect",
        params={"url": url},
        headers={
            "x-rapidapi-host": "technology-detection-api.p.rapidapi.com",
            "x-rapidapi-key": RAPIDAPI_KEY,
        },
    )
    response.raise_for_status()
    return response.json()

result = detect_tech_stack("https://shopify.com")
print(json.dumps(result, indent=2))

The API returns structured data with each detected technology, its category (e.g., "JavaScript framework", "CDN", "Analytics"), and confidence level.

Scanning Multiple Competitors

Now let's scale this up. Say you're researching the project management SaaS space and want to compare tech stacks across competitors:

import requests
import time
from collections import defaultdict

RAPIDAPI_KEY = "YOUR_RAPIDAPI_KEY"
API_URL = "https://technology-detection-api.p.rapidapi.com/detect"
HEADERS = {
    "x-rapidapi-host": "technology-detection-api.p.rapidapi.com",
    "x-rapidapi-key": RAPIDAPI_KEY,
}

competitors = [
    "https://asana.com",
    "https://monday.com",
    "https://notion.so",
    "https://clickup.com",
    "https://linear.app",
]

def detect_tech_stack(url):
    resp = requests.get(API_URL, params={"url": url}, headers=HEADERS)
    resp.raise_for_status()
    return resp.json()

def scan_competitors(urls):
    results = {}
    for url in urls:
        print(f"Scanning {url}...")
        try:
            data = detect_tech_stack(url)
            technologies = data.get("technologies", [])
            results[url] = technologies
        except Exception as e:
            print(f"  Error: {e}")
            results[url] = []
        time.sleep(1)  # be polite with rate limits
    return results

all_results = scan_competitors(competitors)

Building a Comparison Matrix

The raw data is useful, but a comparison table is more actionable. Let's build one:

def build_comparison(results):
    # Collect all unique technologies
    all_techs = set()
    for techs in results.values():
        for t in techs:
            name = t.get("name") or t.get("technology", "Unknown")
            all_techs.add(name)

    # Build the matrix
    print(f"
{'Technology':<30}", end="")
    short_names = {}
    for url in results:
        short = url.replace("https://", "").rstrip("/")
        short_names[url] = short
        print(f"{short:<18}", end="")
    print()
    print("-" * (30 + 18 * len(results)))

    for tech in sorted(all_techs):
        print(f"{tech:<30}", end="")
        for url in results:
            found = any(
                (t.get("name") or t.get("technology", "")) == tech
                for t in results[url]
            )
            print(f"{'YES':<18}" if found else f"{'--':<18}", end="")
        print()

build_comparison(all_results)

This prints a clean table showing which technologies each competitor uses — immediately revealing patterns like "4 out of 5 use Cloudflare" or "only one uses Next.js."

Categorized Summary

For a higher-level view, group technologies by category:

def categorized_summary(url, technologies):
    categories = defaultdict(list)
    for tech in technologies:
        cat = tech.get("category", "Other")
        name = tech.get("name") or tech.get("technology", "Unknown")
        categories[cat].append(name)

    domain = url.replace("https://", "").rstrip("/")
    print(f"
=== {domain} ===")
    for category, techs in sorted(categories.items()):
        print(f"  {category}: {', '.join(techs)}")

for url, techs in all_results.items():
    categorized_summary(url, techs)

Sample output might look like:

=== linear.app ===
  CDN: Cloudflare
  Frontend: React, Next.js
  Analytics: Segment, Google Analytics
  Hosting: Vercel

Practical Use Cases

Once you have this data, you can:

Generate a report — export to CSV or PDF for stakeholders
Track changes over time — run the script weekly and diff the results to spot when a competitor migrates to a new framework
Feed into a CRM — enrich lead records with technology data for better sales targeting
Benchmark yourself — compare your own stack against industry norms

Wrapping Up

With a few lines of Python and the Technology Detection API, you can reverse-engineer any company's tech stack at scale. No browser extensions, no manual guessing — just structured data you can plug into your workflows.

The API detects 141+ technologies across categories like CMS, frameworks, CDNs, analytics, hosting, and more. Subscribe on RapidAPI to start building.

What would you build with this? Drop a comment below — I'm curious to see what use cases you come up with.

Build a "Clone the Fund" Portfolio Tracker Using SEC 13F Data in Python

DAPDEV — Fri, 27 Feb 2026 01:37:52 +0000

Every quarter, institutional investors managing over $100 million must file a 13F form with the SEC. This filing discloses every equity position they hold — stock by stock, share by share.

Berkshire Hathaway, Citadel, Renaissance Technologies, Bridgewater — they all file. And it's all public data.

The idea behind "cloning the fund" is simple: pick a fund you admire, see what they're buying and selling each quarter, and mirror their moves in your own portfolio. Whether or not you actually trade on it, tracking institutional movements is one of the best ways to understand where smart money is flowing.

This tutorial shows you how to build a fund cloning tracker in Python.

The Problem with Raw SEC Data

The SEC's EDGAR system makes 13F filings available as XML. But the data is painful to work with:

Company names aren't normalized ("APPLE INC" vs "Apple Inc." vs "APPLE COMPUTER INC")
Values are reported in thousands, not dollars
No ticker symbols — just company names and CUSIPs
Formats vary across 20+ years of filings

Parsing this manually is a weekend project you don't want.

The Clean Way: SEC EDGAR Financial Data API

The SEC EDGAR Financial Data API handles all the parsing and normalization. You get back clean JSON with resolved tickers, actual dollar values, and quarter-over-quarter diffs.

import requests

API_KEY = "your_rapidapi_key"
API_HOST = "sec-edgar-financial-data-api.p.rapidapi.com"
HEADERS = {"x-rapidapi-key": API_KEY, "x-rapidapi-host": API_HOST}

def get_13f_holdings(cik):
    """Get the latest 13F holdings for a fund."""
    response = requests.get(
        f"https://{API_HOST}/institutional-holdings/13f",
        headers=HEADERS,
        params={"cik": cik}
    )
    response.raise_for_status()
    return response.json()

# Berkshire Hathaway's CIK
holdings = get_13f_holdings("0001067983")

for h in holdings["data"][:10]:
    print(f"{h['ticker']:6} | {h['shares']:>12,} shares | ${h['value']:>14,.0f}")

Output:

AAPL   |  915,560,382 shares | $348,298,945,000
BAC    |  680,233,587 shares |  $30,082,334,000
AXP    |  151,610,700 shares |  $44,898,553,000
KO     |  400,000,000 shares |  $28,440,000,000
CVX    |  118,610,534 shares |  $18,498,067,000
OXY    |  264,274,424 shares |  $13,216,577,000
KHC    |  325,634,818 shares |  $11,303,533,000
MCO    |   24,669,778 shares |  $12,082,179,000
CB     |   27,033,784 shares |   $8,204,859,000
DVA    |   36,095,570 shares |   $6,195,197,000

Step 1: Pick Your Funds to Track

Some popular funds to clone:

Fund	CIK	Known For
Berkshire Hathaway	0001067983	Warren Buffett's value investing
Bridgewater Associates	0001350694	Ray Dalio's macro strategy
Renaissance Technologies	0001037389	Jim Simons' quant approach
Citadel Advisors	0001423053	Ken Griffin's multi-strategy
Appaloosa Management	0001656456	David Tepper's event-driven
Pershing Square	0001336528	Bill Ackman's concentrated bets

FUNDS = {
    "Berkshire Hathaway": "0001067983",
    "Bridgewater Associates": "0001350694",
    "Renaissance Technologies": "0001037389",
    "Citadel Advisors": "0001423053",
    "Pershing Square": "0001336528",
}

Step 2: Build the Holdings Fetcher

import time

def fetch_all_funds(funds):
    """Fetch latest 13F holdings for all tracked funds."""
    all_holdings = {}
    for name, cik in funds.items():
        print(f"Fetching {name}...")
        try:
            data = get_13f_holdings(cik)
            all_holdings[name] = data.get("data", [])
        except Exception as e:
            print(f"  Error: {e}")
            all_holdings[name] = []
        time.sleep(1)  # respect rate limits
    return all_holdings

all_holdings = fetch_all_funds(FUNDS)

# Quick summary
for fund, holdings in all_holdings.items():
    total = sum(h.get("value", 0) for h in holdings)
    print(f"{fund}: {len(holdings)} positions, ${total:,.0f} total value")

Step 3: Find the "Consensus Picks"

The most interesting signal is when multiple smart-money funds hold the same stock. If Berkshire, Bridgewater, AND Renaissance all own it — that's a crowded conviction bet.

from collections import Counter, defaultdict

def find_consensus_picks(all_holdings, min_funds=3):
    """Find stocks held by multiple funds."""
    stock_holders = defaultdict(list)

    for fund_name, holdings in all_holdings.items():
        for h in holdings:
            ticker = h.get("ticker", "UNKNOWN")
            stock_holders[ticker].append({
                "fund": fund_name,
                "shares": h.get("shares", 0),
                "value": h.get("value", 0),
            })

    consensus = {
        ticker: holders
        for ticker, holders in stock_holders.items()
        if len(holders) >= min_funds and ticker != "UNKNOWN"
    }

    return dict(sorted(
        consensus.items(), key=lambda x: len(x[1]), reverse=True
    ))

consensus = find_consensus_picks(all_holdings, min_funds=2)

print(f"\nStocks held by 2+ funds:")
print(f"{'Ticker':<8} {'Funds':>5}  {'Total Value':>15}  Held By")
print("-" * 70)
for ticker, holders in list(consensus.items())[:20]:
    total_val = sum(h["value"] for h in holders)
    fund_names = ", ".join(h["fund"].split()[0] for h in holders)
    print(f"{ticker:<8} {len(holders):>5}  ${total_val:>14,.0f}  {fund_names}")

Step 4: Track Quarter-Over-Quarter Changes

This is where it gets really interesting — not just what funds hold, but what they're buying and selling.

def get_fund_changes(cik):
    """Get quarter-over-quarter changes for a fund."""
    response = requests.get(
        f"https://{API_HOST}/institutional-holdings/13f",
        headers=HEADERS,
        params={"cik": cik, "include_changes": "true"}
    )
    response.raise_for_status()
    return response.json()

def analyze_moves(data):
    """Categorize into new buys, increases, decreases, exits."""
    new_buys, increases, decreases, exits = [], [], [], []

    for h in data.get("data", []):
        change = h.get("change_shares", 0)
        prev = h.get("prev_shares", 0)

        if prev == 0 and change > 0:
            new_buys.append(h)
        elif change > 0:
            increases.append(h)
        elif h.get("shares", 0) == 0 and prev > 0:
            exits.append(h)
        elif change < 0:
            decreases.append(h)

    return {
        "new_buys": sorted(new_buys, key=lambda x: x.get("value", 0), reverse=True),
        "increases": sorted(increases, key=lambda x: abs(x.get("change_shares", 0)), reverse=True),
        "decreases": sorted(decreases, key=lambda x: abs(x.get("change_shares", 0)), reverse=True),
        "exits": exits,
    }

# Check what Berkshire is doing
berkshire_data = get_fund_changes("0001067983")
moves = analyze_moves(berkshire_data)

print("NEW POSITIONS:")
for h in moves["new_buys"][:5]:
    print(f"  {h['ticker']}: {h['shares']:,} shares (${h['value']:,.0f})")

print("\nINCREASED:")
for h in moves["increases"][:5]:
    pct = (h["change_shares"] / max(h.get("prev_shares", 1), 1)) * 100
    print(f"  {h['ticker']}: +{h['change_shares']:,} shares (+{pct:.1f}%)")

print("\nDECREASED:")
for h in moves["decreases"][:5]:
    pct = (abs(h["change_shares"]) / max(h.get("prev_shares", 1), 1)) * 100
    print(f"  {h['ticker']}: {h['change_shares']:,} shares (-{pct:.1f}%)")

print("\nEXITED:")
for h in moves["exits"][:5]:
    print(f"  {h['ticker']}: sold all {h.get('prev_shares', 0):,} shares")

Step 5: Build Your Clone Portfolio

Now combine everything into a simple portfolio allocation based on a fund's top holdings:

def build_clone_portfolio(holdings, top_n=10, budget=10000):
    """Create a simplified clone portfolio from top holdings."""
    top = sorted(
        holdings, key=lambda x: x.get("value", 0), reverse=True
    )[:top_n]

    total_value = sum(h.get("value", 0) for h in top)
    if total_value == 0:
        return []

    return [
        {
            "ticker": h.get("ticker", "?"),
            "weight": h["value"] / total_value,
            "allocation": budget * (h["value"] / total_value),
        }
        for h in top
    ]

# Clone Berkshire's top 10
clone = build_clone_portfolio(
    all_holdings.get("Berkshire Hathaway", []),
    top_n=10, budget=10000
)

print(f"\n{'Ticker':<8} {'Weight':>8} {'Allocation':>12}")
print("-" * 30)
for p in clone:
    print(f"{p['ticker']:<8} {p['weight']:>7.1%} ${p['allocation']:>10,.2f}")
print("-" * 30)
print(f"{'TOTAL':<8} {'100.0%':>8} ${sum(p['allocation'] for p in clone):>10,.2f}")

Bonus: Crowded Trade Detector

When too many funds pile into the same stock, it can signal either strong conviction OR a crowded trade vulnerable to a selloff.

def crowded_trade_alert(all_holdings, threshold=4):
    """Flag stocks held by too many institutional portfolios."""
    stock_count = Counter()
    stock_value = defaultdict(float)

    for fund, holdings in all_holdings.items():
        for h in holdings:
            ticker = h.get("ticker", "UNKNOWN")
            if ticker != "UNKNOWN":
                stock_count[ticker] += 1
                stock_value[ticker] += h.get("value", 0)

    crowded = [
        (ticker, count, stock_value[ticker])
        for ticker, count in stock_count.items()
        if count >= threshold
    ]

    return sorted(crowded, key=lambda x: x[1], reverse=True)

alerts = crowded_trade_alert(all_holdings, threshold=3)
if alerts:
    print("CROWDED TRADE ALERTS:")
    for ticker, count, value in alerts[:10]:
        print(f"  {ticker}: held by {count} funds (${value:,.0f} combined)")

Important Caveats

Before you go clone Warren Buffett's portfolio:

13F filings are delayed. They're filed ~45 days after quarter end. By the time you see it, the fund may have already changed positions.
13F only covers long equity positions. No shorts, no options strategies, no fixed income. You're seeing one slice of a fund's total strategy.
Context matters. A position might be a hedge, not a conviction bet. Bridgewater's positions often serve macro hedging purposes.
Size differences. Berkshire can hold a $50B Apple position because they manage $350B+. Scaling their allocation to a $10k portfolio changes the risk profile.

That said, tracking institutional moves is genuinely useful for idea generation, understanding market sentiment, and spotting emerging trends before they hit the headlines.

Getting Started

pip install edgar-client

The Python client simplifies everything:

from edgar_client import EdgarClient

client = EdgarClient(api_key="your_key")
holdings = client.get_13f_holdings(cik="0001067983")

Resources:

API on RapidAPI (free tier: 50 requests/month)
Python client on GitHub
Full SEC 13F tutorial

If you build something interesting with the 13F data — portfolio trackers, Telegram bots, dashboards — share it in the comments. I'd love to see what people create with institutional holdings data.

How to Build a Competitive Intelligence Tool That Reveals Any Company's Tech Stack

DAPDEV — Fri, 27 Feb 2026 01:32:45 +0000

If you're building a SaaS product, running a sales team, or doing market research, one of the most valuable signals you can get about a company is their technology stack.

What CMS do they use? What analytics? What payment provider? What hosting? These aren't just technical details — they're business intelligence.

A company running Shopify is a potential customer for Shopify apps
A company using HubSpot has budget for marketing tools
A company on AWS with React is likely a modern engineering org
A company still on jQuery might be ready for a migration consulting pitch

This post walks through building a competitive intelligence tool in Python that can scan any website and return its full tech stack in under 2 seconds.

The Manual Way (Don't Do This)

You could try to figure out a website's stack manually:

Open DevTools, check the Network tab for server headers
View source, search for framework-specific patterns
Check DNS records with dig
Look at the TLS certificate issuer

This works for one site. It doesn't work for 500 prospects in your CRM.

The Programmatic Way

The Technology Detection API does all four of those detection layers automatically — HTTP headers, HTML/JS patterns, DNS records, and TLS certificates — and returns structured JSON.

import requests

url = "https://technology-detection-api.p.rapidapi.com/detect"
headers = {
    "x-rapidapi-key": "YOUR_API_KEY",
    "x-rapidapi-host": "technology-detection-api.p.rapidapi.com"
}

response = requests.get(url, headers=headers, params={"url": "https://stripe.com"})
data = response.json()

for tech in data["technologies"]:
    print(f"{tech['name']} ({tech['category']}) - confidence: {tech['confidence']}")

Output:

React (JavaScript Framework) - confidence: 0.95
Next.js (JavaScript Framework) - confidence: 0.90
Cloudflare (CDN) - confidence: 1.0
Google Analytics (Analytics) - confidence: 0.85
Marketo (Marketing Automation) - confidence: 0.80
AWS (Hosting) - confidence: 0.75

One API call. Every technology. Confidence scores on each.

Building the Competitive Intelligence Scanner

Let's build something actually useful: a tool that takes a CSV of competitor URLs, scans each one, and produces a comparison matrix.

Step 1: Install Dependencies

pip install requests pandas tabulate

Step 2: The Scanner

import requests
import pandas as pd
import time
import json

API_KEY = "your_rapidapi_key"
API_HOST = "technology-detection-api.p.rapidapi.com"

def detect_tech(url):
    """Detect technologies for a single URL."""
    try:
        response = requests.get(
            f"https://{API_HOST}/detect",
            headers={"x-rapidapi-key": API_KEY, "x-rapidapi-host": API_HOST},
            params={"url": url},
            timeout=10
        )
        response.raise_for_status()
        return response.json()
    except Exception as e:
        return {"error": str(e), "url": url, "technologies": []}


def scan_competitors(urls):
    """Scan a list of URLs and return structured results."""
    results = []
    for url in urls:
        print(f"Scanning {url}...")
        data = detect_tech(url)
        for tech in data.get("technologies", []):
            results.append({
                "company": url.replace("https://", "").replace("www.", "").split("/")[0],
                "technology": tech["name"],
                "category": tech["category"],
                "confidence": tech["confidence"]
            })
        time.sleep(1)  # respect rate limits
    return pd.DataFrame(results)


# Your competitor list
competitors = [
    "https://stripe.com",
    "https://square.com",
    "https://paypal.com",
    "https://braintreepayments.com",
    "https://adyen.com",
]

df = scan_competitors(competitors)

Step 3: Build the Comparison Matrix

# Pivot: companies as rows, technology categories as columns
matrix = df.pivot_table(
    index="company",
    columns="category",
    values="technology",
    aggfunc=lambda x: ", ".join(sorted(set(x)))
)

print(matrix.to_markdown())

This gives you a table like:

Company	Analytics	CDN	CMS	Hosting	JS Framework
stripe.com	Google Analytics	Cloudflare	-	AWS	React, Next.js
square.com	Segment	Fastly	-	GCP	React
paypal.com	Adobe Analytics	Akamai	-	PayPal (self)	Angular
adyen.com	Google Analytics	Cloudflare	-	AWS	Vue.js

Now you can see at a glance: who uses what CDN, who's on which framework, who has which analytics. This is intelligence you can act on.

Practical Use Cases That Generate Revenue

1. Sales Lead Qualification

You sell a Shopify app. Instead of cold-emailing every e-commerce company, scan their sites first:

def is_qualified_lead(url):
    """Check if a prospect uses our target platform."""
    data = detect_tech(url)
    techs = [t["name"].lower() for t in data.get("technologies", [])]
    return "shopify" in techs

# Filter your prospect list
prospects = ["https://allbirds.com", "https://gymshark.com", "https://mvmtwatches.com"]
qualified = [url for url in prospects if is_qualified_lead(url)]
print(f"{len(qualified)}/{len(prospects)} prospects are on Shopify")

Now your sales team only contacts companies that actually use your target platform. Conversion rates go up, wasted time goes down.

2. Market Research at Scale

Want to know what percentage of the top 100 e-commerce sites use Cloudflare vs Akamai? Or how many have adopted React?

from collections import Counter

# After scanning your list
cdn_usage = Counter()
for _, row in df[df["category"] == "CDN"].iterrows():
    cdn_usage[row["technology"]] += 1

print("CDN market share among scanned sites:")
for cdn, count in cdn_usage.most_common():
    print(f"  {cdn}: {count} sites ({count/len(competitors)*100:.0f}%)")

3. Security Auditing

If you run a security consultancy, scanning a prospect's tech stack is the first step in an assessment. Outdated jQuery? No CDN? HTTP instead of HTTPS headers? These are conversation starters.

4. Investment Due Diligence

VCs and analysts scan portfolio company tech stacks to assess technical maturity. A startup claiming "AI-first" that runs on WordPress with no modern framework might raise questions.

What Gets Detected

The API identifies 141+ technologies across these categories:

Category	Examples
CMS	WordPress, Shopify, Squarespace, Wix, Webflow
JS Frameworks	React, Vue.js, Angular, Next.js, Svelte
CDN	Cloudflare, Akamai, Fastly, AWS CloudFront
Analytics	Google Analytics, Hotjar, Segment, Mixpanel
E-commerce	Shopify, WooCommerce, Magento, BigCommerce
Hosting	AWS, Google Cloud, Azure, Vercel, Netlify
Email	Google Workspace, Microsoft 365, SendGrid
Security	Cloudflare WAF, Sucuri, reCAPTCHA

Each detection comes with a confidence score (0.0-1.0) and which detection layer triggered it (HTTP headers, HTML patterns, DNS, or TLS).

Getting Started

pip install techdetect

The Python client handles authentication, rate limiting, and response parsing:

from techdetect import TechDetectClient

client = TechDetectClient(api_key="your_key")
result = client.detect("https://example.com")

for tech in result.technologies:
    print(f"{tech.name}: {tech.confidence}")

Resources:

API on RapidAPI (free tier: 10 requests/month)
Python client on GitHub
Step-by-step detection tutorial

If you're building competitive intelligence tooling or have interesting use cases for technology detection data, I'd like to hear about them in the comments. The API is also available as an MCP server for integration with AI assistants.