# Hex256: full product description

> Hex256 (hex256.com) finds security gaps in a company's domain, code, dependencies, secrets and cloud, ranks them, opens safe fixes as pull requests, and drafts documents for Indonesia's personal data protection law (UU 27/2022 tentang Pelindungan Data Pribadi, "UU PDP"). Built for Indonesian e-commerce stores and SaaS companies. Same group as Dampingin (legal services). Interface and reports are in Indonesian.

## Who it is for

- Founders, CTOs and IT leads at Indonesian online stores and SaaS companies, usually without a dedicated security team.
- Companies preparing for a first penetration test, an enterprise client's security questionnaire, or UU PDP obligations.

## Why now

- UU PDP has been fully in force since 17 October 2024, after a two-year transition period.
- Article 46: data subjects and the authority must be notified within 3x24 hours of a personal data protection failure.
- Article 57(3): administrative fines of up to 2% of annual revenue.

## What is checked (the "six doors")

1. Domain and email: SPF, DKIM and DMARC. Weak or missing records let phishing emails sent in the company's name reach customers' inboxes.
2. Web and TLS: certificate validity and expiry, old protocols, HSTS, Content-Security-Policy, clickjacking protection (X-Frame-Options / frame-ancestors) and session cookies without secure flags.
3. Subdomains: read from public Certificate Transparency logs (crt.sh and Cert Spotter). Staging, dev, admin panel and database hosts that are publicly reachable are flagged.
4. Code and dependencies: Semgrep, Trivy and OSV on every push. Vulnerabilities on the CISA Known Exploited Vulnerabilities (KEV) list are ranked first.
5. Leaked secrets: Gitleaks scans the full commit history. Secret values are never stored, only a fingerprint and the file location.
6. Cloud: Firebase security rules (Realtime Database, Storage, Firestore) and Supabase row-level security (RLS), checked read-only with the public client config. AWS and GCP through read-only roles are coming soon.

## How it works

1. Connect: add a domain, add one DNS TXT record to verify ownership, connect a repository. A read-only cloud role is optional.
2. Check: open-source scanners run in a disposable sandbox on every push and every day.
3. Rank: priority (P0 to P3) combines CVSS severity, FIRST EPSS exploit probability, CISA KEV membership and whether the issue is reachable from the internet.
4. Fix: every finding comes with remediation steps. Fix classes that are safe to automate are opened as pull requests; the customer's team reviews and merges.
5. Report: an executive PDF report for management and auditors, plus email alerts when a new subdomain appears or a certificate is close to expiry.

## Free domain check

- Passive only: DNS, TLS, Certificate Transparency logs and the public homepage, the same data any browser sees. Takes about 30 seconds and needs no account.
- Returns a grade (A to E), a score (0 to 100) and findings with severity and fix steps.
- Checks for sensitive files such as /.env only run after domain ownership is verified. Active scanning requires written authorization (Rules of Engagement), in line with UU ITE Article 30.
- API: GET https://hex256.com/api/cek?domain=<domain>

## UU PDP workflow

- Hex256 reads the database schema (table and column names and types), never the data itself.
- Each column is mapped to a personal data category and turned into a draft ROPA (record of processing activities). A DPIA draft is also prepared.
- When a developer adds a new personal data column (for example no_ktp, the national ID number), the customer is notified to check the legal basis.
- Drafts are labelled as needing review by the company's data protection officer (PPDP). Nothing is sent anywhere without approval.
- Evidence for auditors: scan history, merged fix pull requests and DMARC status in one export.

## Legal findings and Dampingin

Some findings are legal rather than technical: a privacy policy that does not meet UU PDP, a missing data processing agreement, an unregistered trademark.

1. Hex256 finds the issue.
2. The customer approves forwarding a summary, with one click. No code and no personal data are included.
3. A Dampingin advocate does the work at a fixed price shown upfront. The customer pays Dampingin directly.
4. The finding closes automatically and the new document is added to the evidence pack.

Hex256 receives no referral fee from Dampingin.

## Hex256 versus a penetration test

- Hex256 Cek: automatic and daily; covers common gaps in domain, code, dependencies and secrets; Rp499.000 per month; UU PDP documents included.
- Penetration test by a human team: manual, one to several weeks, usually once a year; covers business logic, attack chains and social engineering; priced per project; produces reports for certification and enterprise clients.
- Recommended use: let Hex256 keep the basics fixed every day so paid pentest days go to the hard problems. Hex256's report can be the starting point for the testers.

## Methodology

- OWASP Top 10 and OWASP Secure Headers for web checks.
- CVSS for severity and FIRST EPSS for likelihood of exploitation.
- CISA KEV: vulnerabilities already exploited in the wild are ranked first.
- Certificate Transparency logs (crt.sh, Cert Spotter) for subdomain discovery.
- UU 27/2022: ROPA, DPIA and the 3x24-hour notification duty.

## What Hex256 does and does not do

Does:
- Finds gaps in code, dependencies, secrets, cloud and domains.
- Opens fix pull requests for safe fix classes.
- Drafts ROPA, DPIA and control evidence.
- Forwards legal issues to an advocate, with the customer's permission.

Does not:
- Block attacks in real time (that is the job of an EDR or WAF).
- Replace the company's PPDP, who stays legally responsible.
- Run active scans without written authorization.
- Guarantee passing an audit or never being breached.

## Pricing (Rupiah, excluding VAT)

- Free check: one-off passive domain check, no account.
- Hex256 Cek: Rp499.000 per month. 5 repositories, 1 verified domain, 1 cloud account, daily monitoring, automatic fix pull requests, ROPA draft from the database schema.
- Readiness Sprint: fixed-price engagement.
- Payment by bank transfer or payment gateway in Rupiah. Official invoices for companies. No crypto.

## FAQ

- Does the free check attack my site? No. It only reads public data: DNS, certificates, certificate logs and the homepage, like a normal browser.
- How is this different from antivirus or EDR? EDR blocks malware on laptops and servers in real time. Hex256 finds gaps in code, cloud and domains before attackers use them, then helps fix them. Many companies need both.
- Is our code sent to AI? Repositories are cloned into a disposable sandbox and deleted after the scan. Only the lines around a finding are sent to a model, with secrets and personal data redacted.
- Does Hex256 guarantee we pass a UU PDP audit? No one can guarantee that. Hex256 prepares drafts and evidence so the PPDP has organised material; legal responsibility stays with the company and its PPDP.

## Contact

- Security reports: security@hex256.com
- Privacy: privasi@hex256.com