Finding Hidden Internal Apps Through Public Certificate Logs

Fri, 07 Aug 2026 07:06:00 -0500

Here is how anyone can unwrap the organization’s internal tools/products that no one is supposed to know about.

Typically, in software organizations, most of us don’t want to share internal applications on the internet, but we unintentionally share application names by requesting certificates. The issued certs get into the Certificate Transparency (CT) logs https://certificate.transparency.dev/, which are a Merkle tree that allows the rest of the world to see them. With this, anyone can access internal finance, upcoming products that had code names, etc.

Security on naveen srinivasan

Finding Hidden Internal Apps Through Public Certificate Logs