Mobius 1 helps small software teams see what their app exposes to the internet, prove whether a specific problem is real, and confirm the fix worked. José runs it.
Who I am
I'm José, a retired Space Force officer. I was a space operator: I worked on the space launch ground crew at Cape Canaveral, and I commanded a crew of satellite operators in Colorado. Security was at the forefront of my military career. These days I'm obsessed with agentic AI, and I'm learning it and building agentic AI solutions in public.
I love vibe coding. I also see the huge gaps vibe coders leave every time they code. My mission is to help close those gaps, with vibe coders and for them. I write about what I build, including what breaks, at Hold My Hammer.
What Mobius does
Mobius has a free check that reads only public data, and a paid check that tests your systems only after you prove you own the domain and give permission.
The free domain check
You type a domain on the home page. Mobius looks it up in public sources only:
- certificate transparency logs, through crt.sh, for hostnames that have had a public TLS certificate;
- passive subdomain sources;
- DNS, to see which of those names still resolve;
- Shodan's InternetDB, for public scan data about the resulting IP addresses;
- the CISA Known Exploited Vulnerabilities catalog, to tell which reported vulnerabilities are being exploited in the wild.
If Shodan reports vulnerabilities on an address that sits on a shared CDN or shared hosting, Mobius leaves them out, because they are as likely to belong to another customer on that machine. You get the remaining signals and a suggested next step. Apart from ordinary DNS lookups, the check never connects to your systems or tests them.
Proof & Retest
For one named question, such as whether a specific exposure is real, Mobius can test it directly. First you prove you control the domain by adding a DNS TXT record. Mobius then sets the scope: your verified domain, a short time window and a fixed list of approved checks. You confirm you own the domain or are authorized to test it. A policy gate refuses any check outside that scope. You get a PDF evidence brief whether the condition is confirmed or not, remediation guidance when it applies, and one retest of the same condition after you fix it. It costs $500 per scoped question during early access. It is not a full penetration test, and a finding is not guaranteed.
How the guides are written
The guides answer questions small teams search for when something comes up: a customer's security review, an incident at a provider, a worry about what is public. Each one cites its sources inline and lists them at the end, and someone other than the writer fact-checks it before it is published. A fact we couldn't confirm is either left out or marked as unconfirmed.
Contact
Email jrosario@mobius1.io, or find me on LinkedIn and GitHub. To report a security issue in Mobius itself, see security.txt.