observatorio-da-superficie

Surface Observatory is a project for passive, daily monitoring of the public surface of an explicit set of targets. Instead of producing a single security snapshot, it periodically collects HTTP security headers, TLS properties, DNS records, and Certificate Transparency data, storing everything as a time series. The core goal is to make drift visible: a header that disappears after a migration, a certificate issued by another authority, or a new subdomain that appears in public logs. The repository maintains automated probes that evaluate items such as HSTS, Content Security Policy, X-Content-Type-Options, Referrer policy, the presence of security.txt, and certificate validity. Results are displayed on a dashboard with scores per target, also indicating inconclusive states, which the project explicitly differentiates from absence. Complete snapshots are preserved only when there is a change, avoiding storage of large volumes of repeated data. The implementation uses only Python's standard library for the probes and dashboard generation. Data is kept in an append-only JSONL series, along with raw snapshots organized by date. There is also a change log in Markdown, with records of the days when the observed surface was altered. The target list is defined in a YAML file with inclusion justifications, and the project publishes engagement rules describing what is collected, what is never collected, and how to request removal of a target. The project emphasizes non-invasive collection: no cookie values are recorded, no request alters state, and only targets with a public policy authorizing observation are included. It is useful as a reference for those who want to track web security posture over time, compare their own targets with known references, and understand gradual changes in public infrastructure.