Hex256
Security and UU PDP readiness for Indonesian e-commerce and SaaS teams that have no dedicated security team.
- Client
- Hex256
- Role
- Year
- 2026
- Stack
- Next.js 16, React 19, TypeScript monorepo, Prisma + PostgreSQL, Semgrep, Trivy, passive recon, REST partner API + remote MCP server, Three.js
Problem
Indonesia's personal data protection law (UU 27/2022) has been fully in force since 17 October 2024, with a 3x24-hour breach notification duty. Small teams get security questionnaires from banks and enterprise buyers, but a yearly penetration test and a pile of scanner alerts do not tell them what to fix first.
What we built
- Free domain check (no account, about 30 seconds): a passive report on DNS, email authentication (SPF, DKIM, DMARC), TLS, security headers, Certificate Transparency subdomains and the privacy policy. It returns an A-E grade, a score and findings with fix steps. We ran it on hex256.com itself and published the honest result: grade C, 74/100, four medium findings. - Customer dashboard: add a domain, verify it with one DNS TXT record, connect a repository. Scanners run in disposable sandboxes, every finding is ranked P0 to P3 using CVSS, EPSS, CISA KEV and internet reachability, and safe fix classes are opened as pull requests. - UU PDP drafts: a ROPA and DPIA draft generated from table and column names only, never row data, plus an executive PDF report and an evidence export for auditors. - Public trust page, daily monitoring with alerts, a partner REST API and an MCP server so coding agents can run the checks.
Principles the code enforces
The public check is passive; exposure probes run only after domain ownership is verified and rules of engagement are accepted (UU ITE Art. 30); leaked secret values are never stored, only a hash; legal findings go to Dampingin only with the owner's consent.