THE SECURITY GATOR · GATORBYTE #010 · FREE
Nobody broke in. Every door was a login.
Count every internet-reachable sign-in you expose, mark where MFA is really enforced, and close the paths that skip it. Twelve categories, a coverage matrix, and a help-desk verification script.
Free, and yours to keep. Works offline — the kit contains no network code, so nothing phones home.
Who it's for
Built for
- MSPs and IT teams that have never counted their sign-in surface
- Anyone who says “we have MFA” and hasn't checked it door by door
- Teams hardening after a season of intrusions that used valid-looking logins
Not built for
- An identity provider or an MFA product
- A penetration test or an external attack-surface scan
- A guarantee that every door is covered
What it does
Twelve categories
From the identity provider to the help desk's reset procedure — the doors teams forget they have.
MFA coverage matrix
Per door: enforced on the door, upstream at the IdP, or nowhere. “We have MFA” is a per-door claim.
Legacy-path kill list
The paths that skip the second factor. Close what you can, write down what you can't and why.
Help-desk verification script
A reset flow is a login. A script for the door that answers to a voice.
How it runs — the honest version
It is one HTML file that opens in the browser you already have. No install, no account, no license key, no connection required.
What you type stays on your machine. Entries save to your browser's local storage. There is no analytics, no tracker, and no network code in the file — nothing to send anything anywhere.
Local storage is per browser, per machine. A different computer, a cleared cache, or a private window means a fresh copy. For anything you need to keep, use Print or Export — that is what they are for.
The worksheet comes as files too. Login-Surface Inventory ships as CSV and as an Excel workbook, so nothing traps your data in our format.
Free means free. No subscription, no trial, nothing locked behind a paywall. Gumroad collects an email at checkout to deliver it, and that is how the next kit finds you.
What's in the download
One folder, 7 files, 263 KB zipped. Nothing to install.
Gatorbyte-010-login-surface-kit.html243 KBthe kit — opens in any browser, works offline
Gatorbyte-010-login-surface-kit.pdf95 KBprint edition, if you would rather work on paper
MANIFEST.txt2 KB
START-HERE.txt3 KBwhat this is and how to use it
TERMS-AND-LICENSE.txt3 KBlicense, disclaimers, and what you may do with it
worksheets/Gatorbyte-010-worksheets.xlsx7 KBthe worksheet as an Excel workbook, with dropdowns
worksheets/login-surface-inventory.csv1 KBthe same worksheet as plain CSV
Every release publishes a SHA-256 checksum so you can confirm the file is exactly what we built, byte for byte.
In PowerShell:
FAQ
- Where does a gap usually turn up?
- Local and service accounts on a console that has its own login, and the help desk's reset procedure. A console with a local admin does not care how good the identity provider's MFA is.
- What does it cost?
- Nothing. It is free, and it stays yours. Gumroad asks for an email address at checkout because that is how it delivers the file — and yes, it means you may hear about the next one. That is the whole trade.
- Do I need an account, a key, or an internet connection?
- No, no, and only to download it. Once the folder is on your machine the kit opens straight from the file and runs with no connection at all.
- Where does what I type go?
- Into your own browser's local storage, on your own machine. The file contains no analytics, no trackers, and no network code of any kind — there is nowhere for it to send anything. Print or export to keep a durable copy.
- I'd rather use a spreadsheet.
- Then use the included one. The worksheet ships as CSV and as an Excel workbook with the dropdowns already set up, so you can work there instead. The guidance itself lives in the HTML and the PDF.
- Can I use this with my clients?
- Yes, including in paid engagements. Use it inside your organization and with the clients you serve. What you may not do is resell it or republish it as your own. Full terms are in the download.
Free · instant delivery · no subscription · yours to keep and to use with your clients.
Supports security-review and audit-prep workflows — a practical starting point to review and adapt for your organization; not legal, compliance, or audit advice, and not a substitute for managed security or incident-response services.
This kit supports compliance documentation and audit-preparation workflows. It is a practical starting point — review and adapt it for your organization. It is not legal, compliance, or audit advice, it is not a substitute for counsel, a qualified assessor, or your own testing, and using it does not establish or certify any compliance or security outcome. Framework references are provided for orientation; consult the official source documents for normative text. The Security Gator LLC is not affiliated with or endorsed by NIST or any other standards body or regulator.