Free local baseline
Run the checks above, understand their limits, and export your own evidence-based report. No signup or API credits.
Evidence first. A practical next step.
Find a gap.
Understand the fix.
Review response headers or source text you’re permitted to inspect. Get real, bounded checks and a private remediation report—in your browser.
01 / No evidence uploads02 / No code execution03 / No target requests
Live now: local static evidence review. Website URL scans, repository cloning, and autonomous red-team testing are not enabled.
Start with the right permission
Which path fits your work?
Use response headers you obtained from your own system for a local review. The alpha does not fetch or attack your site.
Need broader coverage or still arranging permission? Request a scope review. Share a high-level objective only. A request never starts testing.
01 / Define your scope
What do you want to review?
Paste one complete response header block from browser developer tools. Remove cookies and credentials. A URL alone is not evidence.
Evidence origin: your supplied text.
One text input · 128 KiB · 4,000 lines · 5-second timeout · 100 displayed findings maximum.
Ready when you are. Confirm permission to begin.
02 / Evidence → remediation → retest
Your private report
[ — ]
No review has run yet.
You’ll see exactly what was checked, what needs a human look, and how to verify a fix. We don’t turn missing context into a security score.
Coverage and limits
The report omits raw evidence, filenames, and URLs. It includes a content hash, rule IDs, line numbers, and your local consent record. Store and share it thoughtfully.
Your evidence stays with you.
This page processes evidence in an isolated browser worker. There is no evidence upload, account, public report link, browser storage, or model API call. The hosting provider receives normal page requests. Downloading creates a file on your device; clearing removes this page’s input and report, but cannot erase downloaded files or copies made by your browser or extensions.
Do not include credentials, private keys, personal data, or customer secrets. Contact forms elsewhere on the site are separate: send only a high-level scope, not findings or credentials.
Rules reference OWASP Secure Headers and CWE as review guidance. Mappings do not establish compliance or certification. Real active testing requires separately verified authority, written scope, limits, and a private delivery arrangement.