Analyze pasted CORS response headers for dangerous combos: reflected origin with credentials, wildcard with credentials, null origin accepted, broad exposed headers. Offline, no probing.
Audit pasted HTTP response headers for missing security headers: HSTS, CSP, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy, cookie flags. Offline, no fetching.
Quick health check on an npm package before installing: latest version, days since publish, deprecation flag, license, stale/deprecated heuristic. One registry request.
Reviews HTTP response security headers from pasted curl -I/-IL/-v output, a HAR export or a headers file - HSTS, Content-Security-Policy, frame-ancestors/X-Frame-Options, nosniff, Referrer-Policy, Permissions-Policy, COOP, Set-Cookie flags and __Host- prefixes, CORS origin reflection, version leaks and deprecated headers. Ranks findings and returns a corrected header set. Includes an offline stdlib Python checker with --self-test.
Statically scan a project directory for leaked credentials (AWS access keys, GitHub PATs, Slack tokens, private-key blocks) before committing. JSON report with masked fingerprints only - raw secret values are never emitted. Zero dependencies, Node 18+.
