Audit pasted HTTP response headers for missing security headers: HSTS, CSP, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy, cookie flags. Offline, no fetching.
Analyze pasted CORS response headers for dangerous combos: reflected origin with credentials, wildcard with credentials, null origin accepted, broad exposed headers. Offline, no probing.
Statically lint a Dockerfile for common security mistakes: untagged/latest base image, missing USER, secrets in ENV/ARG, curl|sh installs, remote ADD. Local files only, zero network.
Statically scan a project directory for leaked credentials (AWS access keys, GitHub PATs, Slack tokens, private-key blocks) before committing. JSON report with masked fingerprints only - raw secret values are never emitted. Zero dependencies, Node 18+.
Scan a diff or patch for accidentally committed secrets - API keys, tokens, private keys, passwords - in added lines only, values masked. Local text scan, zero network.
