59 security tools for the web and the build.

Audit Set-Cookie headers: missing Secure/HttpOnly/SameSite, __Host-/__Secure- prefix violations, broad Domain, long expiry, cookies over HTTP, JWTs and emails in values,

Scan a built static site (dist/, build/, out/) or live URL and generate a tight Content-Security-Policy with sha256 hashes for inline code

DNS and email security auditor: SPF (10-lookup limit, +all, ptr), DMARC, DKIM key strength, MX/null MX, MTA-STS, TLS-RPT, CAA, DNSSEC via DoH, dangling CNAME and subdomai

Dockerfile and Docker Compose security linter: root users, unpinned or EOL base images, hardcoded secrets, curl | sh, disabled TLS/GPG checks, sensitive COPY, missing .do

Validate .env files against .env.example or a JSON schema (missing, empty, extra and mistyped variables), flag weak and default secrets, real secrets in example files, an

CI-friendly CLI and API that fails builds when deployed URLs are missing or misconfigure HTTP security headers (HSTS, CSP, COOP, cookies...) with specific fixes

Find open redirects and mixed content in a built site or a live crawl: http:// scripts, styles, frames and images on HTTPS pages, insecure forms, client-side redirects fe

Validate security.txt (RFC 9116) and robots.txt for your domains or local files: missing or expired Expires, Contact and Canonical problems, wrong location, content type,

Subresource Integrity (SRI) generator and checker: hashes <script> and <link> resources in built HTML (sha256/384/512, local and CDN), writes integrity + crossorigin, fai

Crawl a static build (dist/, build/, out/, public/, _site/) before deploy and fail CI on broken internal links, missing assets, case-mismatched paths, missing #anchors an

TLS endpoint checker: certificate expiry, hostname mismatch, untrusted or incomplete chains, self-signed certs, weak keys and signatures, TLS 1.0/1.1 and weak ciphers, mi

Harden GitHub Actions: flags unpinned actions, broad or missing permissions, pull_request_target pwn requests, script injection, leaked secrets, persisted credentials, se

WCAG 2.2 accessibility audit of static HTML for CI: alt text, form labels, button/link names, inline colour contrast, lang, title, landmarks, ARIA roles/references, aria-

Check cookie-banner consent behaviour in your built site: trackers and embeds that load before opt-in, missing banner, Consent Mode defaults, missing or less prominent Re

Assemble Data Subject Access Request (DSAR / GDPR Article 15) exports from CSV, JSON and JSONL sources into one structured, checksummed bundle, and check it: subject matc

Check your built site honours Global Privacy Control: code reading navigator.globalPrivacyControl / Sec-GPC, sale/share advertising trackers that load unconditionally, /

Find and redact PII in log files: emails, phone numbers, public IPs, Luhn-valid card numbers, US SSNs, UK National Insurance numbers, checksum-valid IBANs, passwords/secr

Compare the trackers and third parties your built site actually loads with what its privacy policy declares: undisclosed vendors and categories, undisclosed sale/sharing

Lint a declarative data-retention policy (YAML or JSON): missing or invalid periods, indefinite retention, conflicting rules, data categories held in systems with no rule

Inventory the third-party trackers, pixels and SDKs on your built static site: 45 known vendors with company and category (advertising, analytics, session replay, social,

Fail your build when secrets or API keys end up in the frontend bundle (dist/, build/, .next/static, out/)

Block form spam bots without a captcha: honeypot + signed timing tokens + JS proof + rate limiting

License compliance gate for npm projects: reads node_modules and npm/pnpm/yarn lockfiles, resolves SPDX expressions and LICENSE texts, enforces allow/deny lists, presets

Fail CI when dependency changes look suspicious: new install scripts, publisher/maintainer changes, freshly published versions, typosquats, deprecated packages, integrity

SBOM diff gate: compares CycloneDX 1.4-1.6 / SPDX 2.3 SBOMs or git refs, reports added, removed, upgraded and downgraded components plus license, supplier and hash change

One supply-chain gate for npm projects: runs package-tripwire (risky dependency changes), license-sentinel (license policy), sbom-diff-sentinel (new vulnerabilities and S

Check your built static site is ready for answer engines (AEO): question headings with concise direct answers, FAQPage/QAPage/HowTo schema, llms.txt, AI crawler rules in

Check canonical tags and hreflang clusters in your built static site: missing, multiple, relative or in-body canonicals, targets that are missing, noindex or chained, and

Detect duplicate and near-duplicate content across your built static site: identical or near-identical titles, meta descriptions and page bodies (shingles + MinHash), sit

Audit heading structure in your built static site: exactly one visible H1, no skipped levels, no empty, generic, duplicate, image-only or overlong headings, H1 vs title a

Check indexability of your built static site: meta robots and X-Robots-Tag (noindex, nofollow, none, unavailable_after, nosnippet) against your intended indexing rules, s

Audit titles, meta descriptions, Open Graph and Twitter/X card tags across a built static site: presence, duplicates in the head, length, absolute URLs and real og:image

Find orphan pages in your built static site and measure click depth from the homepage: pages with no internal inbound links, unreachable clusters, nofollow-only or noinde

Validate JSON-LD and microdata in a built static site against schema.org types and Google rich-result requirements: parse errors, unknown types, missing required/recommen

Audit XML sitemaps against your built static site: size limits, invalid or other-host URLs, URLs that are missing, noindex or non-canonical, invalid/future/stale/uniform

CI gate for JS/CSS bundle size: per-entry budgets on raw, gzip and brotli sizes, total JS/CSS budgets, growth vs a base-branch snapshot with content-hash-insensitive name

Check static hosting caching for performance: long max-age + immutable on fingerprinted assets, revalidation on HTML, no long cache on unhashed files, Vary and Set-Cookie

Audit web font loading in a built static site: font-display, preload with crossorigin, unused preloads, WOFF2, heavy or unsubset fonts, unicode-range, unused faces and we

Find oversized and unoptimised images in a built static site: heavy files, images far wider than displayed, JPEG/PNG without AVIF/WebP, missing width/height, srcset and s

Lazy-loading audit for static sites: below-the-fold images and iframes missing loading=lazy, and LCP candidates (hero images, first images) wrongly lazy-loaded or deprior

Find render-blocking resources in a built static site: head scripts without defer/async, heavy blocking CSS, @import chains, third-party blocking resources without precon

Third-party script weight and load-cost report for static sites: estimated bytes, requests and main-thread time per page and per vendor, with budgets, plus sync-script, d

Fail CI on Core Web Vitals: reads Lighthouse, Lighthouse CI, PageSpeed Insights and web-vitals reports (or runs Lighthouse), takes the median per URL and gates LCP, CLS,

Lightweight Conventional Commits linter for git hooks and CI: lints a message, a file, stdin or a commit range, explains every problem and suggests a corrected header

Find dependencies declared in package.json but never imported, and imports missing from package.json (or only in devDependencies)

Make engines.node, your CI matrix, .nvmrc/.node-version/.tool-versions/Volta/Dockerfile and your dependencies' engine requirements agree: untested minimum versions, CI ve

Hygiene checks for npm/yarn/pnpm workspaces: circular internal dependencies, internal ranges that no longer match, shared dependency drift, duplicate names, public packag

Validate package.json before you publish: exports/main/types/bin consistency and condition order, targets that do not exist or are not in "files", ESM/CJS mismatches, nam

Check what npm publish will actually ship before you publish: packs the tarball and verifies entry points, exports and bin targets exist and load, types resolve, no secre

Lint READMEs for missing sections, broken and stale badges, stale install commands, missing usage examples, broken relative links and anchors, placeholders and license mi

CI gate that checks your version bump matches the changes since the last release (Conventional Commits: breaking/feat/fix) and that CHANGELOG.md has a real entry for the

Static PE/ELF triage in pure JS: headers, sections, entropy, imports, imphash, Rich header, overlays, TLS callbacks, packer hints (UPX, ASPack, VMProtect...), suspicious

Defang and refang IOCs (hxxps://evil[.]com) in text, logs and reports with several styles, and a CI check that fails when threat reports, tickets or docs contain live, cl

Hash lookup CLI: hash files or take MD5/SHA1/SHA256/SHA512 values and check them offline against self-hosted feeds (hash lists, CSV, MISP events and MISP feed directories

IOC extractor for threat intel and incident response: pulls URLs, domains, IPv4/IPv6, emails, MD5/SHA1/SHA256/SHA512, CVEs, ATT&CK IDs, crypto wallets and registry keys f

Static malware triage report generator: hashes, file type, entropy, PE/ELF internals, Office macros and auto-exec, PDF actions, LNK, RTF, archives, scripts and HTML smugg

Offline phishing URL heuristics: lookalike and homograph domains, brand impersonation, IP hosts, userinfo tricks, risky TLDs, shorteners, free hosting, open redirects and