How does your website look to an attacker?
A security grade for your public site in about 20 seconds, with the findings to fix first.
- About 20 seconds
- Ordinary requests, no attacks
- No login, nothing to install
- highContent-Security-Policy header not found
- medium6 security headers are missing
- mediumDMARC policy is none
What is checked
A few dozen ordinary requests and a look at public DNS. Nothing logs in, submits forms or tries an attack.
- TLS and certificateTrusted, matches the name, not about to expire, no TLS 1.0 or 1.1
- Security headersHSTS, Content-Security-Policy and its weak spots, framing, referrer, cross-origin isolation
- Cookies and CORSSecure, HttpOnly and SameSite on cookies; no origin allowed by wildcard or echo
- Exposed filesEnvironment files, config backups, archives, diagnostics pages, directory listings, .git
- Server disclosureVersion numbers in headers, TRACE, redirects over plain HTTP
- Mail DNSSPF and DMARC, so nobody can send mail in the domain's name
10 checks here. 76 more in a full run.
The snapshot runs what needs only a public URL. Code Gauntlet is the security review Icons Of runs on customer systems: 86 controls in 7 areas, each mapped to OWASP ASVS, the OWASP Top 10 and the Microsoft cloud security benchmark.
- Live site10 of 11 here
- Source code and dependencies10
- AI code review16
- Azure and identity13
- GitHub and CI/CD5
- Security process and documentation28
- Hands-on review3
| Area and what the full run checks | Needs | Snapshot | Full run |
|---|---|---|---|
Live site TLS, security headers, cookies, CORS, exposed files, version disclosure, mail DNS, and an OWASP ZAP baseline scan | A public URL | 10 | 11 |
Source code and dependencies Secrets in git history, vulnerable dependencies, static analysis, infrastructure as code, container images, SBOM | Read access to the repository | - | 10 |
AI code review Access control, injection, authentication, sessions, API and webhook handling, crypto, file handling and LLM risks, each finding checked against the code | The repository and an AI review pass | - | 16 |
Azure and identity Defender for Cloud, storage exposure, network exposure, RBAC, Key Vault, encryption, backups, alerting, Entra ID app registrations | Reader access to the Azure subscription | - | 13 |
GitHub and CI/CD Branch protection, pinned actions, workflow permissions, CI secrets, dependency updates | The GitHub organisation | - | 5 |
Security process and documentation Architecture and data flows, threat model, incident response, GDPR and privacy, test environments, vulnerability handling | Your documentation, read by an AI review pass | - | 28 |
Hands-on review Database permissions, MFA for administrators, authorization tested with real accounts | A security engineer and test accounts | - | 3 |
| All controls | 10 | 86 |
A full run also ends in a decision per control - fix, approve, risk accept or not applicable - with fix branches for what can be fixed in code, and re-runs that track progress in the report.
Your site is the front door. Check the rest of the house.
A 30-minute walkthrough: we run the automated checks and AI review on your repository and cloud setup, and go through the report with you.