61 Sicherheitstools für Web und Build.

Audit Set-Cookie headers: missing Secure/HttpOnly/SameSite, __Host-/__Secure- prefix violations, broad Domain, long expiry, cookies over HTTP, JWTs and emails in values, with a fix for each. Text, JSON, SARIF, Markdown; GitHub Action. Zero deps.

Scan a built static site (dist/, build/, out/) or live URL and generate a tight Content-Security-Policy with sha256 hashes for inline code. Outputs header, meta, Nginx, Apache, Netlify, Vercel, Helmet, JSON; --check mode for CI.

DNS and email security auditor: SPF (10-lookup limit, +all, ptr), DMARC, DKIM key strength, MX/null MX, MTA-STS, TLS-RPT, CAA, DNSSEC via DoH, dangling CNAME and subdomain takeover, wildcards and AXFR, with a fix for each. Text, JSON, SARIF, Markdown; GitHub Action. Zero deps.

Dockerfile and Docker Compose security linter: root users, unpinned or EOL base images, hardcoded secrets, curl | sh, disabled TLS/GPG checks, sensitive COPY, missing .dockerignore, privileged containers, docker.sock mounts, host namespaces and dangerous capabilities. Zero deps.

Validate .env files against .env.example or a JSON schema (missing, empty, extra and mistyped variables), flag weak and default secrets, real secrets in example files, and .env files that are committed, in git history or not gitignored. Never prints secret values. CLI, library and GitHub Action. Zero deps.

CI-friendly CLI and API that fails builds when deployed URLs are missing or misconfigure HTTP security headers (HSTS, CSP, COOP, cookies...) with specific fixes. JSON & SARIF output.

Find open redirects and mixed content in a built site or a live crawl: http:// scripts, styles, frames and images on HTTPS pages, insecure forms, client-side redirects fed by URL parameters, open redirect rules in _redirects/vercel.json, HTTPS downgrades, and optional safe redirect probing. Zero deps.

Validate security.txt (RFC 9116) and robots.txt for your domains or local files: missing or expired Expires, Contact and Canonical problems, wrong location, content type, PGP signature, redirects, plus robots.txt syntax, sitemap and sensitive-path disclosure. CLI, library and GitHub Action. Zero deps.

Subresource Integrity (SRI) generator and checker: hashes <script> and <link> resources in built HTML (sha256/384/512, local and CDN), writes integrity + crossorigin, fails CI on missing, wrong or stale hashes. JSON manifest, Vite and webpack plugins, text/JSON/SARIF/Markdown output, GitHub Action. Zero dependencies.

Crawl a static build (dist/, build/, out/, public/, _site/) before deploy and fail CI on broken internal links, missing assets, case-mismatched paths, missing #anchors and dead or redirecting external links. CLI, API, Vite and webpack plugins, GitHub Action. Zero dependencies.

TLS endpoint checker: certificate expiry, hostname mismatch, untrusted or incomplete chains, self-signed certs, weak keys and signatures, TLS 1.0/1.1 and weak ciphers, missing TLS 1.3, long-lived certs. Uses Node's TLS stack, no OpenSSL binary needed. CLI, library and GitHub Action. Zero deps.

Harden GitHub Actions: flags unpinned actions, broad or missing permissions, pull_request_target pwn requests, script injection, leaked secrets, persisted credentials, self-hosted PR runners, curl|bash, deprecated commands and undigested images, with a fix for each. --fix pins SHAs. Text, JSON, SARIF, Markdown; GitHub Action included.

WCAG 2.2 accessibility audit of static HTML for CI: alt text, form labels, button/link names, inline colour contrast, lang, title, landmarks, ARIA roles/references, aria-hidden focus traps, tabindex, iframe titles, zoom and autoplay, with a baseline file. SARIF, allowlist with expiry, GitHub Action. Zero deps.

Check cookie-banner consent behaviour in your built site: trackers and embeds that load before opt-in, missing banner, Consent Mode defaults, missing or less prominent Reject, pre-ticked boxes, implied consent and no way to withdraw. GDPR/PECR. SARIF, allowlist with expiry, GitHub Action. Zero deps.

Assemble Data Subject Access Request (DSAR / GDPR Article 15) exports from CSV, JSON and JSONL sources into one structured, checksummed bundle, and check it: subject matching, secret fields removed, third-party data flagged, Article 15 metadata, identity verification and the one-month deadline. SARIF, GitHub Action. Zero deps.

Check your built site honours Global Privacy Control: code reading navigator.globalPrivacyControl / Sec-GPC, sale/share advertising trackers that load unconditionally, /.well-known/gpc.json validity and policy disclosure. CCPA/CPRA, Colorado, Connecticut. SARIF, allowlist with expiry, GitHub Action. Zero deps.

Find and redact PII in log files: emails, phone numbers, public IPs, Luhn-valid card numbers, US SSNs, UK National Insurance numbers, checksum-valid IBANs, passwords/secrets in fields and dates of birth. Masked report, in-place or copy redaction. SARIF, allowlist with expiry, GitHub Action. Zero deps.

Compare the trackers and third parties your built site actually loads with what its privacy policy declares: undisclosed vendors and categories, undisclosed sale/sharing for ads, stale vendors, missing or old update dates, pages not linking the policy. SARIF, allowlist with expiry, GitHub Action. Zero deps.

Lint a declarative data-retention policy (YAML or JSON): missing or invalid periods, indefinite retention, conflicting rules, data categories held in systems with no rule, unknown categories/systems, missing legal basis, expiry action, trigger and owner, over-long periods, overdue reviews. SARIF, GitHub Action. Zero deps.

Inventory the third-party trackers, pixels and SDKs on your built static site: 45 known vendors with company and category (advertising, analytics, session replay, social, tag managers), unknown domains, tracking pixels, approved-vendor gate, JSON/CSV inventory. SARIF, allowlist with expiry, GitHub Action. Zero deps.

Fail your build when secrets or API keys end up in the frontend bundle (dist/, build/, .next/static, out/). Provider patterns, .env cross-check, source map scanning, Vite & webpack plugins, JSON & SARIF output. Zero dependencies.

Block form spam bots without a captcha: honeypot + signed timing tokens + JS proof + rate limiting. Webpack 5 and Vite plugins, a <2 kB client, and Express, Fastify, Next.js and Fetch API (Netlify/Vercel/Cloudflare) server helpers. Zero dependencies.

License compliance gate for npm projects: reads node_modules and npm/pnpm/yarn lockfiles, resolves SPDX expressions and LICENSE texts, enforces allow/deny lists, presets and project-license compatibility, and emits CycloneDX 1.5 and SPDX 2.3 SBOMs, NOTICES, and text/JSON/SARIF/Markdown reports. Zero deps.

Fail CI when dependency changes look suspicious: new install scripts, publisher/maintainer changes, freshly published versions, typosquats, deprecated packages, integrity swaps and git/URL deps. Diffs package-lock, pnpm and yarn lockfiles against a git ref or baseline. Text, JSON, SARIF; GitHub Action included.

Egyptian hieroglyphs instead of password dots: matching passwords show the same glyphs, typos show where they happen, nothing is revealed. Per-instance non-extractable HMAC key over each prefix (no per-character mapping), 4-6 bits/glyph, canvas sprite, input stays type=password, dot fallback. React, Vue, <pass-glyph>. Zero deps.

SBOM diff gate: compares CycloneDX 1.4-1.6 / SPDX 2.3 SBOMs or git refs, reports added, removed, upgraded and downgraded components plus license, supplier and hash changes, checks OSV.dev for new vs fixed vulns, and enforces policy. Text/JSON/SARIF/Markdown, GitHub Action.

One supply-chain gate for npm projects: runs package-tripwire (risky dependency changes), license-sentinel (license policy), sbom-diff-sentinel (new vulnerabilities and SBOM drift) and workflow-sentinel (GitHub Actions hardening) with one config, one combined report (text, JSON, SARIF, Markdown) and one exit code.

Check your built static site is ready for answer engines (AEO): question headings with concise direct answers, FAQPage/QAPage/HowTo schema, llms.txt, AI crawler rules in robots.txt (GPTBot, ClaudeBot, PerplexityBot, Google-Extended) and meta tags, and author/date E-E-A-T signals. SARIF, allowlist, GitHub Action. Zero deps.

Check canonical tags and hreflang clusters in your built static site: missing, multiple, relative or in-body canonicals, targets that are missing, noindex or chained, and hreflang codes, self-references, return links and x-default. Text/JSON/SARIF/Markdown, allowlist with expiry, GitHub Action. Zero deps.

Detect duplicate and near-duplicate content across your built static site: identical or near-identical titles, meta descriptions and page bodies (shingles + MinHash), site-name-only title differences and boilerplate-heavy pages. Text/JSON/SARIF/Markdown, allowlist with expiry, GitHub Action. Zero deps.

Audit heading structure in your built static site: exactly one visible H1, no skipped levels, no empty, generic, duplicate, image-only or overlong headings, H1 vs title agreement and site-wide duplicate H1s. Text/JSON/SARIF/Markdown, allowlist with expiry, GitHub Action. Zero deps.

Check indexability of your built static site: meta robots and X-Robots-Tag (noindex, nofollow, none, unavailable_after, nosnippet) against your intended indexing rules, site-wide noindex leaks, conflicts and malformed directives. Text/JSON/SARIF/Markdown, allowlist with expiry, GitHub Action. Zero deps.

Audit titles, meta descriptions, Open Graph and Twitter/X card tags across a built static site: presence, duplicates in the head, length, absolute URLs and real og:image files (dimensions, format, size). Text/JSON/SARIF/Markdown, allowlist with expiry, GitHub Action. Zero deps.

Find orphan pages in your built static site and measure click depth from the homepage: pages with no internal inbound links, unreachable clusters, nofollow-only or noindex-only links, pages too deep, dead ends. Text/JSON/SARIF/Markdown, allowlist with expiry, GitHub Action. Zero deps.

Validate JSON-LD and microdata in a built static site against schema.org types and Google rich-result requirements: parse errors, unknown types, missing required/recommended properties, bad dates, prices, currencies, enums, durations, ratings and breadcrumbs. Text/JSON/SARIF/Markdown, allowlist with expiry, GitHub Action. Zero deps.

Audit XML sitemaps against your built static site: size limits, invalid or other-host URLs, URLs that are missing, noindex or non-canonical, invalid/future/stale/uniform lastmod, and indexable pages missing from the sitemap. Text/JSON/SARIF/Markdown, allowlist with expiry, GitHub Action. Zero deps.

CI gate for JS/CSS bundle size: per-entry budgets on raw, gzip and brotli sizes, total JS/CSS budgets, growth vs a base-branch snapshot with content-hash-insensitive names, unminified and duplicate files. SARIF, Markdown, GitHub Action. Zero deps.

Check static hosting caching for performance: long max-age + immutable on fingerprinted assets, revalidation on HTML, no long cache on unhashed files, Vary and Set-Cookie pitfalls, and precompressed .br/.gz files that match. Reads _headers, vercel.json, netlify.toml, firebase.json. SARIF, Action. Zero deps.

Tiny (<3 KB gz), zero-dependency, typed favicon library: deterministic generative/identicon favicons from a seed with self-drawing animation, badges, progress rings and pulse, plus per-environment (dev/staging/prod) icons. CLI generates svg/ico/png sets + manifest. Vite & Next.js helpers. Modern replacement for favico.js and tinycon.

Audit web font loading in a built static site: font-display, preload with crossorigin, unused preloads, WOFF2, heavy or unsubset fonts, unicode-range, unused faces and weights, per-page font payload, Google Fonts display=swap and preconnect. SARIF, GitHub Action. Zero deps.

Find oversized and unoptimised images in a built static site: heavy files, images far wider than displayed, JPEG/PNG without AVIF/WebP, missing width/height, srcset and sizes, animated GIFs, opaque PNG photos, bloated SVGs. Reads image headers, no network. SARIF, GitHub Action. Zero deps.

Lazy-loading audit for static sites: below-the-fold images and iframes missing loading=lazy, and LCP candidates (hero images, first images) wrongly lazy-loaded or deprioritised. SARIF, Action. Zero deps.

Find render-blocking resources in a built static site: head scripts without defer/async, heavy blocking CSS, @import chains, third-party blocking resources without preconnect, document.write, parser-blocking body scripts, print CSS without media, missing critical CSS. SARIF, GitHub Action. Zero deps.

Third-party script weight and load-cost report for static sites: estimated bytes, requests and main-thread time per page and per vendor, with budgets, plus sync-script, duplicate and preconnect checks. SARIF, Action. Zero deps.

Fail CI on Core Web Vitals: reads Lighthouse, Lighthouse CI, PageSpeed Insights and web-vitals reports (or runs Lighthouse), takes the median per URL and gates LCP, CLS, TBT (lab INP proxy), INP, FCP and TTFB against thresholds and a baseline. SARIF, GitHub Action. Zero deps.

Lightweight Conventional Commits linter for git hooks and CI: lints a message, a file, stdin or a commit range, explains every problem and suggests a corrected header. Configurable types/scopes, sign-off and issue rules, hook installer. Text/JSON/SARIF/Markdown, allowlist with expiry, GitHub Action. Zero deps.

Find dependencies declared in package.json but never imported, and imports missing from package.json (or only in devDependencies). Understands ESM/CJS/TS, dynamic import, scripts, bins, config files and @types. Text/JSON/SARIF/Markdown, allowlist with expiry, GitHub Action. Zero deps.

Make engines.node, your CI matrix, .nvmrc/.node-version/.tool-versions/Volta/Dockerfile and your dependencies' engine requirements agree: untested minimum versions, CI versions outside engines, deps that need a newer Node, EOL versions. Text/JSON/SARIF/Markdown, allowlist with expiry, GitHub Action. Zero deps.

Hygiene checks for npm/yarn/pnpm workspaces: circular internal dependencies, internal ranges that no longer match, shared dependency drift, duplicate names, public packages depending on private ones, missing package fields and version drift. Text/JSON/SARIF/Markdown, allowlist with expiry, GitHub Action. Zero deps.

Validate package.json before you publish: exports/main/types/bin consistency and condition order, targets that do not exist or are not in "files", ESM/CJS mismatches, name/version rules, repository, keywords, license and sideEffects. Text/JSON/SARIF/Markdown, allowlist with expiry, GitHub Action. Zero deps.

Check what npm publish will actually ship before you publish: packs the tarball and verifies entry points, exports and bin targets exist and load, types resolve, no secrets or junk are included, and size stays within budget. Text/JSON/SARIF/Markdown, allowlist with expiry, GitHub Action. Zero deps.

Lint READMEs for missing sections, broken and stale badges, stale install commands, missing usage examples, broken relative links and anchors, placeholders and license mismatches. Optional live link check. Text/JSON/SARIF/Markdown, allowlist with expiry, GitHub Action. Zero deps.

CI gate that checks your version bump matches the changes since the last release (Conventional Commits: breaking/feat/fix) and that CHANGELOG.md has a real entry for the new version. Text/JSON/SARIF/Markdown, allowlist with expiry, GitHub Action. Zero deps.

Static PE/ELF triage in pure JS: headers, sections, entropy, imports, imphash, Rich header, overlays, TLS callbacks, packer hints (UPX, ASPack, VMProtect...), suspicious API capabilities mapped to ATT&CK, and hardening (ASLR, NX, CFG, PIE, RELRO, canary). Never executes samples. Zero deps.

Defang and refang IOCs (hxxps://evil[.]com) in text, logs and reports with several styles, and a CI check that fails when threat reports, tickets or docs contain live, clickable or half-defanged URLs, domains, IPs or emails. CLI, library and GitHub Action. Zero deps.

Hash lookup CLI: hash files or take MD5/SHA1/SHA256/SHA512 values and check them offline against self-hosted feeds (hash lists, CSV, MISP events and MISP feed directories, cached URL feeds) and optionally CIRCL hashlookup (no key), MalwareBazaar or VirusTotal. Zero deps.

IOC extractor for threat intel and incident response: pulls URLs, domains, IPv4/IPv6, emails, MD5/SHA1/SHA256/SHA512, CVEs, ATT&CK IDs, crypto wallets and registry keys from text, logs and reports, refangs defanged IOCs, filters noise and exports JSON, CSV, STIX 2.1 and SARIF. Zero deps.

Static malware triage report generator: hashes, file type, entropy, PE/ELF internals, Office macros and auto-exec, PDF actions, LNK, RTF, archives, scripts and HTML smuggling, IOCs, ATT&CK mapping, a verdict and a YARA starter rule, as Markdown, HTML or JSON. Never executes samples. Zero deps.

Offline phishing URL heuristics: lookalike and homograph domains, brand impersonation, IP hosts, userinfo tricks, risky TLDs, shorteners, free hosting, open redirects and more, with an explainable score per URL. Protect your own brands with a lookalike watchlist. CLI, library and GitHub Action. Zero deps.