What this is running on.
A security site asking you to trust it ought to be checkable. Below: live health checks performed when you loaded this page, every dependency read from the manifest rather than typed out, and what has actually changed. The whole thing is open source — every claim on this site can be read as code.
Status
Run at request time, not written down in advance. Most status pages say “all systems operational” because nobody updated them, which turns “I don't know” into a false claim. This one prints whatever the checks return, including a failure I haven't noticed yet.
Dependencies (31)
Read from the manifest on this deployment, so it cannot drift from what is actually installed. A hand-maintained list is a document about a build that no longer exists. Machine-readable version at /sbom.json.
Honest limitation: these are the direct dependencies declared in the manifest, not the full resolved tree. The transitive graph is several hundred packages and lives in the lockfile in the repository, which is the authoritative record.
Changelog
Newest first. This records what actually shipped, not what was planned.
28 July 2026
- Eight free tools. Added a certificate-transparency attack surface check, a DNS hygiene checker (CAA, DNSSEC, nameserver resilience, wildcards, dangling CNAMEs), a TLS configuration checker, and three browser-only utilities — a JWT decoder, a CVSS 3.1 calculator and a hash identifier. The CVSS implementation is verified against published NVD vectors and implements the specification's round-up rule.
- Result-aware next steps. Every scan now ends with something that depends on what it found — including a path that offers nothing at all when a result comes back clean, and nothing when it is inconclusive.
- Fixed-price fixes at
/fix, from ₹6,000. The pricing ladder previously started at ₹45,000 with nothing beneath it. - Printable scan results. Free, no email wall, via a print stylesheet rather than a PDF library.
- Live self-scan on the homepage: the real Content-Security-Policy read off the request, plus live SPF and DMARC lookups on every load. Three states, so a resolver timeout shows amber rather than falsely announcing a failure.
- A data-handling policy, because the blog tells buyers to ask providers for one.
- security.txt with a PGP key and its fingerprint published alongside, so a downloaded key can be cross-checked.
- Fixed deep-link scrolling.
/#estimateand similar links were landing visitors on the hero and leaving them to scroll blind — which mattered, because those links are published off-site. - Per-page Open Graph cards for posts, case studies and every tool.
- DNS on this domain: SPF, DMARC at
p=reject, CAA, and a null MX. Before this, the site's own spoofability checker reported the site's own domain as spoofable. - A terminal-styled 404 that returns a real 404 rather than a soft 200.
27 July 2026
- Blog engine — plain markdown, RSS feed, reading time.
- Sample penetration test report published in full: a fictional target, real in every other respect.
- Two free tools: an HTTP security header grader and an email spoofability checker, both behind an SSRF guard tested against ten bypass attempts.
- A+ on securityheaders.com, using a per-request nonce CSP rather than
unsafe-inline. - Case studies, scope estimator, transparent pricing, and a command palette.
- First deploy to the custom domain.
Found something wrong here, or in the source? See security.txt — no bounty, but a fast reply, a fix, and credit if you want it.