Open source
We build the tools we audit with
Free, MIT-licensed command-line tools by Louis Wright for security headers, content security policy, SEO, performance, accessibility and supply-chain checks. Most have zero dependencies and output SARIF for GitHub code scanning.
We reply within one working day. No pitch, no pressure.
Read our reviews on Google40 npm packages · 62 public repos · 71★ on GitHub · 17,787 total downloads
01 / Featured
Featured packages
- csp-forge427/week
Generate a strict Content Security Policy from your built site, and check an existing one against what the site actually loads.
- next-heraldPlanned
Typed metadata, XSS-safe JSON-LD, sitemaps and an SEO CI check for Next.js 16 App Router. In development.
- answer-beaconGitHub
Check that your built site is ready for answer engines: direct answers, FAQ and HowTo schema, llms.txt and AI-crawler rules.
- supply-chain-sentinelGitHub
One supply-chain gate for npm projects: risky dependency changes, licence policy, SBOM drift and GitHub Actions hardening, in one report.
02 / Catalogue
All packages
- next-heraldPlanned
- answer-beaconGitHub
03 / Dogfood
Gates this site
Every pull request to this website runs these checks. If one fails, the change doesn't ship.
- csp-forgeIn use
html · security:csp
- next-heraldPlanned
metadata · sitemap
- answer-beaconIn use
html · audit:html
- sri-sentinelIn use
html · audit:sri
- header-sentinelIn use
headers · html
- static-link-sentinelIn use
html · lighthouse-nightly
- package-tripwireIn use
install · audit:deps
- license-sentinelIn use
install · audit:deps
- form-honeypot-guardIn use
runtime · all forms
- cookie-sentinelIn use
html
- bundle-secret-guardIn use
build · audit:bundle
- workflow-sentinelIn use
audit:deps
04 / Clients
How we use them for clients
The same checks we run on this site are available through our services.
Want these checks on your site?
We reply within one working day. No pitch, no pressure.
Read our reviews on Google