Small checks. Fewer blind spots.

requirements.txt

Python requirements review

Review Python dependency pins, local hash declarations, package indexes, editable sources, and transport settings.

CycloneDX / SPDX JSON

SBOM comparison

Compare software inventories across builds. Find added or removed components and changes to license or digest metadata.

package.json / npm lockfile

Dependency review

Look beyond the version number. Review install scripts, dependency sources, version ranges, and lockfile integrity metadata.

npm lockfile v2 / v3

Lockfile diff

See what a dependency update really changed. Compare versions, download sources, integrity hashes, and installation hooks.

CycloneDX / SPDX JSON

SBOM explorer

Make your software inventory readable. Inspect components, versions, licenses, package identifiers, and missing metadata.

.npmrc

npm configuration review

Catch the quiet configuration risks: insecure registries, disabled TLS checks, and credentials with overly broad scope.

Any file / text

Integrity hash generator

Generate SHA-256, SHA-384, and SHA-512 integrity strings from a local file or text. Keep the bytes in your browser.

CI and build security

GitHub Actions YAML

GitHub Actions review

Review workflow permissions, action pinning, privileged triggers, and untrusted expressions before they reach your build.

Dockerfile

Dockerfile review

Check base-image references, runtime user declarations, installation patterns, and secret-bearing build settings.

Application security

Chrome / Firefox manifest.json

Browser extension review

Review a browser extension manifest for permission scope, injected scripts, messaging boundaries, and update settings.

JavaScript / ES modules

JavaScript review

Inspect JavaScript syntax for dynamic execution, HTML injection sinks, message handling, and sensitive storage patterns.

JWT

JWT inspector

Decode token headers and claims. Inspect expiry, declared algorithms, and key references without sending the token anywhere.

Pasted HTTP response headers

Security header review

Turn HTTP response headers into a practical review of browser protections, with notes on what needs closer attention.

Absolute URL

URL inspector

Unpack a link before you open it. Review its scheme, hostname, embedded credentials, and encoding-related signals locally.

AI and agent security

SKILL.md / Markdown

LLM skill review

Inspect SKILL.md metadata and instructions for capability declarations, remote execution, sensitive data access, and trust-boundary review signals.

Network and domains

PASSIVE LOOKUP

Public domain / certificate records

Subdomain finder

Find domain names recorded in public certificate transparency data, with source attribution and a dated lookup.