Small tools we built for the work that keeps breaking.
Standalone utilities that come out of the audit engagements — some free, some priced per use. Each one targets a narrow problem where the off-the-shelf answer either doesn’t exist or treats the thing you care about as an afterthought.
Nine headers that decide whether your site survives an XSS.
Paste any public URL. The checker fetches it once and scores the OWASP Secure Headers Project baseline plus COOP / COEP / CORP, with a remediation hint for anything missing or weak. Letter grade, per-header verdict, 20 scans per IP per hour.
Keep your regulated RSS feed honest.
Monitor press releases, 8-K filings, prospectus amendments, product-recall notices, and labelling updates for silent edits and late corrections. Byte-level diffs across every snapshot, email alerts on every change, optional auto-correction with a public corrections sidecar feed — so a quiet edit upstream never becomes a reporting gap downstream.
Every certificate issued for your domain — before someone else finds it.
Weekly, daily, or hourly email alerts when a new TLS certificate appears in Certificate Transparency logs for your domain tree. Catch shadow-IT subdomains the moment they go live, and typo-squat lookalikes the moment a CA signs their cert. Mirrors the DORA / NIS2 asset-inventory and unauthorised-change bar without an ASM platform.
Catch lookalike URLs before a click.
Paste any URL or domain to detect IDN / punycode spoofs, mixed-script lookalikes, zero-width and BiDi control characters, and path-based impersonation. Runs client-side in the browser — nothing is sent anywhere.
Looking for a full audit instead?
Tools answer one question at a time. The three audit tiers map to the depth your regulator actually asks you to demonstrate.
See audit services →