Tools

Tools and templates

Tools that run in your browser and keep your data on your device, and templates for the work products the workflows ask for.

Runs in your browser

SBOM checker

Inspect CycloneDX or SPDX JSON for useful inventory signals, missing information, and reference problems. Export the report as JSON or CSV.

Local processingJSON and CSV reports

Open the checker Runs in your browser

JWT inspector

Decode a JWT, flag alg none, key confusion, weak HMAC secrets, risky kid, jku and jwk headers and missing or expired claims, and verify HS256, RS256, ES256 or Ed25519 signatures.

Local processingRFC 8725 checks

Open the inspector Runs in your browser

CSP evaluator

Check a Content Security Policy for unsafe-inline, unsafe-eval, wildcards and broad schemes, missing object-src, base-uri and frame-ancestors, and weak reporting.

Local processingCSP Level 3

Open the evaluator Runs in your browser

Security headers analyzer

Check pasted response headers: HSTS, CSP, X-Content-Type-Options, framing, Referrer-Policy, Permissions-Policy, COOP, COEP, CORP, caching and Set-Cookie attributes.

Local processingCookies and caching

Open the analyzer Runs in your browser

CVSS v4.0 calculator

Score CVSS v4.0 vectors with Base, Threat, Environmental and Supplemental metrics. Paste or build a vector; scores match FIRST’s reference calculator.

Local processingFIRST reference scoring

Open the calculator Runs in your browser

ReDoS checker

Find nested quantifiers, ambiguous alternatives, adjacent overlapping repeats and unanchored leading repeats in a regex, and time it against generated attack strings.

Local processingTiming probe in a worker

Open the checker Runs in your browser

security.txt validator

Validate a security.txt file against RFC 9116 and the IANA field registry: Contact, Expires, Preferred-Languages, https URIs, Canonical, CSAF and the OpenPGP signature wrapper.

Local processingRFC 9116

Open the validator Asks before it sends anything

OSV dependency lookup

Read package-lock.json, requirements.txt, poetry.lock, go.sum, Gemfile.lock, composer.lock or an SBOM locally, then check the exact versions against OSV.dev once you approve the request.

Sends names and versions only when you confirmOSV, CISA KEV and EPSS

Open the lookup Runs in your browser

GitHub Actions workflow analyzer

Check a pasted workflow for pull_request_target and workflow_run checkouts, ${{ }} injection in run steps, tag-pinned actions, broad GITHUB_TOKEN permissions, secrets: inherit, persisted credentials, self-hosted runners and cache poisoning.

Local processingModelled on zizmor’s audits

Open the analyzer Runs in your browser

ASVS 5.0 checklist export

Export the 345 OWASP ASVS 5.0.0 requirements as a CSV or JSON checklist, filtered by level (L1, L2 or L3) and chapter, with official IDs and the CC BY-SA 4.0 attribution.

Local processingCSV and JSON

Build a checklist

Standards

Identifier lookup

Paste a CWE, OWASP or ASVS ID from a scanner, pentest report or audit and go straight to its page: what it means, how to prevent it and the guides that cover it.

Guide

Choose and evaluate application security testing tools

What SAST, DAST, IAST, SCA, secrets, IaC, container and API scanners and ASPM each find and miss, where each runs, how to evaluate them on a seeded repository with per-CWE scoring and triage cost, and which to adopt first.

Read the guide

Templates

Each workflow’s work product as a blank Markdown template, with a completed synthetic example to compare against, and each learning path’s capstone workbook.

Workflow work products
Workflow	Blank template	Completed example
Fix a finding	workflow-fix-a-finding.md	workflow-fix-a-finding-completed.md
Secure a feature	workflow-secure-a-feature.md	workflow-secure-a-feature-completed.md
Review a design	workflow-review-a-design.md	workflow-review-a-design-completed.md
Test an application	workflow-test-an-application.md	workflow-test-an-application-completed.md
Respond to a vulnerability	workflow-respond-to-a-vulnerability.md	workflow-respond-to-a-vulnerability-completed.md
Build an AppSec program	workflow-build-an-appsec-program.md	workflow-build-an-appsec-program-completed.md

Capstone workbooks

Developer foundations capstone for the learning path Developer foundations
AppSec in practice capstone for the learning path AppSec in practice
Cryptography without shortcuts capstone for the learning path Cryptography without shortcuts
Browser and API boundaries capstone for the learning path Browser and API boundaries
From source to trusted release capstone for the learning path From source to trusted release
Runtime and cloud defense capstone for the learning path Runtime and cloud defense
Identity through the whole lifecycle capstone for the learning path Identity through the whole lifecycle
Build an evidence-driven security program capstone for the learning path Build an evidence-driven security program
Secure an AI application capstone for the learning path Secure an AI application

Private by design

The tools run in your browser. Files, tokens, policies, headers, patterns, workflows and security.txt files you check are not uploaded or stored, and the site’s Content Security Policy lets these pages connect only to this site. The one exception is the OSV dependency lookup: it reads your lockfile locally, shows you the exact request, and only when you press Send does it send package names and versions to OSV.dev (and, if you ask, CVE IDs to FIRST’s EPSS API). Its page alone may connect to those two services. Each report lists what was checked, what failed and what the input alone cannot show.