Tools with a purpose.
Work you can take forward.
Four focused workspaces for security engineers. Inspect evidence, make assumptions explicit and leave with a review document — not a score or another dashboard.
Choose the decision you need to make.
HTTP security header review
Turn a response snapshot into a contextual browser-policy review, with evidence and the next checks to make.
- Input
- Response headers + document context
- Take away
- Evidence-backed response review
Cookie attribute review
Inspect cookie scope, transport and browser access. Separate what the attributes say from what the server still needs to prove.
- Input
- Set-Cookie lines + purpose assumption
- Take away
- Redacted cookie review + verification steps
Rules of engagement builder
Prepare the boundary, execution constraints and safety conditions of an authorized security assessment.
- Input
- Assets, owners, constraints + stop conditions
- Take away
- Draft scope + approval handoff pack
Trust boundary worksheet
Connect an actor, a protected asset and a trust decision to an abuse scenario, a control and a verification owner.
- Input
- System boundary + review scenarios
- Take away
- Boundary model + verification register
Show what was reviewed.
Response snapshots, selected context and your own scenarios travel with the export. Examples are clearly labelled.
No manufactured certainty.
Observations are not vulnerability verdicts. Missing context and unverified assumptions remain visible.
Make the next step usable.
Copy or download Markdown and structured JSON for a review, issue or engineering handoff. No account required.
Local tools. Clear assumptions.
No sign-up or upload is required. Tool inputs stay in your browser’s memory, and each result explains its assumptions and limits.