QuickAudit — web security checklist

Ten-point OWASP-style security checklist for the page you're on: headers, cookies, mixed content, exposed files, JS library CVEs.

A pre-pentest sanity check that takes five seconds instead of fifteen minutes. Before you pay for a penetration test — or before you ship — there's a set of boring, mechanical misconfigurations that show up on a depressing share of production sites. No HSTS. No CSP. Session cookies without HttpOnly. A .git directory served to the public internet. jQuery 1.8 with four known XSS advisories. Finding these today means running curl -I, squinting at headers you half-remember, checking DevTools for mixed content, and pasting library versions into a CVE search. That's fifteen minutes per site, so people skip it, so it ships broken. QuickAudit is that checklist, as one button. THE TEN CHECKS 1. Transport security — HTTPS, plus HSTS with a max-age that actually means something 2. Content-Security-Policy — present, enforcing (not report-only), and not defeated by 'unsafe-inline', 'unsafe-eval' or wildcards. Nonces and 'strict-dynamic' are understood, so a modern strict policy passes instead of being nagged at 3. Clickjacking protection — CSP frame-ancestors or X-Frame-Options 4. MIME-sniffing — X-Content-Type-Options: nosniff 5. Referrer & Permissions policy — flags policies that leak full URLs to third parties 6. Cookie security flags — Secure, HttpOnly on session cookies, explicit SameSite 7. Mixed content — http:// subresources on an HTTPS page, split into active and passive 8. JavaScript libraries with known CVEs — versions read from live page globals, script URLs and source banners, looked up against OSV.dev. Not a hardcoded list that goes stale the week it ships 9. Exposed sensitive files — /.env, /.git/HEAD, /.htpasswd, /actuator/env and nine more. Off by default (see below) 10. Server version disclosure — banners that hand attackers your exact build number Every finding cites the header or artifact that caused it, and gives you the specific line to add. No "consider reviewing your security posture." ABOUT CHECK 9 Nine of the ten checks are entirely passive — they read what the page already sent your browser. Check 9 is the exception: it requests about a dozen well-known paths on the site you're looking at. It ships disabled. Enabling it requires ticking a box confirming you own the site or are authorised to test it. There's no crawling, no wordlists, no way to aim it at a host you aren't already on, and it's rate-limited. A finding requires the response body to match a content signature for that file type, so single-page apps that return HTTP 200 for every path don't generate a wall of false positives. WHAT IT IS NOT QuickAudit is not a vulnerability scanner and does not replace one. It sends no payloads, attempts no exploits, and cannot find a business-logic flaw. It is the checklist you run first so a real assessment isn't full of trivia. A perfect score means the ten common misconfigurations are absent — not that the application is secure. PRIVACY QuickAudit sends exactly one kind of data off your machine: detected library name@version strings, to api.osv.dev, to look up known CVEs. No URLs. No page content. No cookie values — it reads cookie flags and discards values. No analytics. No account. No telemetry. Host access is requested one site at a time, when you click Scan — not for all sites at install. Free and unlimited. Source: https://github.com/BAB78/quickaudit