how it works
Collection. Every morning an automatic check, with no AI in it, tests the dependencies against two vulnerability databases, looks for secrets in the day's commits, compares security headers, certificates, DNS and the public surface with a baseline written in the code, and proves that the owner-only pages stay closed to everyone else.
Fix. A new serious problem opens one private report, only one even if it comes back. The fix comes from Dependabot or from a dedicated branch with a test that reproduces the problem; nothing reaches production without a human yes. The problem closes only when the next check sees it clean, in production.
Here you see the date and the outcome; the details of an open problem stay private until it is fixed.
- Next.js 14 (end of life) to 15.5.28 and React 19: out of three critical advisories (remote code execution in image optimization and on Windows hosts) and the Server Components denial of service. The runtime audit went from 1 critical and 3 high to zero.
- Privacy: a real player tag used as an example in code and tests was replaced before it could reach a build.
- Draft Radar security review: private routes behind a token compared in constant time, CORS limited to this site, no edge cache on private data.
- Review fixes: the admin PATCH route got its own owner check, and the status page stopped hanging on a slow probe.
- Hardening: security.txt for responsible disclosure, sitemap and robots, a styled 404 that leaks nothing.
- The first wall: Content Security Policy, HSTS, no framing, no MIME sniffing, and a rate limit on the AI endpoint.
Every load probes the site's public endpoints, with a timeout. No private data involved.