Security tools
JWTs, CORS, cookies, OAuth redirects, and IAM policy - the checks worth running before something ships.
CORS Config Generator/Explainer
Origins, methods, headers to generated CORS headers.
Security Risk Scanner
Paste a real GitHub repo - hardcoded secrets, unsafe dynamic execution, string-built SQL, insecure transport, and weak cryptography. Sign in required.
JWT Inspector
Decode a JWT header and payload, check expiry - decode-only, signing key never needed.
Bcrypt Cost Factor Calculator
A measured benchmark on your hardware plus a target hash time to the right bcrypt cost factor.
AWS IAM Policy Generator
Service, access level, and a resource ARN to a valid, scoped IAM policy JSON.
API Key Format Identifier
Paste a key prefix - which service it belongs to, based on documented prefix conventions.
OAuth Redirect URI Validator
Check a redirect URI against the OAuth 2.0 Security BCP - HTTPS, exact-match, no wildcards.
Session Cookie Security Checker
Paste a Set-Cookie header - HttpOnly, Secure, SameSite checked, each missing flag mapped to its risk.
CORS Preflight Simulator
Method, Content-Type, and headers - whether a preflight OPTIONS request fires, per the Fetch spec.
See this same kind of analysis applied to your whole repository
Call graphs, dead code, blast radius, and a health score. Results in 60 seconds, free.