OpenID Connect Discovery Security Auditor

Track public OpenID Connect discovery metadata and JWKS signing-key changes across runs. Emit structured rotation, endpoint, algorithm, and key-overlap signals for scheduled identity operations.

Audit OpenAPI and Swagger specifications for unsecured operations, unsafe server URLs, weak auth schemes and missing security responses.

Audit public SAML metadata for unsafe endpoints, missing roles, SHA-1, duplicate entity IDs and expired or soon-expiring certificates.

Directory Listing Quality Auditor

seeb/directory-listing-quality-auditor

Audit public directory listing pages for missing business details, weak descriptions, and local SEO quality signals.

Audit package-lock.json files for missing integrity, insecure or non-registry sources, install scripts, duplicate versions and unsupported formats.

Audit Dockerfiles for root execution, mutable images, embedded secrets, download-to-shell, unsafe permissions, remote ADD and weak package installation patterns.

CSP Header Analyzer

junipr/csp-header-analyzer

Deep-analyze Content Security Policy headers and flag unsafe or missing directives.

security.txt Auditor

junipr/security-txt-auditor

Audit security.txt auditor inputs and return structured findings, evidence rows, and a buyer-ready report for SEO, developer, and operations teams.

Website Security Auditor

zyrox/website-security-auditor

A powerful security tool to scan websites for exposed API keys and XSS vulnerabilities.

Audit a public website's security.txt vulnerability disclosure metadata. Checks discovery paths, required fields, expiration, contact methods, and returns a readiness score with recommendations.