RoastMyOpsec

Incident theater · live roast

ROASTMYOPSEC

Take the free audit now. Pick website or app, paste a URL, get five no-brainers unlocked — fifteen-plus deeper cuts stay blurred until you choose to open the vault.

Scan type

Marketing/site surface: headers, cookies, trackers, robots, mixed content.

5 free findings from a fixed audit pack · 15+ deep cuts stay blurred until you unlock

By scanning you agree to the Terms and Privacy Policy.

Score 1–10 · weekly leaderboard · GitHub deepen optional

The pain

Your marketing site is whispering secrets to strangers.

Missing headers. Soft cookies. `.env` souvenirs. Public JS holding keys like a drunk tourist. Attackers don't need zero-days when your OPSEC is cosplay.

How it works

Free audit first. Vault later.

  1. 01

    Pick website or app

    Website mode roasts the public site surface. App mode leans into API/auth OPSEC.

  2. 02

    Take the free audit

    Five no-brainer findings unlock immediately with score 1–10. No card required.

  3. 03

    Peek the blurred vault

    Fifteen-plus deeper opportunities stay frosted until you open the vault — which also includes the RoastMyOpsec Discord community.

Methodology

What we scan, how we gather it, why it gets roasted

Defensive checks only — public responses, headers, careful path probes, DNS, and optional GitHub deepen. No exploit payloads.

Free audit pack

  • Headers

    Browser guardrails missing in transit

    Your headers walked into the room wearing a name tag that says 'please hijack me.' CSP? Absent. HSTS? Optional vibes. Framing? Wide open for an evil iframe party.

    What · Security response headers on the primary document: CSP quality signals, HSTS max-age, framing controls, Referrer-Policy, exact nosniff, and Permissions-Policy.

    How · We issue a consented GET to your URL and read response headers only — no payload injection, no fuzzing.

    Why · Without these, browsers forgive XSS, clickjacking, MIME confusion, and HTTPS downgrade attempts more easily.

  • TLS

    Cleartext or soft HTTPS story

    You're still shipping vibes over HTTP like it's 2009. Encryption is not a personality trait — turn it on.

    What · Whether the submitted public URL and its redirect destination use HTTPS.

    How · We inspect URL schemes while following bounded redirects. This is not a protocol-version or cipher-suite audit; certificate trust is whatever the runtime accepts.

    Why · Cleartext is a gift shop for credential theft, cookie snatching, and quiet tampering on hostile networks.

  • Availability

    Target fetch could not produce auditable evidence

    No evidence, no verdict. The scanner could not reach this target without breaking its safety rules.

    What · Whether the public target returns a bounded HTTP response to the scanner.

    How · One SSRF-guarded public GET with redirect, timeout, port, and body-size limits.

    Why · An unreachable target cannot be graded honestly; this is scan status, not an OPSEC failure.

  • Cookies

    Session cookies without hard flags

    Your cookies are dressed for a beach day: no Secure, no HttpOnly, SameSite optional. Session theft called — it says thanks.

    What · Secure, HttpOnly, and SameSite attributes on session/auth-like cookies visible on the landing response.

    How · We parse Set-Cookie attributes and grade only session-like cookie names. No login automation means absence is inconclusive.

    Why · Soft cookies leak to JS, travel over HTTP, or ride along on cross-site requests — session theft writes itself.

  • Exposure

    Sensitive paths or source maps on the public root

    Congrats: your production root is a museum of secrets. .git, .env, maps — pick a souvenir, attackers already did.

    What · Common sensitive paths (.git, .env, backups, package manifests) and sourceMappingURL breadcrumbs.

    How · Bounded GET probes to well-known paths, checked for redirect-to-home and soft-404 behavior plus file-specific content signatures.

    Why · Public VCS/env files and maps are how amateurs become incident-response customers overnight.

  • Secrets

    API keys and tokens living in client JS

    You hardcoded secrets into JavaScript like it was a diary under the mattress. The whole internet has a nightlight.

    What · Inline HTML and same-origin script assets for high-confidence secret patterns (keys, tokens, PEM blocks).

    How · We fetch publicly linked same-origin scripts and scan text with conservative regex — no authenticated APIs, no exploit kits.

    Why · Client bundles are public. Secrets there are not 'hidden'; they're already stolen pending rotation.

Vault teasers (blurred after free audit)

  • Fingerprint

    Stack banners advertising your exact toys

  • CORS

    CORS policy that trusts the wrong Origin

  • Mixed content

    HTTP assets riding shotgun on an HTTPS page

  • Attack surface

    Admin/login surface inventory

  • Disclosure

    robots.txt acting as a treasure map

  • Email auth

    SPF/DMARC gaps inviting spoofed mail

  • DNS

    Nameserver and DNS hygiene footprint

  • Redirects

    Cross-site redirects or token-like URL parameters

Full list appears on your report after the free audit — still locked until unlock.

Leaderboard

This week's least roasted

Highest OPSEC scores from published free audits. Shame is a feature.

Full board →

Pricing

Start free. Unlock only if it hurts.

Free audit

Website or app mode · 5 unlocked findings · score · blurred vault preview · leaderboard

$0

Free audit now

Deep vault

15+ opportunities with full roast copy, methodology, remediations · GitHub deepen module · Discord community included

Open the vault

One-time unlock after your free audit — Discord access unlocks with the vault.

Community

The RoastMyOpsec Discord

A private room for builders shipping public sites and apps — where OPSEC slips get called out, fixed, and learned from together.

  • OPSEC threads

    Ask about headers, cookies, secrets exposure, and hardening without the LinkedIn cosplay.

  • Peer roast reviews

    Share a public URL or finding and get blunt feedback from people who actually ship.

  • Weekly signal

    Patterns we keep seeing in audits — what leaks, what ages badly, what to fix first.

Included when you open the vault after your free audit — one month of access, invite on your report.

Included when you open the vault

Blog

News, safety, vulnerabilities

Answer-first OPSEC guides for public sites — the same niches the scanner actually grades.

All posts →

FAQ

Before you roast

Is this hacking?
No. Defensive, consent-based self-audits of public responses. Private IPs and localhost are blocked. No exploit payloads. See our Terms.
Website vs app scan?
Website mode emphasizes site hygiene (trackers, robots, mixed content). App mode leans into API/auth discoverability, CORS, methods, and chatty error surfaces — still via your public URL.
Why GitHub access?
Optional. Temporary OAuth lets us check for committed secrets, reckless Actions permissions, and lockfile risk — things a URL alone cannot see.
What's in the deep vault?
Full roast copy, methodology, and remediations for the blurred findings, optional GitHub deepen on the report, and access to the RoastMyOpsec Discord(OPSEC threads, peer roast reviews, weekly signal — one month included). It's a one-time unlock after your free audit; the amount is shown at checkout (currently $19 USD).
Privacy?
Read the Privacy Policy for what we collect and how scans work.