RoastMyOpsec

Incident theater · live roast

ROASTMYOPSEC

Take the free audit now. Pick website or app, paste a URL, get five no-brainers unlocked — fifteen-plus deeper cuts stay blurred until you choose to open the vault.

Scan type

Marketing/site surface: headers, cookies, trackers, robots, mixed content.

5 free findings · 15+ deep cuts stay blurred until you unlock

By scanning you agree to the Terms and Privacy Policy.

Score 1–10 · weekly leaderboard · GitHub deepen optional

The pain

Your marketing site is whispering secrets to strangers.

Missing headers. Soft cookies. `.env` souvenirs. Public JS holding keys like a drunk tourist. Attackers don't need zero-days when your OPSEC is cosplay.

How it works

Free audit first. Vault later.

  1. 01

    Pick website or app

    Website mode roasts the public site surface. App mode leans into API/auth OPSEC.

  2. 02

    Take the free audit

    Five no-brainer findings unlock immediately with score 1–10. No card required.

  3. 03

    Peek the blurred vault

    Fifteen-plus deeper opportunities stay frosted until you unlock — $19 includes a $5 Discord month free.

Methodology

What we scan, how we gather it, why it gets roasted

Defensive checks only — public responses, headers, careful path probes, DNS, and optional GitHub deepen. No exploit payloads.

Free audit pack

  • Headers

    Browser guardrails missing in transit

    Your headers walked into the room wearing a name tag that says 'please hijack me.' CSP? Absent. HSTS? Optional vibes. Framing? Wide open for an evil iframe party.

    What · Security response headers on the primary document: CSP, HSTS, framing controls, Referrer-Policy, nosniff, Permissions-Policy.

    How · We issue a consented GET to your URL and read response headers only — no payload injection, no fuzzing.

    Why · Without these, browsers forgive XSS, clickjacking, MIME confusion, and HTTPS downgrade attempts more easily.

  • TLS

    Cleartext or soft HTTPS story

    You're still shipping vibes over HTTP like it's 2009. Encryption is not a personality trait — turn it on.

    What · Whether the audited URL is served over HTTPS and whether HTTP upgrades to TLS.

    How · We follow redirects on the public URL and inspect the final scheme. Certificate trust is whatever the runtime already accepts.

    Why · Cleartext is a gift shop for credential theft, cookie snatching, and quiet tampering on hostile networks.

  • Cookies

    Session cookies without hard flags

    Your cookies are dressed for a beach day: no Secure, no HttpOnly, SameSite optional. Session theft called — it says thanks.

    What · Set-Cookie attributes: Secure, HttpOnly, SameSite on the landing response.

    How · We read Set-Cookie headers from the first public response (no login automation in the free pass).

    Why · Soft cookies leak to JS, travel over HTTP, or ride along on cross-site requests — session theft writes itself.

  • Exposure

    Sensitive paths or source maps on the public root

    Congrats: your production root is a museum of secrets. .git, .env, maps — pick a souvenir, attackers already did.

    What · Common sensitive paths (.git, .env, backups, package manifests) and sourceMappingURL breadcrumbs.

    How · Careful HEAD/GET probes to well-known paths only. We do not download full repos or exploit anything — presence signals only.

    Why · Public VCS/env files and maps are how amateurs become incident-response customers overnight.

  • Secrets

    API keys and tokens living in client JS

    You hardcoded secrets into JavaScript like it was a diary under the mattress. The whole internet has a nightlight.

    What · Inline HTML and same-origin script assets for high-confidence secret patterns (keys, tokens, PEM blocks).

    How · We fetch publicly linked same-origin scripts and scan text with conservative regex — no authenticated APIs, no exploit kits.

    Why · Client bundles are public. Secrets there are not 'hidden'; they're already stolen pending rotation.

Vault teasers (blurred after free audit)

  • Fingerprint

    Stack banners advertising your exact toys

  • CORS

    CORS policy that trusts the wrong Origin

  • Mixed content

    HTTP assets riding shotgun on an HTTPS page

  • Attack surface

    Admin/login panels waving from the public internet

  • Disclosure

    robots.txt acting as a treasure map

  • Email auth

    SPF/DMARC gaps inviting spoofed mail

  • DNS

    Nameserver and DNS hygiene footprint

  • Redirects

    Redirect chains long enough to hide a mule

Full list appears on your report after the free audit — still locked until unlock.

Leaderboard

This week's least roasted

Highest OPSEC scores from published free audits. Shame is a feature.

Full board →
#1sooklabs.com9.8
#2sookly.co9.5
#3sookly.co9.5
#4vault.example9.4
#5roastmyopsec.sooklabs.com9.3

Pricing

Start free. Unlock only if it hurts.

Free audit

Website or app mode · 5 unlocked findings · score · blurred vault preview · leaderboard

$0

Free audit now

Deep vault unlock

15+ opportunities with full roast copy, methodology, remediations · GitHub deepen module · $5 Discord month included free

$19

Includes $5 Discord · 1 month

Offered after your free audit — Discord month unlocks with the vault.

FAQ

Before you roast

Is this hacking?
No. Defensive, consent-based self-audits of public responses. Private IPs and localhost are blocked. No exploit payloads. See our Terms.
Website vs app scan?
Website mode emphasizes site hygiene (trackers, robots, mixed content). App mode leans into API/auth discoverability, CORS, methods, and chatty error surfaces — still via your public URL.
Why GitHub access?
Optional. Temporary OAuth lets us check for committed secrets, reckless Actions permissions, and lockfile risk — things a URL alone cannot see.
What's in the $19 unlock?
Deep vault insights + remediations, GitHub deepen on the report, and a $5 Discord community month included free(1 month). After unlock, you'll get the invite on the report page — no separate Discord charge.
Privacy?
Read the Privacy Policy for what we collect and how scans work.