Sentinel
Passive web security posture scanner — grades a site’s HTTP headers, cookies, email and DNS hygiene, and TLS from the outside, using only what the server already tells any visitor.
Problem
Security posture decays quietly. Headers drift during a redesign, a cookie loses a flag, the DNS records that stop someone spoofing your domain were never set at all. None of it breaks the site, so nobody looks — and the checks that would catch it are scattered across a handful of single-purpose tools, each grading one slice, none of them telling you where you actually stand.
Solution
Built Sentinel to run the whole set in one pass from outside the perimeter: HTTP security headers, cookie attributes, email and DNS hygiene, and TLS and certificate posture, resolved into a single graded report. Passive by design — it reads only what a server already returns to any visitor, so there is nothing to install, no credentials to hand over, and nothing that could disturb the site being scanned.
Outcome
Live at sentinel.nyxoralabs.com, grading any public domain in a single pass. The first site it scanned was this one, and the F it returned was its own bug rather than a real finding — the fix became a capability: it now walks the redirect chain hop by hop and reports that the plain-http response carries no HSTS of its own.
A Nuxt 3 pnpm workspace — the scanner app is one package, the checks another, each check a plain TypeScript module carrying as few dependencies as it can. Scans run on Nitro serverless functions on Vercel: a scan is a request, so there is no queue and no state to keep between them.
- Passive, not intrusive
- Every check reads something the server already volunteers to any visitor — response headers, cookie attributes, public DNS records, the TLS handshake. Nothing is probed, fuzzed, or authenticated against, which is what makes it safe to point at a domain without arranging anything first.
- Dep-light check modules
- A security tool is judged by its own supply chain. Checks are written as small TypeScript modules rather than wrappers around existing scanners, so the thing doing the grading has an attack surface worth trusting.
- Grade the response you actually got
- The scanner walks redirects by hand instead of letting fetch resolve them, records every hop, and grades the final document response — reporting the resolved URL so the report says exactly what it looked at.
- Nuxt 3
- TypeScript
- Nitro
- Vercel
- pnpm workspace
Interested in similar work?
If this maps to something you're building, let's talk about your project.