QuickAudit — web security checklist

A pre-pentest sanity check that takes five seconds instead of fifteen minutes.

Before you pay for a penetration test — or before you ship — there's a set of boring, mechanical misconfigurations that show up on a depressing share of production sites. No HSTS. No CSP. Session cookies without HttpOnly. A .git directory served to the public internet. jQuery 1.8 with four known XSS advisories.

Finding these today means running curl -I, squinting at headers you half-remember, checking DevTools for mixed content, and pasting library versions into a CVE search. That's fifteen minutes per site, so people skip it, so it ships broken.

QuickAudit is that checklist, as one button.

The ten checks:

1. Transport security — HTTPS, plus HSTS with max-age
2. Content-Security-Policy — present, enforcing, and not defeated by 'unsafe-inline' / 'unsafe-eval' / wildcards
3. Clickjacking protection — CSP frame-ancestors or X-Frame-Options
4. MIME-sniffing — X-Content-Type-Options: nosniff
5. Referrer & Permissions policy — flags policies that leak full URLs to third parties
6. Cookie security flags — Secure, HttpOnly on session cookies, explicit SameSite
7. Mixed content — http:// subresources on an HTTPS page
8. JavaScript libraries with known CVEs — versions read from live page globals, looked up against OSV.dev
9. Exposed sensitive files — /.env, /.git/HEAD, etc. (Off by default)
10. Server version disclosure — banners that hand attackers your exact build number

Privacy: QuickAudit sends exactly one kind of data off your machine: detected library name@version strings, to api.osv.dev, to look up known CVEs. No URLs. No page content. No cookie values — the code reads cookie flags and deliberately discards values. No analytics. No account. No telemetry.

Source: https://github.com/BAB78/quickaudit