About FlawRadar

FlawRadar is a small tool for developers who want to know how their site looks from the outside. It reads what the server already tells every visitor and points out the settings that are missing or wrong.

What it sends

Requests are read-only and come from the published addresses. A normal scan makes about eight requests. A deep scan, which needs proof of control, adds about twenty. FlawRadar never submits a form, logs in, or tries passwords, and it follows at most five redirects, checking every one before it connects.

What it keeps

Each report stores the host name, the time, the score, the findings, and short evidence such as header values. Page bodies are not stored. For the deep checks, a file counts as exposed only when its content matches the kind of file expected, and the content itself is thrown away. Reports are deleted after the retention period set by whoever runs the service. Anyone who has a report link can read the report, so treat the link like a password. Report pages ask search engines not to index them.

What it will not scan

Private addresses, loopback, link-local and other reserved ranges are refused, and so is any name that resolves to one. This is checked again at connect time and at every redirect, so a DNS answer that changes between the check and the connection does not get through. Only ports 80 and 443 are used.

Source code uploads

On the source code page, files you drop are sent to the server, read in memory and discarded. No copy is written to disk, no report is saved, and results are shown only on that page. Secrets that match known formats are shown masked to the first three characters. The check is pattern matching, so it finds common mistakes and misses anything that needs following data through the program.

What it cannot tell you

• It looks at the home page. A header missing from the home page may be present elsewhere, and the reverse.
• It does not look for bugs in your code. A good score means the settings it checks are in place, not that the site is secure.
• Some checks look at what a browser would do (cookies, CSP). They read the policy as written and do not run the page.
• DKIM cannot be checked from outside because the selector name is not public.
• Sites behind a firewall that blocks unknown scanners may refuse the request. FlawRadar reports that instead of grading the block page.

Terms and privacy

Before a scan or an upload, FlawRadar asks you to confirm that you own the site or code, or have written permission to test it, and to accept the Terms of Service, the Acceptable Use Policy and the Privacy Policy. The accepted version is recorded with the scan. Site owners can ask to be excluded from scanning; see the Acceptable Use Policy.

Running your own

FlawRadar is a single Node.js process with an SQLite file. The README in the project explains the settings, including how to publish your own scanner addresses so people can allow-list them.