#128 · Ruby · ★ 90 · MIT · updated 21h ago
The CLI adds a --<check> flag for every enabled check (bin/site-inspector:29-31). The README lists only https, hsts, headers, dns and content (README.md:42-53), and leaves out accessibility, cookies, wappalyzer, wellknown and whois. "What's checked" also has gaps: It has no…
#127 · Ruby · ★ 90 · MIT · updated 21h ago
RFC 6797 §6.1.1 makes max-age a required directive. valid? only checks that the header isn't empty and has no stray quotes or whitespace (lib/site-inspector/endpoint/hsts.rb:10-14), so Strict-Transport-Security: includeSubDomains is reported as valid. Acceptance criteria: valid?…
#126 · Ruby · ★ 90 · MIT · updated 21h ago
Hsts#preload_ready? checks max_age >= 10_886_400 (18 weeks) (lib/site-inspector/endpoint/hsts.rb:34-37). hstspreload.org now requires at least 31536000 seconds (1 year), so site-inspector reports hsts_preload_ready: true for domains the preload list would reject. Acceptance…