[JoeBuildsThings]

Security fixes

• Web audit now sends one raw HEAD over the validated, pinned IP. Redirects are reported and never followed, no body is read. Closes redirect SSRF, DNS rebinding and slow body abuse.
• IP validation is an allowlist of global unicast addresses and also catches IPv4 hidden in mapped, 6to4 and NAT64 IPv6.
• Active port probe is off by default and needs explicit authorization, enforced on the server, with a stricter rate limit.
• Rate limiter uses the trusted proxy hop, is bounded in memory, and supports Upstash for shared counters.
• Nonce based CSP, HSTS and friends, pinned CDN libraries with SRI, JSON only API with origin check and 4 KB body cap.
• Dependencies bumped and audited. dnspython moved to 2.9.2 for a published advisory fix.

Accuracy fixes

• Invalid certificates report the real reason instead of "no TLS".
• Header scoring checks values (wildcard CSP, short HSTS) not just presence.
• SPF and DMARC policies are parsed. Provider fingerprints are anchored. Parallel DNS queries and per probe timeouts return partial results.

UI

New console layout with a written verdict, ranked findings, tabs, loading, cancel and error states that keep prior results, keyboard support, and a print report stylesheet.

Quality

Findings engine, 62 tests, GitHub Actions CI, Dependabot, privacy page, MIT license.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
netrecon	Ready	Preview	Nov 15, 2026 8:19am UTC