cSPY - SecurityHeader Scanner — VaultOcean

CSPy is a professional-grade browser extension that audits HTTP security headers in real time. Built for developers, penetration testers, and security researchers.

WHAT IT DOES
• Scans every HTTP response header on any website
• Deep Content-Security-Policy (CSP) directive-by-directive analysis
• Detects missing, weak, or misconfigured headers (HSTS, X-Frame-Options, CORS, Referrer-Policy, Permissions-Policy, COOP, COEP, CORP, cookies)
• Grades security posture from A+ to F with a 0–100 score

MULTI-ENGINE CONSENSUS
• Three independent scoring engines: CSPy, Google CSP Evaluator, and Mozilla Observatory
• Cross-validates results — when engines agree, confidence is high

ACTIONABLE RECOMMENDATIONS
• Every finding includes a plain-English fix
• Copy-paste server configurations for nginx, Apache, Express, Django, Cloudflare Workers, and Vercel
• Prioritised by severity — fix what matters first

EXPORT & REPORTING
• Professional PDF report with cover page, executive summary, recommendations, and raw headers
• HTML, JSON, and Markdown (bug bounty) export formats
• Ready for stakeholder presentations or HackerOne/Bugcrowd submissions

ADDITIONAL TOOLS
• Auto-generate a working CSP from observed network traffic
• Infrastructure fingerprinting (CDN, WAF, hosting, framework detection)
• DOM audit (missing SRI, mixed content, unsafe iframes)
• Per-request security grading for all sub-resources

PRIVACY
• Zero external network requests — all analysis runs entirely in your browser
• No data collection, no telemetry, no accounts
• Open-source analysis engine

Built by VaultOcean — https://vaultocean.com