slopticweb app slop checkersign in / up

How much slop is in your app?

Paste a link and Sloptic will score the slop in your app. Less is better.

Built with Lovable, Bolt or Cursor? See what AI-built apps miss.
Running a hackathon? Rank a whole event.

What is Sloptic?

Sloptic is a web app grader. It checks how much "slop" your web app has in terms of security, quality, accessibility and performance, and it penalizes things that no app should ever have.

Sloptic can be used by solo app builders to do a quick check of their app's reliability, and by hackathon organizers to rank apps on it.

Learn more about how Sloptic grades here.

  1. 01

    Paste a link to your app. No setup needed.

  2. 02

    Sloptic examines your app and checks for problems no app should have.

  3. 03

    You get a report card consisting of your score, your standings, the issues Sloptic found, and how to remediate them (with an AI prompt you can copy/paste).

What it checks

every check

Open an area to see what kinds of slop Sloptic checks for.

Insecure apps are a goldmine for attackers to steal your users' data or your own. To ensure security, Sloptic checks for missing defenses, bad access control, secrets leakage, and more, adhering to the OWASP Top 10 and ASVS.

See all 30 in this area.

Note that in anonymous mode, we only run the passive checks, i.e. checks that do not alter the site or send attacks. To run the active ones, log in and prove the site is yours.

What you get back

sample
https://your-app.vercel.apppassive mode
48.5slop score
cleaner than 36%of passively graded apps
security3/16/17
quality1/13/13
accessibility1/3/3Checked the way a low vision or screen reader user meets your app, not the way it looks to you. Why?
performance1/11/12Measured as a mid range phone on slow 4G, not your laptop. Why?

failed passed did not applyfailed / applied / available. 43 of 45 applied.

no content security policyNothing tells the browser which scripts may run, so an injected one would.+8
How to fix it

Send a Content-Security-Policy header that lists where your scripts, styles and frames may load from. Most hosts set headers in a config file, such as vercel.json.

Go deeper: HTTP Observatory checks an app's headers in detail.

For Cursor, Lovable, Bolt, or any AI assistant.
no x-content-type-optionsA browser may guess a file's type, and guess it into something executable.+1.8
no referrer-policyEvery outbound click can leak the page it came from, query string included.+0.7
http conformanceA response says one thing in its status line and another in its body.+10
accessibility violationsSome text is too faint to read and some controls have no name a screen reader can say.+20
largest contentful paintThe biggest thing on screen arrives late, so the page looks empty for a while.+8
strict transport securityThe app tells browsers to reach it over https and nothing else.0
no broken linksEvery link the page offers leads somewhere that answers.0

sloptic /ˈslɒp.tɪk/ noun

A coinage from slop, Merriam-Webster's word of the year for 2025 for the throwaway output that generative AI now produces in bulk, and optic, an instrument for bringing something into focus. The apparatus by which slop of the software kind, the app that ships functional but unhardened, is resolved into a single comparable score, serenely indifferent to whatever it was meant to be.