About Sloptic
Sloptic grades any web app from outside and looks for slop.
Why does Sloptic exist?
Building a web app got almost free, thanks to AI. And it shows. Apps ship looking finished yet never hardened against the real world. No security headers, inaccessible controls, dead buttons, uncaught errors, and more routinely show up. Such is the case of AI slop, where AI would happily produce the happy path, and... little else.
Yet this is not so much a slop problem as it is the state of the web. 96% of the top million home pages have noticeable accessibility failures, and that number got worse last year. Only about one site in five has a Content Security Policy at all.
It's tempting to call these minor, since none of them are break-ins. Yet you don't need a break-in to frustrate a user. Many apps fail in such frustrating ways, such as dead buttons, crashes, and pages that take "forever" to load. In fact, more than half of mobile visitors leave if a page takes more than 3 seconds to load. That is how high user expectations are.
Oh, and concerning the break-ins, according to Veracode, AI produces vulnerable code 45% of the time, which is alarmingly high!
These problems persist year after year. And yet nobody bothers to check because nobody is rewarded for it. Only when a user complains, or a bug is filed, or a breach occurs, does anyone care. Especially in hackathons, where the demo is what's judged, not where most of the slop lives.
Hence the need for Sloptic.
The name
sloptic /ˈslɒp.tɪk/ noun
From slop, Merriam-Webster's word of the year for 2025, the shoddy digital content AI now produces in bulk, and optic, an instrument for bringing something into focus. The instrument that grades software slop, the app that ships working but unhardened, into one comparable score, serenely indifferent to whatever it was meant to be.
Why not a scanner?
A scanner, like Burp Suite, Nuclei, Nikto, or even PageSpeed Insights, exists to hand you a list of findings to fix on one app. Sloptic exists to grade and rank, so apps with nothing in common can be compared.
| most scanners | Sloptic | |
|---|---|---|
| what it assumes | what you tell it to look for or what the app is meant to do | nothing about what the app is for |
| what it needs | configuration, templates, or a spec | a URL |
| what it hands back | a list of findings | a score |
| what it is for | fixing one app | comparing and ranking many |
What it can and cannot judge
Sloptic only judges what is wrong no matter what an app is for. It does not judge the rest, because humans judge those better anyway.
It can judge
- Whether a screen reader can operate the controls
- Whether the page loads fast enough on a phone
- Whether the defenses a browser expects are set
- Whether a secret is sitting in the code you ship
- Whether links resolve and errors are handled properly
- Whether what is live is a finished build
It cannot judge
- Whether the idea is any good
- Whether a feature does what it claims
- Whether the design works for anyone
- How hard the thing was to build
- Whether the code behind it is any good
- Whether the app is worth using at all
Who made it
Sloptic was built and calibrated by Ian Sun. He finished a computer science degree at Boston University in May 2026 and starts a master's in CS there the same year. He holds the PNPT and has been active in the security community, having spoken at SecureWorld, Layer 8 and the NICE Conference, and hosted sessions at RSAC 2026.
It started as an objective scorer for a hackathon league, dealing with the problem of judging a diverse set of web apps identically. But it evolved as its own project as this problem proved harder than anticipated.