About Sloptic
Sloptic grades any web app from outside and looks for slop.
Why does Sloptic exist?
Building a web app got almost free, thanks to AI. And it shows. Apps ship looking finished yet never hardened against the real world. No security headers, inaccessible controls, dead buttons, uncaught errors, and more routinely show up. Such is the case of AI slop, where AI would happily produce the happy path, and... little else.
Yet this is not so much a slop problem as it is the state of the web. 96% of the top million home pages have noticeable accessibility failures, and that number got worse last year. Only about one site in five has a Content Security Policy at all.
It's tempting to call these minor, since none of them are break-ins. Yet you don't need a break-in to frustrate a user. Many apps fail in other ways, such as dead buttons, crashes, and pages that take "forever" to load. In fact, more than half of mobile visitors leave if a page takes more than 3 seconds to load. That is how high user expectations are.
Oh, and concerning the break-ins, according to Veracode, AI produces vulnerable code 45% of the time!
These problems persist year after year. And yet nobody bothers to check because nobody is rewarded for it. Only when a user complains, or a bug is filed, or a breach occurs, does anyone care. Especially when an app ships fast: a demo shows the happy path, and the slop lives everywhere else.
Hence the need for Sloptic.
The name
sloptic /ˈslɒp.tɪk/ noun
From slop, Merriam-Webster's word of the year for 2025, the shoddy digital content AI now produces in bulk, and optic, an instrument for bringing something into focus. The instrument that grades software slop, the app that ships working but unhardened, into one comparable score, serenely indifferent to whatever it was meant to be.
Why not a scanner?
Most tools go deep on one area. For example, Burp Suite and Nuclei are security tools, PageSpeed Insights evaluate performance, and WAVE checks accessibility. Sloptic goes wide and checks all four areas in one pass, including app functionality, and compares the result against other apps.
| most scanners | Sloptic | |
|---|---|---|
| what it covers | one area, in depth | four areas, in one pass |
| what it assumes | what you tell it to look for or what the app is meant to do | nothing about what the app is for |
| what it needs | configuration, templates, or a spec | a URL |
| what it hands back | a list of findings | a score, how to fix each finding, and where to go deeper |
| what it is for | digging into one kind of problem | finding your slop and seeing how you compare |
What it can and cannot judge
Sloptic only judges what is wrong no matter what an app is for. It does not judge the rest, because humans judge those better anyway.
Judged
- Whether a screen reader can operate the controls
- Whether the page loads fast enough on a phone
- Whether the defenses a browser expects are set
- Whether a secret is sitting in the code you ship
- Whether links resolve and errors are handled properly
- Whether what is live is a finished build
Not judged
- Whether the idea is any good
- Whether a feature does what it claims
- Whether the design works for anyone
- How hard the thing was to build
- Whether the code behind it is any good
- Whether the app is worth using at all
Who made it
Sloptic was built and calibrated by Ian Sun. He finished a computer science degree at Boston University in May 2026 and starts a master's in CS there the same year. He holds the PNPT and has been active in the security community, having spoken at SecureWorld, Layer 8 and the NICE Conference, and hosted sessions at RSAC 2026.
It started as an objective scorer for a hackathon league, dealing with the problem of judging a diverse set of web apps identically. But it evolved as its own project as this problem proved harder than anticipated.