About Sloptic
Sloptic points at a running web app, checks it from the outside, and turns what it finds into one number you can compare against other apps. It never reads your code.
Why it exists
Building a web app got almost free, and it shows. Apps ship that look finished but were never hardened: no security headers, controls a screen reader cannot touch, a development build left running in production.
This is not a hackathon problem; it is the state of the web. 95.9% of the top million home pages have detectable accessibility failures, and that number got worse last year rather than better. The same six mistakes have led that list for seven years running. Only about one site in five sends a Content Security Policy at all.
It is tempting to file all this under minor, since none of it is a break-in. But that has it backwards. An exploit is a risk that may never be triggered, but a control a screen reader cannot see, or a page that takes five seconds to load on a phone, is not a risk at all. It is something that happens to every visitor, every time, and affects everyone. For example, more than half of mobile visitors leave before a slow page finishes loading.
These failures are known, named, and the same year after year. They go undone at scale because nobody is checking, which is a job worth handing to a machine.
The name
sloptic /ˈslɒp.tɪk/ noun
From slop, Merriam-Webster's word of the year for 2025, the low-quality digital content that AI now produces in bulk, and optic, an instrument for bringing something into focus. The instrument that resolves software slop, the app that ships working but unhardened, into a single comparable number, serenely indifferent to whatever it was meant to be.
What makes it different
A scanner exists to find you a list of things to fix. Sloptic exists to produce a number, so that apps with nothing in common can be put on one scale and ranked against each other. Much the same probing, opposite purpose.
| most scanners | Sloptic | |
|---|---|---|
| what it reads | source, repositories, pull requests | the running app, from the outside |
| what it needs | access to the code, and setup | a URL |
| what it hands back | a list of findings | one score, on a fixed scale |
| what it is for | fixing one app | comparing and ranking many |
What it can and cannot judge
Sloptic only judges things that are wrong no matter what an app is for. Before any check is added, we must ask: is there a legitimate app for which this behavior is actually correct? If yes, the check does not belong. And humans are better for judging that kind of correctness anyway.
It can judge
- Whether a screen reader can operate the controls
- Whether the page loads fast enough on a phone
- Whether the defenses a browser expects are set
- Whether a secret is sitting in the code you ship
- Whether links resolve and pages fail honestly
- Whether what is live is a finished build
It cannot judge
- Whether the idea is any good
- Whether a feature does what it claims
- Whether the design works for anyone
- How hard the thing was to build
- Whether the code behind it is any good
- Whether the app is worth using at all
How it is kept honest
A problem is only reported when the app produces something that only that problem could produce. Sloptic will not flag something because it looks suspicious.
When a check cannot run, it says so and says why, rather than quietly passing. A clean result that was never actually tested is a missed problem wearing a pass, and that is the failure worth caring about most.
A score of 0 means nothing was found. It does not mean nothing is there. Sloptic reports what it saw and refuses to turn that into a promise it cannot keep.
The checks are tested against apps that are deliberately broken and apps that are deliberately clean, so a check that cannot tell the difference does not ship.
Sloptic respects the defenses a site puts up. Working around bot protection or hiding what it is doing is out of scope, permanently.
Who made it
Sloptic was built and calibrated by Ian Sun. He finished a computer science degree at Boston University in May 2026 and starts a cybersecurity master's there this fall. He holds the PNPT, has spoken at SecureWorld, Layer 8 and the NICE Conference, and hosted sessions at RSAC 2026.
Sloptic started as the objective scoring axis for a hackathon league, built for one stubborn problem: a human judge cannot hold a hundred different stacks in their head and rank them fairly. It became its own project once the grading problem turned out to be harder than the league needed, and is open source under Apache 2.0.
This is a single author project, and one person can fool themselves. So correctness is not checked only against the reference apps in the repo, which the same person wrote. It is also checked against targets whose answers nobody here controls: GapBench, a third-party recall benchmark, and the deliberately broken apps the industry already uses for this, DVWA, Juice Shop, VAmPI and bWAPP.
The recall audit across the full catalog, measuring what Sloptic misses rather than what it gets wrong, is still running. Until it finishes, no recall number is claimed. Saying so is less satisfying than a figure, and more honest than one that has not been earned.