slopticgrades any live web app

About Sloptic

Sloptic points at a running web app, checks it from the outside, and turns what it finds into one number you can compare against other apps. It never reads your code.

Why it exists

Building a web app got almost free, and it shows. Apps ship that look finished but were never hardened: no security headers, controls a screen reader cannot touch, a development build left running in production.

This is not a hackathon problem; it is the state of the web. 95.9% of the top million home pages have detectable accessibility failures, and that number got worse last year rather than better. The same six mistakes have led that list for seven years running. Only about one site in five sends a Content Security Policy at all.

It is tempting to file all this under minor, since none of it is a break-in. But that has it backwards. An exploit is a risk that may never be triggered, but a control a screen reader cannot see, or a page that takes five seconds to load on a phone, is not a risk at all. It is something that happens to every visitor, every time, and affects everyone. For example, more than half of mobile visitors leave before a slow page finishes loading.

These failures are known, named, and the same year after year. They go undone at scale because nobody is checking, which is a job worth handing to a machine.

The name

sloptic /ˈslɒp.tɪk/ noun

From slop, Merriam-Webster's word of the year for 2025, the low-quality digital content that AI now produces in bulk, and optic, an instrument for bringing something into focus. The instrument that resolves software slop, the app that ships working but unhardened, into a single comparable number, serenely indifferent to whatever it was meant to be.

What makes it different

A scanner exists to find you a list of things to fix. Sloptic exists to produce a number, so that apps with nothing in common can be put on one scale and ranked against each other. Much the same probing, opposite purpose.

most scannersSloptic
what it readssource, repositories, pull requeststhe running app, from the outside
what it needsaccess to the code, and setupa URL
what it hands backa list of findingsone score, on a fixed scale
what it is forfixing one appcomparing and ranking many

What it can and cannot judge

Sloptic only judges things that are wrong no matter what an app is for. Before any check is added, we must ask: is there a legitimate app for which this behavior is actually correct? If yes, the check does not belong. And humans are better for judging that kind of correctness anyway.

It can judge

  • Whether a screen reader can operate the controls
  • Whether the page loads fast enough on a phone
  • Whether the defenses a browser expects are set
  • Whether a secret is sitting in the code you ship
  • Whether links resolve and pages fail honestly
  • Whether what is live is a finished build

It cannot judge

  • Whether the idea is any good
  • Whether a feature does what it claims
  • Whether the design works for anyone
  • How hard the thing was to build
  • Whether the code behind it is any good
  • Whether the app is worth using at all

How it is kept honest

Findings need proof

A problem is only reported when the app produces something that only that problem could produce. Sloptic will not flag something because it looks suspicious.

It admits what it could not test

When a check cannot run, it says so and says why, rather than quietly passing. A clean result that was never actually tested is a missed problem wearing a pass, and that is the failure worth caring about most.

It never claims you are safe

A score of 0 means nothing was found. It does not mean nothing is there. Sloptic reports what it saw and refuses to turn that into a promise it cannot keep.

It is checked against known answers

The checks are tested against apps that are deliberately broken and apps that are deliberately clean, so a check that cannot tell the difference does not ship.

It plays fair

Sloptic respects the defenses a site puts up. Working around bot protection or hiding what it is doing is out of scope, permanently.

Who made it

Sloptic was built and calibrated by Ian Sun. He finished a computer science degree at Boston University in May 2026 and starts a cybersecurity master's there this fall. He holds the PNPT, has spoken at SecureWorld, Layer 8 and the NICE Conference, and hosted sessions at RSAC 2026.

Sloptic started as the objective scoring axis for a hackathon league, built for one stubborn problem: a human judge cannot hold a hundred different stacks in their head and rank them fairly. It became its own project once the grading problem turned out to be harder than the league needed, and is open source under Apache 2.0.

This is a single author project, and one person can fool themselves. So correctness is not checked only against the reference apps in the repo, which the same person wrote. It is also checked against targets whose answers nobody here controls: GapBench, a third-party recall benchmark, and the deliberately broken apps the industry already uses for this, DVWA, Juice Shop, VAmPI and bWAPP.

The recall audit across the full catalog, measuring what Sloptic misses rather than what it gets wrong, is still running. Until it finishes, no recall number is claimed. Saying so is less satisfying than a figure, and more honest than one that has not been earned.