Sloptic's checks
Sloptic runs 106 checks across 61 kinds of slop. Each check is a file in this GitHub repository..
How many?
45 of the 106 run on any app; the other 61 send test traffic and require ownership verification.
| area | kinds | runs on any app | needs ownership proof | total |
|---|---|---|---|---|
| security | 30 | 17 | 46 | 63 |
| quality | 17 | 13 | 14 | 27 |
| accessibility | 2 | 3 | 0 | 3 |
| performance | 12 | 12 | 1 | 13 |
| all | 61 | 45 | 61 | 106 |
Scoring
Each check has a price. Checks can have fixed prices or vary depending on thresholds reached or frequency. How does Sloptic finds slop?
security
30 kinds of slop across 63 checks. Open to learn more: Most name the ASVS requirement they test.
access control 730 to 90
- Protected route open without loginverified90
- Rows readable by other signed-in usersverified30 to 85
- Other users' records readable by IDverified30 to 85
- Other accounts' objects readable through the APIverified30 to 85
- Other users' profiles readableverified30 to 85
- Other users' backend rows readableverified30 to 85
- Other users' objects in private listsverified30 to 85
Thresholds that raise the price:
- 55
- reads another user's record
- 68
- record holds personal or secret data
- 78
- reaches many users' records
- 85
- changes another user's record
exposed files 74 to 98
.envfile servedverified90.git/configservedverified55- Same flaw as sec-exposure-003. Only the highest counts.
.git/HEADservedverified55- Same flaw as sec-exposure-002. Only the highest counts.
- Deploy files served (state files, dumps, keys)verified90
- Source maps servedany URL15
- Credential files servedverified70 to 98
- 92
- the credential works
- 98
- server key, database login or private key
- Internal addresses in the bundleany URL4
security headers 72 to 8
- Toothless CSPany URL5
- Rises to 24 in a grade with cross-site scripting or scripting in the browser.
- No
nosniffheaderany URL3 - No CSPany URL8
- Rises to 24 in a grade with cross-site scripting or scripting in the browser.
- No HSTSany URL5
- No clickjacking protectionany URL5
- ASVS asks for CSP frame-ancestors. This check also accepts X-Frame-Options.
- No referrer policyany URL2
- Server version advertisedany URL2
session handling 512 to 28
- Session cookie without
HttpOnlyverified15- Rises to 28 in a grade with cross-site scripting or scripting in the browser.
- Session cookie without
SameSiteverified12 - Session cookie without
Secureverified12 - Session token in
localStorageverified15- Rises to 28 in a grade with cross-site scripting or scripting in the browser.
- ASVS allows session tokens in browser storage. OWASP's HTML5 cheat sheet does not.
- Session token in the URLverified28
sql injection 590 to 98
- Login bypass with
' OR '1'='1' --verified90 to 98- Same flaw as sec-sqli-002, sec-sqli-003 and sec-sqli-005. Only the highest counts.
- Login bypass with
' OR 1=1 --verified90 to 98- Same flaw as sec-sqli-001, sec-sqli-003 and sec-sqli-005. Only the highest counts.
- Login bypass with
' OR 'a'='a' --verified90 to 98- Same flaw as sec-sqli-001, sec-sqli-002 and sec-sqli-005. Only the highest counts.
- SQL injection in an API parameterverified90 to 98
- Login bypass with
' OR '1'='1verified90 to 98- Same flaw as sec-sqli-001, sec-sqli-002 and sec-sqli-003. Only the highest counts.
Thresholds that raise the price:
- 95
- rows pulled out
- 98
- data changed
managed backend rules 312 to 98
- Database open to anonymous visitorsverified70 to 98
- Same flaw as sec-backend-003. Only the highest counts.
- Database schema exposedverified12
- Same flaw as sec-backend-001. Only the highest counts.
- Storage bucket listable by anyoneverified70 to 98
Thresholds that raise the price:
- 80
- personal, financial or credential data
- 90
- records readable in bulk
- 98
- anyone can write to it
secrets in the code 370 to 98
- Keys or tokens in shipped codeany URL70 to 98
- Same flaw as sec-secrets-002 and sec-secrets-003. Only the highest counts.
- Server secrets in the bundleany URL70 to 98
- Same flaw as sec-secrets-001 and sec-secrets-003. Only the highest counts.
- Live Gemini key in the bundleverified70 to 98
- Same flaw as sec-secrets-001 and sec-secrets-002. Only the highest counts.
Thresholds that raise the price:
- 92
- the key works
- 98
- server key, database login or private key
cross-site scripting 240 to 85
- Reflected cross-site scriptingverified40 to 85
- Stored cross-site scriptingverified40 to 85
Thresholds that raise the price:
- 61
- the script runs
- 85
- stored for all visitors
exposed data 270 to 98
- Credentials in responsesany URL70 to 98
- 92
- the credential works
- 98
- server key, database login or private key
- Bulk records without loginverified70 to 98
- 80
- personal, financial or credential data
- 90
- records readable in bulk
- 98
- anyone can write data
file uploads 240 to 98
- Uploads that run on the serververified90 to 98
- 98
- the upload runs
- Uploads served as live pagesverified40 to 85
- 61
- the upload runs
- 85
- stored for every visitor
command injection 190 to 98
- Command injectionverified90 to 98
- 98
- the command runs
cross-origin sharing rules 145
- Credentialed CORS for any originany URL45
cross-site request forgery 145
- No CSRF protectionverified45
debug mode left on 140 to 98
- Debug mode in productionverified40 to 98
- 98
- the debugger runs code
filter injection 175
- Filter injectionverified75
host header handling 140
- Host header injectionverified40
known-vulnerable dependencies 1measured
- Libraries with known vulnerabilitiesany URLmeasured
- The worst CVE's CVSS score * 10.
- ASVS sets the update deadline in the app's own docs. Sloptic checks for a known CVE.
login rate limiting 130
- No login rate limitverified30
- ASVS leaves the limit to the app's own docs. Sloptic checks for any throttling.
mixed content 110
- Mixed contentany URL10
open redirects 125 to 55
- Open redirectverified25 to 55
- 40
- to an outside site
- 55
- inside the login flow
oversized request handling 115
- Unbounded decompression (zip bomb)verified15
path traversal 150 to 85
- Path traversalverified50 to 85
- 75
- a system file read
- 85
- source or secrets read
response splitting 145
- Response splittingverified45
scripting in the browser 140 to 85
- DOM-based cross-site scriptingverified40 to 85
- 61
- the script runs
- 85
- stored for every visitor
server-side request forgery 140 to 91
- Server-side request forgeryverified40 to 91
- 70
- the server makes the request
- 91
- cloud metadata or secrets reached
session lifetime 145
- Guessable session IDsverified45
subresource integrity 110
- CDN files without integrity hashesany URL10
template injection 190 to 98
- Template injectionverified90 to 98
- 98
- the payload runs
transport security 130
- No HTTPSany URL30
xml external entities 170 to 91
- XML external entitiesverified70 to 91
- 82
- the server makes an outside request
- 91
- a system file read
quality
17 kinds of slop across 27 checks. Open to learn more:
honest navigation 525 to 45
- Missing script bundleany URL45
- Broken deep linksany URL28
- Silent failed savesverified35
- Stale view after a createverified38
availability 30 to 85
- Backend address set to localhostany URL0 to 85
- 85
- visitors' browsers call it
- Free until proven.
- Endless redirect loopany URL50 to 80
- 80
- the homepage itself loops
- Sign-in redirect to localhostany URL55
data integrity 269
- Saved values changed on the way backverified69
- Same flaw as qa-integrity-002. Only the highest counts.
- Created items never savedverified69
- Same flaw as qa-integrity-001. Only the highest counts.
email verification 25 to 72
- Late or missing signup emailverified5 to 72
- 24
- over 30 seconds late
- 36
- user let in but email never arrives
- 72
- no email within a minute
- Dead confirmation linkverified72
input validation 230 to 72
- Browser-only validationverified30
- Broken international textverified32 to 72
- 72
- the server crashes
race conditions 250
- Duplicate IDs from simultaneous createsverified50
- Same flaw as qa-race-002. Only the highest counts.
- Duplicate IDs from simultaneous API createsverified50
- Same flaw as qa-race-001. Only the highest counts.
broken links 1measured
- Dead internal linksany URLmeasured
- 24 to 48, by the share of dead links.
console errors 118 to 40
- Errors thrown on loadany URL18 to 40
- 40
- an error screen shows
content types 118
- Wrong
Content-Typeany URL18
crash resistance 155
- Crash on malformed inputverified55
dead controls 130 to 50
- Buttons that do nothingverified30 to 50
- 50
- the page's main action
development build left online 128
- Development build in productionany URL28
error handling 125 to 35
- Leaked stack traces or database errorsverified25 to 35
- 35
- database details leaked
http conformance 110
- Missing charsetany URL10
leftover template text 112
- Placeholder text on linked pagesany URL12
pages that fail quietly 1off-score
- Soft 404sany URLoff-score
- Shown on the report. Adds nothing to the score.
password reset 124 to 60
- Broken password resetverified24 to 60
- 60
- no reset email within a minute
accessibility
2 kinds of slop across 3 checks. Open to learn more:
accessibility 2measured
- Accessibility barriers on the rendered pageany URLmeasured
- Each barrier costs its impact: critical 20, serious 12, moderate 7, minor 3. Low contrast costs its shortfall. Each extra barrier counts 60% of the one before.
- Same flaw as qa-a11y-002. Only the highest counts.
- Accessibility basics missing from the markupany URLmeasured
- The same prices read from the markup.
- Same flaw as qa-a11y-001. Only the highest counts.
mobile viewport and description 110
- No
viewportordescriptionmeta tagany URL10
performance
12 kinds of slop across 13 checks. Open to learn more:
core web vitals 2off-score
- Slow first contentful paintany URLoff-score
- Shown on the report. Adds nothing to the score.
- Failing Core Web Vitalsany URLoff-score
- Shown on the report. Adds nothing to the score.
behavior under load 150 to 60
- Server errors under a burst of trafficverified50 to 60
- 60
- server errors under load
caching 1off-score
- Static files not cacheableany URLoff-score
- Shown on the report. Adds nothing to the score.
DOM size 1off-score
- Oversized DOMany URLoff-score
- Shown on the report. Adds nothing to the score.
font loading 1off-score
- Invisible text during font loadany URLoff-score
- Shown on the report. Adds nothing to the score.
largest contentful paint 1off-score
- Largest image found lateany URLoff-score
- Shown on the report. Adds nothing to the score.
load time 1off-score
- Slow Speed Indexany URLoff-score
- Shown on the report. Adds nothing to the score.
minification 1off-score
- Unminified JavaScript or CSSany URLoff-score
- Shown on the report. Adds nothing to the score.
overall Lighthouse score 1measured
- Lighthouse score below 90any URLmeasured
- 1 point per Lighthouse point below 90. For example, a score of 84 on Lighthouse nets 6 slop points.
page weight 1off-score
- Heavy pageany URLoff-score
- Shown on the report. Adds nothing to the score.
request count 1off-score
- Too many requestsany URLoff-score
- Shown on the report. Adds nothing to the score.
server response speed 1off-score
- Slow server responseany URLoff-score
- Shown on the report. Adds nothing to the score.