slopticweb app slop checkersign in / up

Frequently asked questions

Short answers to common questions.

Why is my score bad when my app is fast?

Some kinds of slop are easy to miss when you build and test an app yourself. Below are the most common ones and how Sloptic checks for each.

For performance, Lighthouse measures how the app would load on a mid range phone (Moto G Power, with a 412 by 823 screen) over slow 4G, i.e. a 150 ms round trip, 1.6 Mbps down, and CPU work taking 4 times as long. Sloptic simulates this on the machine that grades your app. Across the corpus, 62.8% of apps scored below 90, and the median score was 83.

For accessibility, 65.5% of apps had at least one instance of slop, and about 4 in 5 of those had text too faint to read against its background.

Does a low score mean my app is secure?

No. A 0 means Sloptic found nothing. It cannot tell a defended app from an app with nothing to test. A passive grade runs no attack checks at all. Treat the score as a minimum.

Can this score be trusted as is?

It is built to be. A finding counts only with proof from the app itself. Traditional DAST tools can raise false alarms. A person then dismisses the wrong ones, at the cost of a few minutes. Sloptic has no such step. Its score is meant to be taken at face value. Each finding has to stand on its own.

No human reviews a grade. A reviewer would add judgment to the score. Two reviewers could grade the same app differently. Their scores would no longer compare. Comparable scores are the point of Sloptic.

Precision is still audited only in places. How accurate is Sloptic? has the details.

How accurate is Sloptic?

Checks are validated for precision. Classes with precision rules are audited. The rest are not yet. The miss rate is not measured yet. Recall is hard to measure across such varied apps. Sloptic tracks coverage instead: how much of the battery applied to each app. How Sloptic finds slop covers the validation.

Why did only some checks run?

An unverified app gets the 45 passive checks. They read what any visitor sees. The other 61 send test traffic, including real attacks. Running those on someone else's app is unauthorized testing. Verify your app to run them.

Can I grade an app I don't own?

Yes, with the passive checks only. They read what any visitor can see. The other checks need proof of ownership.

Why does my report have no score?

A bot challenge blocked the grade. Sloptic never tries to get past one. A partial grade would flatter the app. The report shows no score instead.

Why can't I see where a leak is?

For leaked secrets, exposed backends and exposed files, the location is enough to exploit it. The report shows it only to the app's verified owner. Owning the report does not prove you own the app. Verify the app to see it.

What does “cleaner than” mean?

It places your app against real hackathon apps graded the same way. A passive grade is placed against 1,702 passive grades. A full grade is placed against 1,579 full grades. These sets are frozen. New grades never move them. What do hackathon apps look like? describes them.

Can I compare this grade to an older one?

Only on the same ruler. Each report names the ruler that scored it. Scores from before Sloptic 3.0 do not compare to current ones. A passive grade and a full grade are different measurements too.

Is Sloptic ASVS compliant?

No. Sloptic is not compliant with or certified against ASVS. Most of its security checks map to an ASVS requirement. Each check tests only the visible part of it. Where the scores come from explains.

How do I stop Sloptic grading my site?

Email abuse@sloptic.org with the site's address. We will block it from being graded again by anyone. No reason is needed. Report an issue covers the other routes.