Trust by design
What the tools check—and what they deliberately do not claim.
Noustiq free tools are diagnostics. We publish the scoring logic, separate observation from inference, and state the limits that matter before you make a business or security decision.
Public website scans
Public scanners make user-initiated GET requests to the submitted HTTP/HTTPS page, follow only same-host/www redirects, refuse private/internal IP space and non-standard ports, cap response size and time, and do not authenticate, submit forms, execute JavaScript, brute-force directories, exploit vulnerabilities or attempt credential attacks.
Submitted URLs are processed transiently for the result and are not stored as scan history. Rate limiting uses a pseudonymous one-way identifier rather than storing raw IP addresses in the tool data directory.
Website security baseline
The free security audit checks public-response controls such as HTTPS, HSTS, Content-Security-Policy, clickjacking protection, MIME-sniffing protection, Referrer-Policy, Permissions-Policy, cross-origin policy headers, cookie flags, obvious mixed content, form transport, CORS response policy and unnecessary technology-version disclosure.
It does not test authorization/IDOR/BOLA, tenant isolation, injection, database RLS, webhook signatures, business logic, authenticated workflows, source-code dependencies, private cloud IAM or secrets that are not present in the public response. A high score therefore does not certify an application as secure.
Client exposure scan
The exposure scan reads the page you submitted and the JavaScript files that page already links to on the same host. It looks for credential formats that should never be delivered to a browser: provider secret keys, cloud access keys, private key blocks, database connection strings containing passwords, and Supabase service_role tokens.
Two rules govern it. We only read what the site already hands to every visitor. No path is guessed, no directory is enumerated, no login is attempted, and no file is requested that the page did not link to. We never use a discovered credential. Where a finding is provable, it is proved offline — a Supabase token states its own privilege level inside the token, so we decode that locally. Sending a discovered key to a live service to confirm it works would be an attack, and we do not do it, even against a site whose owner authorised the scan.
Findings are redacted before display: you see a short prefix, the length, and a truncated SHA-256 fingerprint you can use to locate the value in your own source. A full working credential is never rendered into the report, because reports get pasted into chat threads and tickets.
Some matches are deliberately reported as questions rather than failures. A Google browser API key and a Firebase client configuration are meant to be public; whether they are safe depends on restriction settings and database rules that cannot be observed from outside. Calling those a breach would be false confidence, which is the failure mode this product exists to argue against.
Limits: one page and its same-origin scripts, up to a fixed file count and size budget. Server-side code, other routes, authenticated pages and your repository are not examined.
AI-app self-audit
The checklist is completed in the visitor's browser. Noustiq does not receive the answers. The score is a weighted readiness indicator based on whether the visitor says controls have been verified. It is not an automated code scan or penetration test.
Standards we use as reference points
Security content is designed around broadly accepted application-security guidance including the OWASP Top 10 and OWASP secure-coding guidance. Browser-header recommendations are based on current browser/platform security behavior rather than rewarding obsolete headers for the sake of a higher score.
Evidence language
Across the tools, reports and research on this site, four labels are used consistently and mean specific things.
- Observed — directly supported by something we read. The evidence is shown.
- Inferred — a reasonable interpretation of what was observed, which could be wrong.
- Unknown — not enough evidence to say either way. We say so rather than filling the gap.
- Ask — a question worth putting to the owner, because the answer lives somewhere we cannot see.
The distinction is the point. A tool that presents inference as fact is more dangerous than one that finds nothing, because it gets acted on.
How we measure this website
Noustiq measures its own traffic with a first-party system: no third-party analytics vendor, no advertising pixel, no cookie, and no cross-site identifier. Approximate unique visitors are derived from a one-way keyed hash; raw IP addresses and full user-agent strings are never written to analytics storage, and event data is deleted after 90 days.
We count visitors in stages — arrived, engaged, qualified, intent, booking intent — and a click through to our booking calendar is recorded as booking intent, never as a booking. We do not know whether a call was booked unless the booking provider confirms it, so that number is not displayed anywhere.
Commercial relationship
The tools are free and may identify issues that Noustiq services can help implement or remediate. That commercial relationship does not change the scoring logic. A finding should be fixed because it is verified and material—not because Noustiq sells a service.