TLS, HTTP headers and cookies

What your server answers to an ordinary request says more about your posture than any written policy.

Buteo opens a connection, observes which protocol versions and ciphers the server accepts, how long the certificate has left and whether the chain is complete, and grades it. Then it reads the response: which security headers are present, which are missing and what each absence actually permits. It inventories the cookies the site sets along with their attributes, which is the RGPD conversation rather than merely a technical one. And it detects source maps published by accident, which hand the original source of an application to anyone who knows where to look.

What Buteo audits

• ✓Protocol versions and accepted ciphers, with a grade
• ✓Certificate chain validity and time remaining
• ✓Security headers present and missing, with the effect of each absence
• ✓Cookie inventory and attributes
• ✓Source maps exposed in production
• ✓Technologies detected from the response already fetched