Tick through them before shipping, while debugging an API, or in a security review
Five minutes before deploy; catches most silly incidents
Not just "no browser warning" — the cert may expire in three days. Check days remaining first.
Open tool →At minimum HSTS, CSP and X-Content-Type-Options; missing ones show up in pentest reports.
Open tool →"Daily at 3" and "every 3 hours" are different expressions; check the next five run times.
Open tool →One-year caching on non-hashed filenames means users never get the new version.
A missing apex A record is the classic "only half the users can open it".
Open tool →Work through these in order — much faster than staring at the code
Decode the payload; exp is a second-level timestamp — compare with now.
Open tool →Backend returns seconds, frontend treats as ms — dates land in 1970 or the far future.
Open tool →Mixing URL-safe (-_) with standard (+/) variants fails silently on decode.
Open tool →Probe the path with JSON Path first, then write it into code.
Open tool →Paste both responses into the structural diff to see exactly which field differs.
Open tool →A raw & = # or space in a query truncates it into a different parameter.
Open tool →Most "low severity" scanner findings live here
HSTS needs includeSubDomains, or subdomains can still be downgraded.
Open tool →Credentialed endpoints reject "*" anyway; for public ones, decide whether anyone should call it.
Open tool →Syntax checks are not enough; validate resolved IPs too, or DNS can point at 127.0.0.1.
Open tool →Missing intermediates often work on desktop (cached) but fail on mobile.
Open tool →Using non-private ranges internally breaks broadly once VPN connects.
Open tool →