À cocher avant un déploiement, pendant un debug d'API ou une revue de sécurité
Five minutes before deploy; catches most silly incidents
Not just "no browser warning" — the cert may expire in three days. Check days remaining first.
Ouvrir l'outil →At minimum HSTS, CSP and X-Content-Type-Options; missing ones show up in pentest reports.
Ouvrir l'outil →"Daily at 3" and "every 3 hours" are different expressions; check the next five run times.
Ouvrir l'outil →One-year caching on non-hashed filenames means users never get the new version.
A missing apex A record is the classic "only half the users can open it".
Ouvrir l'outil →Work through these in order — much faster than staring at the code
Decode the payload; exp is a second-level timestamp — compare with now.
Ouvrir l'outil →Backend returns seconds, frontend treats as ms — dates land in 1970 or the far future.
Ouvrir l'outil →Mixing URL-safe (-_) with standard (+/) variants fails silently on decode.
Ouvrir l'outil →Probe the path with JSON Path first, then write it into code.
Ouvrir l'outil →Paste both responses into the structural diff to see exactly which field differs.
Ouvrir l'outil →A raw & = # or space in a query truncates it into a different parameter.
Ouvrir l'outil →Most "low severity" scanner findings live here
HSTS needs includeSubDomains, or subdomains can still be downgraded.
Ouvrir l'outil →Credentialed endpoints reject "*" anyway; for public ones, decide whether anyone should call it.
Ouvrir l'outil →Syntax checks are not enough; validate resolved IPs too, or DNS can point at 127.0.0.1.
Ouvrir l'outil →Missing intermediates often work on desktop (cached) but fail on mobile.
Ouvrir l'outil →Using non-private ranges internally breaks broadly once VPN connects.
Ouvrir l'outil →