01-express · 30–45 min · 6 min
Website security audit: Express mode, a first signal.
Before a demo or a quote, you want obvious holes, not a certificate. Express walks one public origin in 30–45 min, writes what it saw, and marks the rest Untested.
- When to open it
- One public origin, no test account
- Triage before a demo, or to bound a quote
- You accept low coverage, written in the report
- Agents
- 00, 01, 02, 03, 07, 10, 11
- Outside this mode
- No deep auth, no tenant isolation, no API beyond pages seen
- No supply chain, no MCP audit — Untested if an agent surface appears
- Cap: 80 HTML URLs per origin
What it is for
Express is triage. It answers: is there an obvious hole in what a stranger sees? Missing CSP, talkative Server header, source map, secret in a bundle. It does not answer: can tenant A read tenant B’s invoices?
What the squad does
The orchestrator opens the project. Surface maps the origin. A short threat model. On-page audit observes, no payload. If an in-scope bundle exists, the secrets agent reads the JS. Short QA requires evidence for every Confirmed. The report ships only if QA signs.
What not to use it for
- Multi-tenant SaaS → Full SaaS mode.
- MCP server or tools → Agents / MCP mode.
- A board report → a Full audit first, then mode 8.
- “Go further” with a trial POST → refused. Observation only.
Launch phrase
Express on https://example.com, no account, no authenticated API.
Before you launch
- Does this replace a web pentest?
- No. First signal only. Full Web (one day) adds session, API, supply chain.
- With no test account, what do we see?
- What a stranger sees. Everything else is Untested — written, not invented.
The kit, not the guide.
Open source, MIT. Clone it, open it in Claude, Codex, Cursor or Hermes. A held report — or QA’s silence.