# Web Security Inspector v2.0 (sec.dai.ninja) — English Edition

> 100% passive, non-intrusive 50-point Web Security & Hygiene diagnostic suite. Evaluates HTTP security headers (Mozilla Observatory + Google CSP Evaluator bypass gadgets), TLS 1.0–1.3 protocol matrix (SSL Labs baseline), runtime/.git/.env exposure, WordPress/CMS hygiene, JS bundle secret leaks & SHA-384 SRI, SPF/DMARC/DKIM/MTA-STS/DNSSEC, and third-party privacy trackers from a single URL ($0, zero public leaderboard).

- Canonical Web App (English): https://sec.dai.ninja/en/
- Canonical Web App (Japanese): https://sec.dai.ninja/
- Sister Platform (AI Search & Agent Readiness): https://aio.dai.ninja/en/
- Architect & Maintainer: Dai Miyawaki — https://dai.ninja/ | https://x.com/miyawakidai

## Core Capabilities & API Endpoints
1. **100% Non-Intrusive Passive Telemetry**: Standard HTTP GET/HEAD, TLS handshake inspection, DNS/DoH queries, and keyless OSV.dev advisory matching — zero attack payloads.
2. **4 Parallel Benchmarks + 4 Compliance Frameworks**: Overall Score (S–D), HTTP Observatory Grade, SSL/TLS Grade, and Email/DNS Grade mapped to OWASP/IPA, Enterprise & E-Commerce Governance, PCI-DSS v4.0, and Tracker Privacy Transparency.
3. **Zero Public Exposure**: Audited domains are never listed on any public leaderboard; history stays strictly in browser `localStorage`.
4. **Built-In Remediation Suite**: Auto-tailored configs for 8 stacks (Apache, Nginx, Cloudflare, php.ini, WordPress, Firebase Hosting, Next.js, DNS/security.txt), SHA-384 SRI generator, SPF/DMARC wizard, and stateless SVG badge (`/api/sec/badge`).
5. **REST Scan Endpoint**: `POST https://sec.dai.ninja/api/sec/scan` with `{"url": "https://example.com", "lang": "en"}`.