Kevick / Evidence before launch
Confidence, layer by layer.
4 of 8 layers examined todayThe layer modelEight layers, four examined.
Eight layers, four examined.
One evidence trail.
See what was found.See what could not be checked.4 of 8 layers examined today.
LayersSecurityExamined today
The layer modelEight layers, four examined.
Eight layers, four examined.
One evidence trail.
See what was found.See what could not be checked.4 of 8 layers examined today.
LayersLook at what is actually deployed.
See what was found. See what could not be checked. See the evidence.LayersThe layer model01 / 08
One report. Eight layers, four examined.
01 / SecurityExamined today
Examined today
- What transport, header and certificate problems are visible from outside? Checks for exposed credentials run only once you prove you own the site.
Not checked
- Authentication, sessions and cookies
- Database access, permissions and data isolation
Some checks run only after you prove you own the site, because their results could help someone attack it.Proving ownership says nothing about whether your site is safe.
Illustrative model01 / 08
4 of 8 layers examined today2 of those can come back clean once you prove you own the site; the other 2 can report problems but never a clean result.
Examined means a detector ran and reported what it found, not that the layer was cleared.
The method
Follow the evidence.
Five steps. A traceable decision.- 01
Probe
Observe the deployed page. - 02
Detect
Run checks against the evidence. - 03
Map
Connect findings to layers. - 04
Disclose
State what was examined, and how sure Kevick is. - 05
Verdict
Explain the next action.
Look closer
Every finding has a trail.
Observed evidence.A clear scope.A useful next step.
An illustrative finding
- Problem
Content-Security-Policy header is missing
- Impact
- A content security policy limits where scripts may load from. Without one, a single injected script — from a compromised dependency or user-supplied content — can run with full access to your page and your users' sessions.
- Evidence
- content-security-policy not present on the response
- Next action
- Send a `Content-Security-Policy` header, starting with `Content-Security-Policy-Report-Only` so you can see what would break before enforcing it. Begin with `default-src 'self'` and widen it deliberately for the origins you actually use. Set it wherever your responses get their headers — your framework's header configuration, your web server, or your CDN or host's header rules.
- Uncertainty
- Confidence 90/100Exploitability unproven.Whole-application coverage unconfirmed.
Useful distinctions