DEV Community

Cover image for I built a free tool that runs 614 passive security checks on any website
TN
TN

Posted on

I built a free tool that runs 614 passive security checks on any website

#webdev #ai #opensource

I built a free tool that runs 614 passive security checks on any website

tl;dr: pip install tblue → tblue -u https://yoursite.com → instant security grade. No account, no API key, nothing sent anywhere.

What it does

Tblue runs 614 passive security checks on any website from your terminal:

  • Security headers (CSP, HSTS, CORS, X-Frame-Options, 30+ more)
  • Cookies (HttpOnly, Secure, SameSite for every cookie)
  • Email security (SPF, DKIM, DMARC)
  • Secrets in JS bundles, exposed config files, source maps
  • Subdomain takeover, DNS misconfigs, typosquatting detection
  • Compliance mapping: PCI-DSS, HIPAA, SOC 2, NIST CSF

Passive only — reads what your site sends back, never modifies anything.

Install & run 

pip install tblue
tblue -u https://yoursite.com
Enter fullscreen mode Exit fullscreen mode

Outputs a letter grade (A+ to F), a score (0–100), and remediation steps for every finding. Generates a shareable HTML report.

GitHub: github.com/taylannuhogluofficial-png/Tblue

Would love to hear what you scan first. Happy to answer questions in the comments.

Top comments (0)