advisories Are shipped packages clear of every flaw the advisory feeds list? | green | 2026-10-27 09:05 UTC | 2.0 s | 0 | 6 numbers- known advisories across them14
- days since the exploited-flaw list was releasedAge of the copy of CISA's known-exploited list the drill used.0
- packages with a flaw known to be exploitedListed in CISA's catalogue of flaws attackers are known to use.0
- packages checked for known advisories232
- build-tool packages with a known advisory5
- shipped packages with a known advisoryPackages that ship in the app, as opposed to build tools. Not listed in a feed does not mean safe.0
|
anonymous-access Is private data closed to a stranger with only the public key? | green | 2026-10-27 09:05 UTC | 2.9 s | 0 | 3 numbers- private rows a stranger can readRows in private tables the drill could read with only the public key every browser gets.restricted
- tables a stranger can read1
- tables a stranger can write toTables the drill could write to with only that public key.0
|
armour Is Noxkeep's own CI hardened: pinned images, locked installs, no key files? | green | 2026-10-27 09:05 UTC | 0.1 s | 0 | 6 numbers- container images checked11
- installs checked43
- files shaped like a cloud keyA cloud service-account key in the repo would let anyone who reads it act as that account.0
- places where npm install scripts runnpm can run a package's own scripts during install; that is how a poisoned package usually runs its code.0
- installs that do not use the lockfileThe lockfile pins the exact version of every package, so an install cannot quietly pull a different one.0
- container images not pinned to a digestA digest pins a container image to exact bytes; a tag such as latest can change underneath you.0
|
clock Are runtimes and website certificates still within their dates? | green | 2026-10-27 09:05 UTC | 6.0 s | 0 | 9 numbers- domains checked0
- days to the nearest end of life185
- runtimes checked7
- runtimes past active supportendoflife.date lists this release as past active support.3
- runtimes reaching end of life within 90 daysEnd of life: the date after which a runtime gets no more security fixes.0
- runtimes with no end-of-life date yetendoflife.date lists this release as maintained, with no end-of-life date yet.3
- runtimes past end of lifeEnd of life: the date after which a runtime gets no more security fixes.0
- website certificates (TLS) checked1
- website certificates (TLS) expiring within 14 daysTLS certificates are what give a website address its https padlock.0
|
exposed-settings Are the live service's secrets kept out of plain text? | green | 2026-10-27 09:05 UTC | 0.7 s | 0 | 3 numbers- plain-text secrets on the live serviceSettings on the live service that look like secrets but are not kept in a secret store.0
- plain-text secrets in older revisions0
- settings checked6
|
postmortem Are deploy jobs kept out of scheduled pipelines? | green | 2026-10-27 09:05 UTC | 1.2 s | 0 | 4 numbers- deploy jobs checked5
- deploy jobs a schedule would runA deploy job in a scheduled pipeline could ship code nobody chose to release.0
- deploy jobs seen in a live schedule pipeline0
- rules the check could not work outRules the drill could not work out for certain. They count against it, never for it.0
|
restore Does the newest backup really restore, and fast enough? | green | 2026-10-26 15:20 UTC | 1.0 s | 0 | 4 numbers- age of the newest backupHow old the newest backup was when the drill ran: the most data a restore would lose.6 min
- time to restore itHow long restoring that backup into an empty throwaway database took.0.2 s
- tables compared6
- tables that did not matchTables whose restored copy did not match the original.0
|
supply-chain Do installs use the lockfile, with install scripts off? | green | 2026-10-27 09:05 UTC | 0.0 s | 0 | 6 numbers- packages that carry an install script2
- installs checked1
- packages in the lockfile232
- lockfile packages with no checkable downloadEach lockfile entry should say where the package came from, with a checksum to verify it.0
- places where npm install scripts runnpm can run a package's own scripts during install; that is how a poisoned package usually runs its code.0
- installs that do not use the lockfileThe lockfile pins the exact version of every package, so an install cannot quietly pull a different one.0
|
supply-chain-probe In this CI job, is install-time code kept from credential-looking names and from pushing? | green | 2026-10-27 09:05 UTC | 1.6 s | 0 | 5 numbers- checks performed2
- public-by-design keys visible (not counted)1
- GitLab job credentials visible (not counted)4
- an install could push to the repo (1 means yes)Whether the CI job's own credentials could push to the repository, checked without pushing anything.0
- credential-looking names an install could seeCredential-looking variable names (matched by name) a package's install script could read in this CI job. Names only, never values.restricted
|