Our product · Web & security · the original norveth.app
Norveth audit engine
Point it at a website, a GitHub repository or a ZIP and it reports what's insecure, slow, broken or invisible to Google, from what a real browser actually receives.
- Status
- Hosted app retired in September 2026; the code is kept
- Related service
- Cybersecurity
- Stack
- Python 3.13
- FastAPI
- Celery
- Playwright
- Next.js 15
- Postgres + Drizzle
- Redis
Results
- checkers running in parallel on every scan
- ~20checkers running in parallel on every scan
- dependencies · findings · recommendations on a verified production scan of expressjs/cors
- 8 · 24 · 2dependencies · findings · recommendations on a verified production scan of expressjs/cors
- language models needed to produce a report
- 0language models needed to produce a report
- commits in the product monorepo
- 221commits in the product monorepo
Source: Norveth product overview (docs/company/OVERVIEW.md), production scan verified 2026-07-12.
The problem
Site owners can't see what their site really sends to a visitor's browser. Scanners bury them in noise, and AI-written audits invent findings.
What we built
- Collectors for websites, GitHub repositories and ZIP uploads. Website scans run in headless Chromium through Playwright, with an HTTP fallback and an SSRF blocklist on the crawler.
- About 20 specialised checkers run concurrently: security headers and TLS, dependencies, code quality, performance, architecture, SEO and accessibility.
- Security checks read the headers the server actually sends: HTTPS redirect, HSTS, Content-Security-Policy, clickjacking protection, cookie flags, mixed content, certificate expiry.
- Findings go into a knowledge graph, and reports are generated from it deterministically. A language model only rewrites the prose when one is switched on, so findings can't be invented.
- A Next.js product around it: email verification codes stored as HMACs, API keys stored as SHA-256 hashes and shown once, org-scoped data (an IDOR was found and fixed), SSRF-validated webhooks.
What happened to it
Norveth started as this product, and it worked end to end in production. Norveth now sells the engineering behind it as services rather than the software itself.
The free website check on this site runs on a lighter, non-intrusive checker (homepage only, one request per URL, Python standard library plus Lighthouse in Chromium), because the full engine is built for owners who've given permission, not for a first look.
What it doesn't do
Written down here so nobody finds out later.
- The hosted app is retired: its backend hosting expired and scans no longer run on norveth.app.
- No deep static analysis: it does not parse code into syntax trees for per-function complexity or SAST.
- Semantic search was never switched on in production; ranking was text and severity only.
Want something like this?
Tell us what you need. You get a fixed price, or a short scoping call, within 48 hours.