Security AI Apps

See every invisible character in your text - zero-width spaces, directional overrides, tag characters, private-use codepoints, homoglyph spaces - each named, counted and located, then removed exactly, without breaking the joiners that hold emoji, Persian, Khmer, Hangul and regional flags together. Adds a zero-model style score for AI-like cadence and an optional model lane that either explains the findings or rewrites only the highest-signal paragraphs, with a word-level before-and-after diff. The scan, the reveal view, the style score and the clean all run free in your browser with no account. Method derived from github.com/guillaumemeyer/watermarks-remover (MIT, Guillaume Meyer) - this app is an independent re-implementation of that project's text layers, not a port of its code.

Paste an email — subject, HTML or plain-text body, optionally your SPF/DKIM/DMARC records — and get an expert deliverability audit: an inbox/risky/spam verdict, severity-ranked findings each with the corrected record, header or copy, a scored twelve-item checklist, a five-area health check, and your own email rewritten to land. A free instant prescan flags spam-trigger phrasing, missing unsubscribe, image-heavy bodies and broken auth records before you run anything. Derived from @sickn33/email-systems.

Paste a system or architecture description and get an AppSec threat model: a posture verdict, components and trust boundaries, an attacker model with explicit non-capabilities, entry points, multi-step abuse paths, a prioritized threat table with mitigations and detection ideas, and the focus areas to review first. A free client-side prescan flags attack surfaces, sensitive assets and exposure hints, and the model must reconcile every one. Derived from the @openai/security-threat-model skill.

Paste code — an API endpoint, a module, a diff — and get an application-security review: a ship/fix-first/block verdict, severity-ranked findings each with corrected code, a twelve-item pre-deploy checklist scored against your paste, and a hardened rewrite. A free instant prescan flags hardcoded secrets, SQL concatenation, unsafe HTML sinks and more before you run anything. Derived from @affaan-m/security-review.

Paste your Bash script (and optionally its helper files) and get a senior infrastructure engineer's defensive review: a production-readiness posture, the inventory of every file and function, prioritized findings with corrected shell fragments, a reconciliation of the free client-side prescan, quick wins and focus areas. The instant prescan (strict mode, unguarded rm -rf, curl piped to sh, backticks, unquoted $@, read without -r, fixed /tmp paths, missing traps, literal secrets and more) runs free in the browser. Derived from @wshobson/bash-defensive-patterns (MIT).

Three SVGs embedded as base64 data URIs, each shown rendered beside its decoded source - including one carrying a script element that renders fine and never executes, because an SVG loaded through an img tag is treated as an image with scripting disabled. A concrete look at why embedding untrusted SVG as an image differs from inlining it. Runs fully client-side. Imported Claude artifact. Source: https://github.com/simonw/tools (svg-sandbox.html, Apache-2.0).

Encrypt a message with a passphrase and share it as a link - the recipient opens the link, enters the passphrase, and reads the message. Uses browser WebCrypto (AES-GCM 256 with a PBKDF2-derived key, 100,000 iterations, random salt); nothing is uploaded. Imported Claude artifact. Source: https://github.com/simonw/tools (encrypt.html, Apache-2.0).