Nyxora Sentinel
Nyxora Sentinel is two tools pointed at one domain. Scan connects to the site and grades what it finds — headers, cookies, DNS records, TLS, and whether a valid security.txt is published — into a single A+ to F report. Recon never contacts the target at all: it maps the domain’s public surface from certificate transparency logs, registration records, apex DNS, and generated look-alike domains. Neither sends the target anything it had not already volunteered.
Problem
Security posture decays quietly. Headers drift during a redesign, a cookie loses a flag, the DNS records that stop someone spoofing your domain were never set at all. None of it breaks the site, so nobody looks — and the checks that would catch it are scattered across a handful of single-purpose tools, each grading one slice, none of them telling you where you actually stand.
Solution
Built as two tools under one umbrella. Scan runs the full check set against a live target in a single pass — HTTP security headers including CSP and HSTS, cookie attributes, SPF, DMARC and CAA records, TLS certificate, chain and protocol posture, and whether the site publishes a valid security.txt — weighting each category into one A+ to F grade. Recon answers the other half: it never contacts the target, enumerating the domain’s public surface from certificate transparency logs, RDAP registration data, apex DNS, and generated look-alike domains. Scan grades; Recon maps. Neither needs anything installed, no credentials handed over, and nothing that could disturb the site being examined.
Outcome
Both tools are live at sentinel.nyxoralabs.com — Scan grading any public domain in a single pass, Recon mapping the same domain’s surface beside it. The first site Scan graded was this one, and the F it returned was its own bug rather than a real finding — the fix became a capability: it now walks the redirect chain hop by hop and reports that the plain-http response carries no HSTS of its own.
A Nuxt 3 pnpm workspace of four packages: the web app, a core package holding the shared types and the grading rubric, Scan’s check modules, and Recon’s discovery sources. Each check is a plain TypeScript module carrying as few dependencies as it can, and the rubric sits apart from the checks so how a finding is weighted stays separable from how it is detected. Both tools run on Nitro serverless functions on Vercel: a scan and a recon are each one request, so there is no queue and no state to keep between them.
- Passive, not intrusive
- Every Scan check reads something the server already volunteers to any visitor — response headers, cookie attributes, public DNS records, the TLS handshake. Nothing is probed, fuzzed, or authenticated against. Recon goes further and never contacts the target at all, assembling its map from third-party sources instead. Which is what makes either safe to point at a domain without arranging anything first.
- Dep-light check modules
- A security tool is judged by its own supply chain. Checks are written as small TypeScript modules rather than wrappers around existing scanners, so the thing doing the grading has an attack surface worth trusting.
- Grade the response you actually got
- The scanner walks redirects by hand instead of letting fetch resolve them, records every hop, and grades the final document response — reporting the resolved URL so the report says exactly what it looked at.
- Nuxt 3
- TypeScript
- Nitro
- Vercel
- pnpm workspace
- August 6, 2026 · 2 min readThe guard was correct. Its scope was wrong.Scan makes requests to whatever host you point it at, so it has a guard against reaching internal addresses. The guard was right. It just wasn’t covering the whole path.
- July 30, 2026 · 2 min readA certificate check that worked on my machine and was dead in productionScan flags certificates signed with SHA-1. The check ran perfectly in development and silently never fired on the deployed site, because the two run different versions of Node.
- July 23, 2026 · 2 min readMy scanner told me to add a DNS record that wouldn’t have helpedSentinel checked a subdomain for a DMARC record, didn’t find one, and told me exactly what to add. Following that advice would have accomplished nothing.
- July 16, 2026 · 2 min readThe scanner said my own site was an FSentinel graded nyxoralabs.com an F. I’d already hardened it, so only one of us was wrong.
Interested in similar work?
If this maps to something you're building, let's talk about your project.