Changelog

One-line summary of every website update. Newest first — we ship small improvements often.

📡 Subscribe — new tools & updates in your feed reader, no email required: Atom · JSON Feed

  • IMPROVE Today’s set now shows the top 10 CVEs of the week. Next to the CISA KEV pick, Today’s set lists two groups of five: Exploited this week (KEV additions of the last 7 days, highest EPSS first) and Critical in widely used software (CVEs published in the last 7 days with a CVSS score of 9.0 or more in software such as PHP, OpenSSL, OpenSSH, the Linux kernel, nginx, Windows, Chrome, Java or Cisco, or named in a Debian security advisory). A fresh critical bug that nobody is known to exploit yet, like this week’s PHP remote code execution flaws, now shows up the day after it is published, labelled “not known exploited” so it is never mistaken for an attack in progress. The homepage shows the first three of each; the full ticket shows all ten with CVSS, CISA’s SSVC ratings, the advisory links and how the lists are picked. Data comes once a day from NVD, CVE.org, CISA KEV, FIRST EPSS and the Debian security tracker.
  • FIX Security updates for two bundled libraries. The Certificate Decoder now uses node-forge 1.4.0 (was 1.3.1), which fixes ASN.1 parsing flaws (unbounded recursion, OID integer truncation, validator desynchronization) that a crafted certificate could trigger. The JSON Formatter's YAML support now uses js-yaml 4.3.2 (was 4.1.0), which fixes prototype pollution in merge keys and several inputs that made parsing very slow. Both run only in your browser on what you paste. The Certificate Decoder does not verify signatures, so the node-forge signature advisories do not apply to it.
  • CONTENT New cheat sheet: Redis Hardening. The Redis Hardening sheet covers where to listen and what protected mode really does, named ACL users instead of one shared password, least-privilege rules (key patterns do not stop FLUSHALL), the admin features Redis 7+ keeps locked, TLS with client certificates, the ACL log, and how to check the server from outside. Checked against the Redis documentation and the redis.conf shipped with Redis 8.10, and the examples were run on a Redis 8.10 test server.
  • IMPROVE LinkedIn Exposure Audit: settings checked against LinkedIn Help. The hardening advice now names LinkedIn's current settings and where to find them (public profile visibility, Connection visibility, Invitations to connect, Share profile updates, Two-factor authentication, Where you're signed in), and the breach note separates the 2012 password theft from the 2021 scraping. The report lists the highest-risk attacker use cases first, says what to do when nothing is ticked, moves focus to the report, and screen readers hear the score as it changes. The SHA-256 fingerprint no longer includes the time, so the same answers always give the same fingerprint. Examples are now generic, and the page no longer claims GDPR/DORA compliance (it collects no data; a checklist cannot be compliant by itself).
  • FIX Security Feeds: no more long waits on a slow source. When a source fails or times out, it is not asked again for 5 minutes; the last saved copy (with its date) or the error is shown straight away instead of making each visitor wait up to 15 seconds. In My feed, a source that was unticked while waiting its turn and then ticked again no longer stays on "loading" forever.
  • FIX Phishing Checker: two small fixes. A plain http:// link that does not answer is no longer scored as "page served over plain HTTP" (no page was served); it is noted for information only. Links with another scheme, such as ftp:// or file://, now get a clear "only http:// and https:// links can be checked" message instead of a broken scan.
  • IMPROVE SSL Checker now checks mail servers that use STARTTLS. Add port 587 (SMTP submission), 143 (IMAP) or 110 (POP3) to a host, for example smtp.example.com:587, and the SSL Checker asks the server to switch to TLS, then shows its certificate and chain as for a web server. Before, these ports failed with "this tool does not speak STARTTLS". Port 25 still cannot be tested, because the hosting provider of this server blocks outbound SMTP on it; the error now says so.
  • FIX Phishing Checker no longer gives a verdict on a site it could not reach. When the Phishing Checker gets no answer from a link (down, already taken down, or blocking scanners), it now says "Not checked: the site did not respond" instead of scoring the failed connection as a risk, and explains that a silent link is not a sign it is safe. URLs typed with an upper-case HTTPS:// prefix now scan correctly, and redirects that only change the query string are followed to the right page.
  • FIX Clear message when the RDAP directory is down. If the IANA RDAP directory cannot be reached, WHOIS Lookup, Domain Availability and the Phishing Checker now say so and ask you to retry, instead of claiming the registry has no RDAP service or that a registered name might be available.
  • CONTENT Four OWASP 2025 risks added to the AI / LLM Vocabulary. The AI / LLM Vocabulary now has its own entries for Sensitive information disclosure (LLM02), Vector and embedding weaknesses (LLM08), Misinformation (LLM09) and Unbounded consumption / Denial of wallet (LLM10), each written from the OWASP GenAI Security Project page for that risk. System-prompt extraction now notes it is LLM07, and the OWASP entry links to all of them.
  • FIX AI / LLM Vocabulary brought up to date. The AI / LLM Vocabulary model snapshot now lists the current Claude models and prices (Fable 5.1, Opus 5.5, Sonnet 5.5, Haiku 5.5, from Anthropic’s pricing page). The OWASP Top 10 for LLM entry lists the 2025 categories instead of the 2023 ones, and the EU AI Act entry gives the high-risk dates as deferred by the Digital Omnibus on AI (2 December 2027 and 2 August 2028). Also: search highlights now stay inside the definitions, cards opened to show a match close again when the search changes, and “Copy link” says when copying fails and no longer gets stuck on “Copied” after a double click.
  • CONTENT New cheat sheet: PostgreSQL Hardening. The PostgreSQL Hardening sheet covers where to listen, a strict pg_hba.conf (first match wins), SCRAM passwords instead of MD5 (deprecated in PostgreSQL 18), TLS with sslmode=verify-full, least-privilege roles and default privileges, timeouts, connection and DDL logging, and how to check the server from outside. Checked against the PostgreSQL 18 documentation, and the snippets were run on a PostgreSQL 16 test server.
  • FIX Resource Health reads the right numbers. The Resource Health checker now takes disk activity from the last iostat report (the current second) instead of the first one, which is the average since boot, and shows an idle disk as 0%. A CPU figure taken from the load average is now labelled "load per core" (above 1 means tasks are waiting), not "usage". On Windows, the suggested Get-Counter commands print each counter name next to its value, and CPU and disk samples are read by name instead of being split in half.
  • IMPROVE Domain Availability Checker names the lines it skips. When some lines are not valid domain names, the Domain Availability Checker now shows the first three of them, so you can see what to fix. Also, the Page Content Audit Markdown link export now escapes < in link text, so a link label cannot turn into HTML in a Markdown viewer.
  • IMPROVE Domain Availability Checker: international names, deletion status, clearer feedback. The Domain Availability Checker now checks international names such as café.com (and TLDs such as .рф) in the xn-- form registries use, instead of rejecting them. A registered name the registry is deleting now says so (RDAP status “pending delete” or “redemption period”), because it may become available. Errors are announced to screen readers and put the cursor in the field to fix, the finished result is announced, and a cancelled run says how many names were not checked.
  • CONTENT New cheat sheet: Web Server Hardening (Apache and nginx). The Web Server Hardening sheet gives baseline settings for Apache httpd 2.4 and nginx: testing a change before reloading, hiding version details (including X-Powered-By from PHP), refusing directory listings and dotfiles such as .env and .git/ while keeping /.well-known/ reachable, limiting HTTP methods, the OWASP Secure Headers values and the nginx add_header inheritance trap, Mozilla’s “intermediate” TLS settings (guidelines 6.0), request size and slow-client limits, rate limiting, private status pages, and quick checks from outside. The Apache and nginx settings were checked against the official documentation and tested on Apache 2.4.68 and nginx 1.31.7.
  • FIX Page Content Audit: the page preview can no longer make requests. The hidden-text preview resolved a page's relative images and CSS backgrounds against cyberramen.com, so auditing or pasting a page triggered requests to this site from your browser. A block-everything policy inside the preview now stops every request; the analysis is unchanged. Also: Extract links caps <link> tags at 2,000 like the other link types, an empty field gets focus with a clear message, and an old error no longer stays on screen next to a new result, the hidden-text counts stay exact on pages with more than 200 hidden elements, only Pinterest’s own domains count as Pinterest profile links, and in pasted HTML relative scripts and stylesheets count as the page’s own. Site-wide, the same notice shown twice now replaces itself instead of stacking.
  • CONTENT Three more Privacy Guides: private cloud storage, secure file sharing, and private calls. Private cloud storage explains the two ways to keep a cloud drive from reading your files — wrapping your existing Google Drive, OneDrive, Dropbox or iCloud with Cryptomator, or moving to an end-to-end encrypted provider — and is clear that a lost password means lost files and that iCloud’s end-to-end mode is opt-in. Secure file sharing covers OnionShare, which sends a file straight from your computer to the recipient over Tor with no company in the middle, including its new Download Mode and its real limits. Private voice and video calls explains why ordinary calls and SMS are not end-to-end encrypted, which apps fix the content (Signal, FaceTime, WhatsApp), what metadata still leaks, and how to hide your IP and phone number on Signal. Every claim was checked against primary sources (Cryptomator, Apple, OnionShare, Signal and CISA).
  • CONTENT Three new Privacy Guides: two-factor authentication, removing file metadata, and reducing OS telemetry. Two-factor authentication: use an app, not SMS explains the strength order (passkey or hardware key, then an authenticator app, then SMS), what a TOTP code really is (RFC 6238), how to pick an app by its backup model, and how to move your codes to a new phone without locking yourself out. Remove hidden metadata before you share a file covers the GPS, device and author data hidden in photos and documents, why you should strip it yourself rather than trust each app, and how to do it with this site’s metadata tool, ExifTool and the Office Document Inspector. Reduce OS telemetry on Windows and macOS shows which diagnostic and advertising settings you can turn off, and is honest that the vendors’ required data cannot be switched off from the interface. Every claim was checked against primary sources (the RFCs, Microsoft Support, Apple Support and CISA).
  • FIX Server-side address checks now refuse multicast and other special-purpose addresses. The shared check that stops server-side lookups and fetches from reaching non-public addresses now also refuses IPv4 multicast (224.0.0.0/4), the reserved 240.0.0.0/4 block including 255.255.255.255, the retired 6to4 relay block 192.88.99.0/24, and every IPv4-mapped IPv6 address (::ffff:…), following the IANA special-purpose address registries. The IP Geolocation & Privacy Checker, for example, previously ran a lookup and a reverse DNS query for 224.0.0.1; it now says such addresses cannot be geolocated. Public addresses are not affected.
  • IMPROVE IP Geolocation & Privacy Checker: clearer WebRTC leak verdict. The WebRTC check in the IP Geolocation & Privacy Checker now compares only addresses of the same IP version, so an IPv4 WebRTC address next to an IPv6 site address is no longer reported as a leak; it says when local addresses are hidden behind .local names, when only local addresses are revealed, and when WebRTC is blocked, and it finishes once instead of redrawing its result. Addresses are checked before they are sent, with a message that says what is wrong (for example a port number or a private address), and a slower earlier lookup can no longer replace a newer one. Errors and results are announced to screen readers, and the background text no longer gives unsourced accuracy figures.
  • CONTENT New cheat sheet: systemd Service Hardening. The systemd Service Hardening sheet shows how to sandbox a Linux service with its own unit settings and measure the result: systemd-analyze security and its --threshold gate, drop-in files with systemctl edit, a starting set of settings (ProtectSystem=strict, NoNewPrivileges=yes, SystemCallFilter=@system-service and more), what each one does not cover, DynamicUser=, per-unit IP and device limits, and how to try a setting with systemd-run first. Every line was checked by script against the systemd 255 manual pages.
  • IMPROVE Policy Document Generator: references checked against the official texts. All 433 framework references in the Policy Document Generator were checked by script against the EUR-Lex texts of NIS2, DORA and the GDPR and the ISO/IEC 27001:2022 Annex A list; 16 that pointed to the wrong article, paragraph or requirement were corrected and one PCI DSS reference that the passphrase statement does not meet was removed (for example DORA 12(6) for recovery objectives and GDPR 33(1) for internal breach reporting); six statements now follow the legal or standard wording more closely. The password policy follows NIST SP 800-63B-4 (at least 15 characters when a password is the only factor, 8 with multi-factor authentication) and PCI DSS v4.0.1. The next review date no longer rolls into the following month (31 August plus six months is 28 February). Screen readers no longer hear the whole document after every keystroke, copy results are announced, and focus moves to each step’s heading.
  • IMPROVE Document Watermark: no stale downloads, white backgrounds, clearer messages. In the Document Watermark tool, changing a setting after applying now withdraws the old download until you apply again (before, Apply kept the old result). Transparent PNG and WEBP areas now come out white instead of black, the watermark text can have up to four lines, and Apply stops if a template placeholder such as [recipient] is still in the text. Messages appear on the page instead of pop-ups, a damaged or password-protected PDF says so, files with the same name get distinct names in the ZIP, and ZIP entries carry the real date. Very large images and pages are scaled down to fit what mobile browsers accept. The privacy notes are more precise: the site’s session cookie is mentioned, and the output keeps no EXIF data or PDF author, title or dates.
  • CONTENT New cheat sheet: USB Device Control. The USB Device Control sheet shows how to choose which USB devices a computer accepts and how to see which ones were connected: the Windows Device Installation Restrictions policies and their order of precedence, pnputil and Get-PnpDevice, the Plug and Play audit events (6416 to 6424) and removable storage auditing, the Linux kernel’s USB authorization switches, and USBGuard with example rules that allow storage-only devices and reject a storage device that also offers a keyboard. Every line was checked by script against Microsoft Learn, the Linux kernel documentation and the USBGuard manual.
  • IMPROVE USB Hygiene Helper: real vendor list, Windows exports, clearer checks. The USB Hygiene Helper now names vendors from the USB ID Repository list that lsusb uses (about 3,400 vendors, instead of a short built-in list) and reads lsusb, lsusb -t, Get-PnpDevice (CSV or table) and pnputil /enum-devices output, including semicolon and UTF-16 CSV files. Each check is explained: input and storage on one device (MITRE ATT&CK T1200), a vendor ID missing from usb.ids, or many storage devices. The page says plainly that vendor and product IDs are reported by the device itself and can be faked. Results can be filtered, sorted and exported as CSV or JSON, and the page gives copyable commands for Linux and Windows.
  • IMPROVE Risk Matrix Builder: NIST risk table, editing, keyboard use. The Risk Matrix Builder can now rate risks with the NIST SP 800-30 Rev. 1 risk table (Table I-2: five levels, read from the table instead of multiplied), checked cell by cell against the NIST publication. Risks can be edited, a removed risk can be restored with Undo, heatmap cells work with the keyboard, and an empty title, an import or an export now says what happened. Imports report values that had to be adjusted, switching to 3 × 3 asks before changing risks, and the page warns before closing with risks that were not exported. CSV exports now include the scale labels, the level and the method. The page no longer claims that the 5 × 5 scale follows ISO 31000.
  • CONTENT New cheat sheet: Windows Audit Policy and Event Log Settings. The Windows Audit Policy sheet shows how advanced audit policy is applied and why it must not be mixed with the basic policy, how to read it with auditpol, Microsoft’s recommended settings for clients and servers (baseline and stronger) side by side, a PowerShell loop that applies the server baseline, the subcategory GUIDs, backup and restore, how to put command lines into event 4688, Security log size and retention with wevtutil, and the events that show the log or the policy was tampered with (1102, 1104, 1100, 4719, 4906, 4912). Checked against Microsoft Learn and the MS-GPAC specification.
  • IMPROVE Markdown Preview: standard rendering, safer export, clearer feedback. The Markdown Preview now uses marked 18.0.14, checked against all 652 examples of the CommonMark 0.31.2 specification: 640 now render as the specification says (602 before; links, images and code blocks gained the most). New option: turn off “Enter starts a new line” to preview a README the way GitHub shows files. Pasted HTML can no longer borrow the page’s own styles (class kept only on code languages) or add editable inputs (only read-only task-list checkboxes). Images hosted on other sites are now explained instead of shown broken, words are counted in the rendered text, Copy HTML says when it fails, and the downloaded HTML file carries its own Content-Security-Policy, a no-referrer policy and the first heading as its title.
  • FIX Windows Event ID Lookup: links to an unknown event now say so. A link such as ?id=9999 or ?channel=Bogus used to show all 100 events as if nothing was wrong. The Windows Event ID Lookup now says which event ID or channel is not in its list (the event may still exist, so check Microsoft Learn), shows an empty result for an unknown ID, and searches a non-numeric ID as a keyword. The message goes away as soon as you search or pick a filter.
  • IMPROVE Windows Event ID Lookup: App Control, AppLocker, attack surface reduction and 11 more Security events. The Windows Event ID Lookup now has 100 events instead of 72. New: Security 4662 (with the DCSync replication-right GUIDs), 4663, 4657, 4719, 4767, 4778, 4779, 4794, 5136, 1100 and 4616; Defender attack surface reduction (1121, 1122, 1129), controlled folder access (1123, 1124, 1127) and network protection (1125, 1126); App Control for Business (3076, 3077, 3089, 3033, 3099) and AppLocker (8003, 8004, 8006, 8007), each with its own channel filter. Fixes: 4776 now uses Microsoft’s title (credential validation, not only on domain controllers), 1119 (remediation failed) no longer claims a defence-evasion technique, 1102 is no longer tagged as persistence, and Defender events list the field names Microsoft documents. Checked against Microsoft Learn and MITRE ATT&CK.
  • FIX security.txt at its standard address. /.well-known/security.txt (RFC 9116) returned 403 because the rule that hides dot-files also caught the virtual .well-known path before it was rewritten. It now serves the same file as /security.txt; other dot-files stay blocked.
  • CONTENT New cheat sheet: Defender ASR Rules and App Control. The Defender ASR Rules and App Control sheet lists the attack surface reduction rule GUIDs and modes (Off, Block, Audit, Not configured, Warn), how to set them and their exclusions with PowerShell, Group Policy and the Policy CSP, the Windows Defender event IDs (1121, 1122, 1129, 5007), controlled folder access and network protection modes and events, advanced hunting queries for audited rules, App Control for Business events (3076, 3077, 3089, 8028, 8029) and CiTool, AppLocker events (8000–8040) and policy export, a roll-out order from Audit to Block, and ATT&CK technique IDs as hunting leads. Checked against Microsoft Learn.
  • CONTENT Cloud Log Analysis sheet: Azure part corrected. The CloudTrail & Azure Monitor Log Analysis sheet listed Entra ID audit events, sign-ins and Azure Resource Manager operations together under “Azure Activity Log”. They are now two lists: Activity log operations by their ARM names (as found in AzureActivity), and Entra ID audit log activity names (AuditLogs), with sign-ins and risk pointed to SigninLogs and AADUserRiskEvents. Fixes: the PIM activation and admin password reset activity names, the token replay hunt (now the anomalousToken risk detection), the Global Administrator query, case-insensitive operation matching, a note that activity log profiles were retired on 15 September 2026, and session revocation with Revoke-MgUserSignInSession in place of the retired AzureAD module. Checked against Microsoft Learn.
  • CONTENT New cheat sheet: Azure Resource Incident Response. The Azure Resource Incident Response sheet covers a suspected compromise of Azure virtual machines, storage accounts, key vaults and networks: which log holds what (activity log, resource logs, flow logs, Defender for Cloud alerts) and why data-plane history only exists once a diagnostic setting is in place, reading the activity log with Azure CLI (and its 6-hour, 50-event defaults), the control-plane operations to look for (Run Command, extensions, role assignments, federated credentials, storage key listing, snapshot export, elevate access), KQL hunts on AzureActivity, StorageBlobLogs, AZKVAuditLogs, NTANetAnalytics and SecurityAlert, containment that keeps evidence (locks, NSG deny rules and their limits, key renewal and SAS revocation, Key Vault network and purge protection), and disk snapshots with a short read-only SAS, hashes and legal hold. MITRE ATT&CK technique IDs are given where they apply, and the sheet ends with a quick triage order. Operation names, table columns and commands were checked against Microsoft Learn, Azure CLI 2.91.0 help and ATT&CK v20.
  • CONTENT New cheat sheet: Kubernetes & Container Incident Response. The Kubernetes & Container Incident Response sheet shows what to do first when a cluster or container host may be compromised: isolate the pod without deleting it, save its state, then check recent changes, risky pods, RBAC, secrets and tokens, admission webhooks, static pods, the container runtime, image signatures and the API audit log. Each section links to MITRE ATT&CK v20. Every command was run on a test cluster with harmless planted examples; three notes are checked against the documentation only: the CRI-O mention, how long a copied token stays valid, and that traffic from the pod’s own node is always allowed.
  • CONTENT New cheat sheet: Email & BEC Triage. The Email & BEC Triage sheet walks through a reported phishing or business email compromise case: saving the original message and hashing it, reading the Received chain and your own Authentication-Results (and why a forged lower one or a lookalike domain can still show dmarc=pass), DNS checks with the new DMARC tags from RFC 9989, lookalike and punycode addresses, extracting links and attachments by hash without opening them, Exchange Online inbox rules (including hidden ones), forwarding, delegates and the unified audit log with MailItemsAccessed, Entra sign-ins and app consents, Google Workspace forwarding, filters and OAuth tokens, the signs of a payment-change scam, and containment. Each section gives the MITRE ATT&CK technique ID and what to flag, and ends with a quick triage order. The Python and dig steps were run on synthetic test messages; cmdlets, API paths and audit operation names were checked against Microsoft Learn, Google Workspace Admin Help, RFC 9989, FBI IC3 guidance and ATT&CK v20.
  • CONTENT New cheat sheet: OpenSSL TLS and Certificate Checks. The OpenSSL TLS and Certificate Checks sheet shows how to check a TLS server and its certificates with the openssl command line: what the server sends, whether the chain and the hostname verify (with the error codes you will meet), key and certificate match, protocol and cipher tests, OCSP and CRL checks, STARTTLS for mail servers, PEM/DER/PKCS#12 files and expiry monitoring. It includes the CA/Browser Forum validity limits (200 days now, 100 days from March 2027, 47 days from March 2029). Every command was run with OpenSSL 3.0 against a test certificate chain and a public site.
  • CONTENT New cheat sheet: Web Server Log Triage. The Web Server Log Triage sheet shows how to investigate Apache httpd and Nginx access and error logs after an incident: preserving and hashing the logs, finding every log file and the real log format, joining rotated and compressed files, the busiest clients, URLs and minutes, scanners and probes, injection and path traversal attempts, login brute force, web shells in the logs and on disk, large downloads, 5xx spikes and the error log, proxies and X-Forwarded-For, and signs of log tampering or missing hours. Each section gives the MITRE ATT&CK technique ID where one applies and what to flag, and ends with a fast triage order. Formats and paths were checked against the Apache httpd 2.4 and Nginx documentation and ATT&CK v20, and every command was run on synthetic logs on Debian 13 and Rocky Linux 9 test systems.
  • CONTENT New cheat sheet: Linux Firewall Audit. The Linux Firewall Audit (nftables and iptables) sheet is a read-only audit of a Linux host firewall: which backend really filters traffic (nftables, iptables-nft or legacy iptables), the full ruleset with counters, default policies and IPv6 parity, ufw and firewalld, Docker’s chains and published ports, listening ports against the rules, saved versus running config (with a diff that never touches the live firewall), forwarding and reverse-path kernel settings, logging, NAT redirects and port-knock patterns, signs of tampering, and fail2ban chains. Each section gives the MITRE ATT&CK technique ID and what to flag, a last section marks the few safe changes, and it ends with a quick audit order. Commands and options were checked against the nft, iptables and ufw manual pages, the firewalld, Linux kernel and Docker documentation and ATT&CK v20, and the commands were run on Debian 13 and Rocky Linux 9 test systems (the Docker, systemd and journal commands were checked against the documentation only).
  • CONTENT New cheat sheet: Windows Live Response. The Windows Live Response sheet is a first-hour collection guide for a running Windows host you suspect is compromised, using only built-in tools (Windows PowerShell 5.1, netstat, tasklist, wevtutil, reg, robocopy, vssadmin). It gives the order of volatility from RFC 3227, a list of which commands are read-only, which only write to your evidence folder and which destroy evidence (ipconfig /flushdns, wevtutil cl, vssadmin delete shadows, a Defender scan), and copy-paste blocks that save network state, processes with hashes and signatures, sessions and local administrators, Prefetch, scheduled tasks and Run keys, Defender status and exclusions, event logs as .evtx, registry hives and the shadow copy list into one time-stamped folder with a transcript and a SHA-256 manifest. It also notes that WMIC is removed from Windows 11 24H2 and later and gives the PowerShell replacements. Commands and properties were checked against Microsoft Learn, RFC 3227 and MITRE ATT&CK v20; no Windows host was available, so the PowerShell blocks were syntax-checked and their portable parts run with PowerShell 7.6, and the Windows-only commands were checked against the documentation only. It links to the PowerShell Blue Team, Windows Persistence Locations, Windows Security Event IDs, KAPE, EZ Tools and Memory Forensics sheets for analysis.
  • CONTENT New cheat sheet: Linux Persistence Detection. The Linux Persistence Detection sheet lists the places where attackers keep a foothold on a Linux host and how to inspect each one read-only: systemd services, timers and generators, cron and at, shell startup files, SSH keys and ~/.ssh/rc, accounts and sudo, PAM modules, /etc/ld.so.preload, kernel modules, udev rules, rc.local and init scripts, desktop autostart, apt and dnf hooks, Debian login message scripts, Python .pth files, setuid files and capabilities, and package verification with dpkg --verify and rpm -Va. Each section gives the MITRE ATT&CK technique ID, the Debian/Ubuntu and RHEL/Rocky/Alma paths and what to flag, and ends with a fast triage order. Paths and options were checked against the systemd, OpenSSH, glibc, kmod, Linux-PAM, apt, dpkg and rpm manual pages and ATT&CK v20, and the commands were run on Debian 13 and Rocky Linux 9 test systems (two kernel-module lookups that need a real kernel were checked against the manuals only).
  • FIX Small wording fixes. The TOTP Generator & Verifier countdown now says “1 second remaining” instead of “1 seconds remaining”. The sources note at the end of the Windows Persistence Locations cheat sheet was cut in half on the page; it now shows in full.
  • FIX Certificate Decoder: CRL addresses, every extended key usage and non-English names now show correctly. In the Certificate Decoder the CRL Distribution Points of a certificate were never listed; they are now. Extended key usages the tool had no name for (for example Microsoft Encrypted File System or IPsec IKE) were silently left out; every one is now shown, by name or by its OID. Alternative names of the otherName, directory-name and registered-ID kinds printed [object Object] or raw bytes; they now read like UPN: user@example.com, CN=Dir Name, O=Example and 1.2.3.4. Names stored as UTF-8 showed garbled letters (Zürich for Zürich); they are now decoded. A negative serial number was shown as its raw byte (FB); it now reads -05 as in openssl, with a note that RFC 5280 forbids zero, negative and over-20-byte serials. A TRUSTED CERTIFICATE block from openssl -trustout is now decoded instead of refused. Key Usage and Extended Key Usage show when they are marked critical, an error is announced to screen readers, editing the input hides the old result, and hostile input gives a plain message instead of a JavaScript error. Checked against openssl and Python cryptography on 19 generated certificates: RSA, EC P-384/P-521 and Ed448 keys, every alternative-name type, UTF-8, BMP and T61 names, dates in 1950, 2049 and 2050, a v1 certificate and a chain. Fingerprints, serials, dates, names and extensions all match.
  • FIX CIDR Calculator: correct address types, IPv6, and the full Range to CIDR list. The CIDR Calculator only knew private (RFC 1918) and loopback addresses, so many special addresses were labelled “Public”: shared address space 100.64.0.0/10, link-local 169.254.0.0/16, the documentation ranges, multicast and 240.0.0.0/4 among them. The type now comes from the IANA special-purpose address registries, with the block, its RFC and whether it is globally reachable. IPv6 addresses and prefixes now work in all three modes. Range to CIDR now lists every block (it stopped after five) and no longer shows the first block’s details as if they were the whole range; each block can be opened, and the list copied. Also accepted: a mask after a space (10.0.0.0 255.0.0.0), a wildcard mask, and a single address. Errors now say what is wrong (for example a leading zero, or “::” used twice), and old results are cleared. The /8 row of the reference table now shows its usable hosts. Results were checked against Python’s ipaddress module on 1,654 networks, 246 ranges and 422 addresses at the edges of every IANA block: all match.
  • FIX Hidden buttons and boxes stay hidden until they are needed. A style rule for buttons overrode the browser’s own rule for hidden elements, so on at least 17 pages buttons and boxes meant to appear only at the right moment were on screen from the start. Examples: Delete vendor in the Third-Party Risk Register before any vendor was chosen, Delete saved draft in the Incident Report Generator with no draft saved, an empty output box in the HMAC Generator, the version 5 fields in the UUID Generator while version 4 was chosen, and Copy defanged in the QR Code Generator & Scanner before any scan. These now appear only when they apply. All 377 pages in the sitemap were checked in a browser before and after the change: 25 elements on 15 pages were wrongly visible as the page loaded, none after. Two more showed up only during use and are fixed too: the S3 region hint in the Bucket Exposure Checker for non-AWS providers, and the Keep option in the Secrets Leak Scanner when masking was not chosen.
  • FIX TOTP Generator: 8-digit codes fit on phones, and Verify can use an imported period. In the TOTP Generator & Verifier an 8-digit code was wider than a 375 px phone screen and was cut off; the code now scales with the screen and stays on one line at 320 px, while keeping its full size on a desktop. Verify only offered 30 or 60 seconds, so a code from an imported 15 s secret could not be checked; an imported period is now added to the Verify Period list too. A 1-second period is labelled “1 second” instead of “1 seconds”. Verification was checked against 341 codes computed with Python’s hmac module at periods of 1, 15, 90, 120 and 300 seconds: all match.
  • FIX Binary/Hex/Decimal Calculator: no more misread input, a sign-keeping right shift, and results that follow what you type. In the Binary/Hex/Decimal Calculator & ASCII Table some non-English letters were read as digits because upper-casing turned them into one (ß became SS, the ff ligature became hex FF); only the digits and letters A–Z now count. A decimal comma such as 3,14 was silently read as 314; commas are now accepted in decimal only as thousands separators (1,000,000). AND, OR, XOR and shifts quietly wrapped a number that did not fit the bit width (300 at 8 bits was used as 44); it is now refused with the allowed range. The only right shift filled with zeros, so -8 >> 1 at 8 bits gave 124; there is now an arithmetic >> that keeps the sign (−4, as in C, Java and Python) next to the zero-filling >>>. With Signed integer ticked, a pattern such as hex FF at 8 bits now also shows its signed value (−1). Results update as you type and clear when you change the base, so an old result never sits next to a new number; the step-by-step walkthrough is limited to 256-bit numbers, because a 4,096-digit number used to freeze the tab, while results stay exact at any size. A failed copy now says so. In the ASCII table, code 9 uses its standard abbreviation HT, an emoji is read as one character, hex and binary accept 0x/0b, and an invalid entry clears the other fields. Checked against Python: 404 conversions in bases 2–36, 300 bitwise and shift cases, 200 exact arithmetic cases and all ASCII control names match.
  • FIX TOTP Generator: imported 15 s secrets give the right codes, and Verify accepts codes as apps show them. In the TOTP Generator & Verifier, importing an otpauth:// URI with a period other than 30 or 60 seconds said it had imported it but then generated codes every 30 seconds, so every code was wrong; the imported period is now kept and offered in the Period list. Import now rejects a zero, negative or fractional period and non-numeric digits instead of quietly using a default, explains a broken %-escape, ignores a # fragment, and keeps an issuer that contains a colon. Verify accepts a code typed with a space or dash, such as 123 456, and says so when the code has a different number of digits than the Digits setting. A one-character secret gets a clear message. A new Copy code button works from the keyboard, and copying no longer swaps the code for the word “Copied!”. The generator was checked against the RFC 4226 and RFC 6238 test vectors and 600 random cases computed with Python’s hmac module (SHA-1, SHA-256, SHA-512, 6 and 8 digits, dates past 2038): all match.
  • FIX AES-GCM Encrypt & Decrypt: clearer errors and an accurate format description. In the AES-GCM Encrypt & Decrypt tool every decryption problem said “Wrong password or corrupted data”, even when the pasted text was not Base64 at all or had been cut short. It now says which it is. Base64url text (with - and _, as used in links) and text without the trailing = are accepted. The page described the output as salt + IV + ciphertext; it now lists the full layout (a CR1 header with the iteration count, salt, IV, ciphertext and the 16-byte authentication tag), so other software can read it. An old result is hidden as soon as you change the text or password, so it cannot be copied by mistake. Clicking Copy twice no longer leaves the button stuck on “Copied!”, and error messages can no longer be copied as if they were output. The Encrypt and Decrypt buttons now tell screen readers which mode is on. The encryption itself was already correct: output from Python’s cryptography library decrypts here, and output from here decrypts with Node.js, in both directions.
  • FIX ASCII Banner Generator: real FIGlet fonts, and comment wrappers that cannot break your code. In the ASCII Banner Generator several fonts (Doom, Slant and Big most of all) had letters whose rows were different widths, so every letter after them was sheared out of line, and in Standard, Small, Big and Doom digits and punctuation came out as a single ?. It now uses six original FIGlet fonts (Standard, Slant, Small, Big, Doom and Banner) laid out with FIGlet’s own rules; on 522 test strings the result is identical to the figlet 2.2.5 command. The Block and Simple box-drawing fonts were repaired. The banner updates as you type, shows its width with a warning past 80 columns, and lists any characters the font does not have. Comment wrappers were unsafe: a */ or --> drawn by a font ended the comment early, a // or # line ending in a backslash pulled your next line of C, Make or Tcl code into the comment, and \u broke Java builds. Each wrapper is now made safe and was checked by compiling and running the result in gcc, g++, Java, Node.js, Python, Bash, SQLite, GNU Make and Tcl. The font choice now works with the keyboard and screen readers, and the downloaded file keeps the box-drawing characters as UTF-8.
  • IMPROVE Favicon Generator: a complete favicon set in one ZIP, now from your own image too. The Favicon Generator only offered single PNG files, while its HTML snippet pointed to an apple-touch-icon.png it could not make. Download all now gives a ZIP with favicon.ico (16, 32 and 48 px inside), 16 and 32 px PNGs, a 180 px apple-touch-icon.png (square and opaque: iOS rounds the corners itself), the 192 and 512 px icons Chromium needs for an installable site, a maskable icon with the artwork kept inside the safe zone, and a site.webmanifest with your site name and colour; the HTML snippet links exactly those files. New Image source: pick a PNG, JPEG, WebP or GIF and it is fitted without cropping, with adjustable padding, drawn in your browser and never uploaded. The text box now counts an emoji with a skin tone as one character, a mistyped hex colour shows an error instead of being ignored, and the type and emoji buttons work with the keyboard and screen readers. The ICO and ZIP files were checked with Python Pillow and zipfile.
  • IMPROVE SecOps Response Templates: fill every placeholder from one form. The SecOps Response Templates showed the [PLACEHOLDERS] but left you to replace each one by hand in the editor, where a ticket ID used several times had to be typed each time. A new Fill in panel under the text has one field per placeholder: what you type replaces every copy at once, filled values are highlighted, and a counter shows how many are left. Fields such as [YES/NO], [LOW/MEDIUM/HIGH] or [VERDICT - Confirmed Phishing / Suspicious / Legitimate] suggest their choices. Values stay while you switch templates or change the tone, and are never saved in the browser. Copy and Download now name the placeholders still to fill.
  • FIX EXIF & Metadata Analyzer: reads PNG, WebP, TIFF and HEIC, plus XMP and IPTC. The EXIF & Metadata Analyzer only read Exif from JPEG files, so a PNG, WebP, TIFF or iPhone HEIC photo with GPS coordinates was reported as having “no EXIF data”. It now reads Exif, XMP (including GPS stored only in XMP), IPTC, PNG text chunks (also compressed ones and ImageMagick “Raw profile” Exif), JPEG comments, the embedded preview image (which can still show the uncropped original) and data hidden after the end of the image. Names and text in other alphabets are decoded correctly, and a summary lists what the file reveals: location, serial numbers, names, dates, device. Results were checked against ExifTool on test images in every format and on thousands of damaged files. The Strip tab now reads each cleaned image again and shows what is left, instead of always printing “0 metadata tags”.
  • FIX User Agent Parser: correct results for iPhones, Chrome, Internet Explorer and today’s bots. The User Agent Parser reported every iPhone as a Mac (its string says “like Mac OS X”), Chrome and Edge as WebKit instead of Blink, Internet Explorer 11 as Gecko, the old EdgeHTML Edge as Chrome, Chromium as unknown, Chrome and Firefox on iOS as Safari, and the Firefox engine version as a fixed 2010 date. It now gets these right, and results were checked against an independent parser (ua-parser-js) on the User-Agent strings published by MDN, Chromium, Google, Microsoft, Apple, Samsung, OpenAI and Perplexity; the few places where we deliberately differ are listed in the test with the reason. New: it flags the reduced User-Agent that Chromium browsers send (fixed NNN.0.0.0 versions, Windows NT 10.0 for Windows 10 and 11, Android 10; K hiding the phone model, macOS capped at 10.15.7) and explains what the string cannot tell you; it recognises 75 crawler, AI bot (GPTBot, ClaudeBot, PerplexityBot and others), link preview, scanner (sqlmap, Nikto, Nmap) and HTTP library signatures, with the operator’s own way to verify a claimed crawler (reverse DNS or a published IP list); and it shows smart TVs and game consoles.
  • FIX HTTP Request Builder: the generated code now runs, whatever you type. The HTTP Request Builder pasted URLs, headers and bodies into the code without escaping them, so a quote, a backslash, a line break or a $ broke the program, and some inputs changed what it did: a curl body starting with @ was read as a file, -X HEAD could leave curl hanging, Python failed on JSON true/null, Go and Ruby strings broke on backticks or a final backslash, and the C# code threw on Content-Type. Every value now goes through the escaping rules of the chosen language, and each of the 8 languages (curl, JavaScript, Python, PHP, Go, Java, C# and Ruby) was tested by running the generated code against a local test server with tricky inputs and checking that the method, URL, headers and body arrived unchanged. Header names that HTTP does not allow are left out with a warning, and line breaks in header values are removed (they could add extra headers). Query parameters now go before a #fragment, a user name and password in the URL become an Authorization: Basic header (fetch refused them), and empty header values are no longer dropped by curl and PHP. Saved requests stay in your browser and leave out the values of headers and query parameters whose name looks like a credential (Authorization, Cookie, anything with key, token, secret, password or session) and any password in the URL.
  • FIX Random Test Data Generator: test data that can never reach a real person or host. The Random Test Data Generator used to make addresses at real mail providers (a generated name at gmail.com can belong to someone), public IP addresses, MAC addresses with real vendor prefixes and random phone numbers that could ring a real line. Every value now comes from a range reserved for this purpose: IPv4 from the RFC 5737 documentation networks, IPv6 from 2001:db8::/32 and 3fff::/20, domains and e-mail under example.com/.net/.org, .example and .test, MAC addresses from the IANA documentation block 00:00:5e:00:53:xx, and phone numbers from the fiction ranges published by NANPA (555-0100 to 555-0199), Ofcom (UK) and the ACMA (Australia). A test checks thousands of generated values against those official lists. Also fixed: user agents mixed parts of different browsers (for example a Firefox start with a Safari ending) and are now well-formed; IPv6 addresses use the RFC 5952 short form; CSV downloads go through the site’s spreadsheet formula guard. A “Where the values come from” panel lists the sources.
  • FIX Compliance Reference Database: GDPR entries checked against the Regulation’s text. Every GDPR article entry in the Compliance Reference Database was compared with the official EUR-Lex text, and 24 entries were corrected. Removed claims that the Regulation does not make: foreign data requests do not have to be reported to the supervisory authority (Art. 48), Art. 72 gives the EDPB Chair no casting vote (the Chair decides only when the Board is split on an Art. 65 dispute decision), research safeguards do not ban decisions about individuals (Art. 89), and Art. 94 says nothing about earlier decisions staying in force. EDPB opinions are no longer called binding: binding decisions come under Art. 65 (Art. 64). Fixed: biometric data is special-category data only when used to uniquely identify a person (Art. 9); a joint controllers’ contact point is optional (Art. 26); the one-month reply deadline for access requests comes from Art. 12(3); the host Member State is liable for seconded staff in joint operations (Art. 62(4)); the four-year term and the supervisory authority rules are in Art. 54 rather than Art. 53; complaints are free of charge under Art. 57(3). Also corrected: Art. 14, 24, 29, 59, 67, 68, 69, 73, 75, 91, 97 and 98.
  • FIX Tabletop Exercise Generator: every MITRE ATT&CK technique checked against MITRE’s own data. Several scenarios in the Tabletop Exercise Generator listed techniques that did not match what happens in them: the leaked cloud bucket cited Resource Hijacking (that is cryptomining), the phishing scenario cited Password Spraying although the password was phished, the e-mail fraud scenario missed the forwarding and hiding rules it describes, and the OT scenario used a tactic name as a technique. Every scenario now lists “tactic — technique (ID)” taken from ATT&CK Enterprise v19.2 and ICS v20.0, and a test checks each one against the official MITRE files. Card payment incidents now point to the card brands via your acquirer (not the PCI council or a QSA), and the DORA and NIS2 references name the articles: DORA Art. 24–25 (testing), Art. 28(8) (exit strategies), NIS2 Art. 21(2)(f). An organisation name typed with HTML in it is now shown as text instead of being inserted into the page (the site’s security policy already stopped any script from running).
  • FIX NIS2 Self-Assessment keeps when each answer was last changed; the Workflows menu link works in the Classic view. The NIS2 Self-Assessment dropped the per-answer “last changed” time whenever the page refreshed its state, so a saved case recorded every answer as never changed and importing a file could not tell which side was newer. The time is now kept, including for answers carried over from the older browser-only save. In the Classic view, the header menu link “Workflows” opened the tools page showing every tool instead of the three workflows; it now opens on the workflows.
  • FIX Swiss FADP Self-Assessment: checked line by line against the Act and the Ordinance. Every item of the Swiss FADP (nLPD) Self-Assessment and the FADP entries of the Compliance Reference Database were compared with the official Fedlex texts (FADP as of 7 July 2025, Data Protection Ordinance as of 1 December 2025). Corrected: data not collected from the person must be explained within one month of receiving it, or at the first disclosure if earlier (Art. 19(5)); breaches must be documented and the documentation kept at least two years (Ordinance Art. 15(4)), which the tool called “not explicit”; the breach notice to the FDPIC lists the Ordinance’s content (time, duration and amounts where possible, contact person); the register exemption is “fewer than 250 employees unless a large volume of sensitive data or high-risk profiling” (Ordinance Art. 24), not “low risk”; the logging duty applies only when preventive measures cannot protect the data (Ordinance Art. 4); a business can itself be fined up to CHF 50 000 where finding the responsible person would be disproportionate (Art. 64). Your saved answers are kept.
  • FIX Subdomain Takeover Checker: verdicts follow the can-i-take-over-xyz list, and the whole CNAME chain is checked. The Subdomain Takeover Checker now uses the services, fingerprints and status of the public can-i-take-over-xyz list (39 services matched by CNAME, up from 20). Each result says whether the service is listed as allowing takeover, as an edge case (GitHub Pages, Heroku, Netlify and others), or as not claimable, so a stale record on a service that checks domain ownership is no longer reported as a takeover. The tool follows CNAME chains up to 8 hops, so a service behind an intermediate name is found. A CNAME target that no longer resolves and is not a known service is now flagged as dangling, because its expired domain could be registered by anyone. A DNS timeout no longer counts as a dangling record. Four fingerprints that had changed (Pantheon, Read the Docs, ngrok, Cargo) were re-checked against the services on 16 October 2026. Verdicts use plain words, and on phones each host is shown as a card.
  • IMPROVE File Signature Identifier: names the exact format and warns about renamed files. The File Signature Identifier now reads the first 64 KiB of a dropped file (it read 64 bytes; still only in your browser, nothing is uploaded) and looks past the magic number: a Windows executable shows PE32 or PE32+, EXE, DLL or EFI image, console or GUI, the CPU (x86, x86-64, ARM64) and whether it is a .NET assembly; an ELF file shows 32/64-bit, executable, shared object or core dump, and the CPU; a ZIP is named as the Word, Excel, PowerPoint, OpenDocument, EPUB, JAR or Android APK file it really is; MP4, QuickTime, M4A, 3GP, HEIC and AVIF are told apart by their brand, WAV, AVI and WebP inside RIFF, and Java class files (with the Java version) from Mach-O universal binaries. When the file name’s extension does not fit the content, for example invoice.pdf that is an executable, a warning says so. The table grew from 62 to 95 signatures, among them Android DEX, Debian and RPM packages, WIM, Chrome extensions, OneNote, Outlook PST, CHM, Photoshop, icons, fonts, VHDX, QCOW, ISO 9660, Windows registry hives, EVTX logs, minidumps, pcap and pcapng captures, LUKS, KeePass and age. The Windows shortcut (.lnk) signature now checks the full 20-byte header, not just its first 8 bytes. Every signature and refinement was checked against libmagic (the engine behind the Unix file command) on 98 real or specification-built files.
  • FIX Port Lookup: IANA registry refreshed, and each service now shows its own transport. Port Lookup now uses the IANA Service Name and Transport Protocol Port Number Registry as downloaded on 15 October 2026 (it was a 15 September copy): 53 entries added, 12 removed and 664 edited (descriptions, references, notes or dates). The tool used to merge the transports of every service on a port, so a port carrying different services on TCP and UDP was wrong: port 514 is shell on TCP and syslog on UDP, yet a search for “syslog” with TCP selected returned 514. Each service now keeps its own transports, a search with a transport selected only returns services that really use it (syslog over TCP gives 601 and 6514), the matched service is shown first with its own transport badges, and the other services on the port list their transports. Services that IANA registers for a whole range were missing, so 248 numbers showed as unassigned: X11 on 6000–6063, IRC (ircu) on 6665–6669, FLEXlm on 27000–27009 and others now show the service and the range. Numbers IANA marks as Reserved now show its note (for example “De-assigned on 2025-02-13”). The data is checked against the registry file by an independent script: 6,510 port numbers and 6,673 services, no difference.
  • CONTENT Certifications: every exam fact checked against the certification bodies’ own websites. All 41 certifications on the Certifications page were checked field by field (price, duration, questions, pass mark, validity, experience, renewal, retake rules) against ISC2, ISACA, CompTIA, GIAC/SANS, OffSec, INE, TCM, Cisco, AWS, Microsoft, Google Cloud and EC-Council pages: 646 values checked, 219 were wrong or out of date and are corrected (study guides written for a retired exam are now marked as such). Renamed or replaced exams now carry their current names: CASP+ is CompTIA SecurityX (CAS-005), CyberOps Associate is CCNA Cybersecurity, AZ-500 was retired on 31 August 2026 and replaced by SC-500, and CySA+ moved to CS0-004. ISC2 exams are shorter adaptive exams again (CISSP 3 hours, 100–150 questions) and are taken at test centres only; ISC2’s free CC program closed to new enrollees on 20 May 2026. Passing OSCP now also gives OSCP+, which expires after 3 years. GIAC attempts cost $999 and several pass marks changed; INE’s eCPPT is now a fully practical, auto-graded exam (INE does not publish its duration or pass mark, so those now say so). Euro prices are shown only where the body publishes one (ISC2, CompTIA, AWS); the others were our own conversions and are gone.
  • SITE Privacy notice checked against how the site really works. The privacy notice was compared with the code and the server settings, and corrected: the “last updated” date is now the real date of the last change (it showed today’s date on every visit); fonts are no longer downloaded at all (pages use your system fonts); the session cookie is described as what it is (security tokens for the tools’ forms, 30-minute inactivity timeout); the rate limit’s salted IP hash, the firewall blocking of probing addresses, the drafts and saved work some tools keep in your browser, and the offline cache are now listed; access logs are kept about two weeks (it said 14 days); the misleading “DORA compliant” claim is gone; and a new “Your rights” section explains access, deletion and objection under the GDPR and where to complain. The table of outside services now lists every server each tool really contacts: for example the Phishing Checker’s visit to the site you check, the reverse DNS lookup in IP Geolocation, and the HTTP request of the CAA & HSTS Preload Checker. Cached certificate-log answers, which are named after the domain searched, are now deleted once they are older than a day, the next time someone runs a new certificate search (they were kept indefinitely). The service worker line now says what it really stores: style sheets, scripts, images and an offline notice, not pages.
  • IMPROVE IP Geolocation: the WebRTC leak check runs only when you click. The check in IP Geolocation asks a public STUN server (Cloudflare) which address it sees, straight from your browser, so Cloudflare receives your IP address. It used to run as soon as the page opened; it now waits for “Run WebRTC check”, says what it contacts, and can be run again (for example after you connect a VPN).
  • FIX RSS Hub: every source checked, old cached copies now say how old they are. All 37 sources of the RSS Hub were fetched from our server: 36 answer with a readable feed. Nine had moved (Red Hat, Fortinet, SecurityWeek, Malwarebytes, CrowdStrike, Google Security Blog, GitHub Security Lab, CERT Polska, NCSC-FI) and are now read from their new address directly. CISA Cybersecurity Advisories refuses requests from our server (HTTP 403), so the page has been showing its last good copy, from 18 September; the notice above a cached copy said only “cached at 22:20 UTC”, which read as today. It now gives the date, how many days old the copy is and why the source was not read (refused, no answer, or not a readable feed), and the source list in My feed adds the age too.
  • FIX Classic view: the header fits the screen again. Since the switch to your device’s system fonts on 14 October, the header of the Classic view was wider than the window on desktop screens from 1024 to 1440 pixels, so pages scrolled sideways and the last buttons were cut off. Search is now a compact icon button (its name is still read out, and Ctrl+K still opens it), and the switch back to the Dashboard view lives in the Tools menu and the footer. Checked at nine widths from 861 to 1920 pixels.
  • IMPROVE A “next step” box on the Phishing Simulator and the PGP Key Lookup. After the Phishing Simulator, a short box points to what helps with a real message: the Phishing Link Checker, the Email Header Analyzer, the recovery guide for when you already clicked, and the Training Labs; the end-of-level screen links the first two as well. The PGP Key Lookup now ends with the PGP keys guide (how to check a key before trusting it), the GPG and GPG & age cheat sheets, and the guide to keeping a private key on a security key.
  • IMPROVE HMAC Generator: empty secret keys work; Cipher Decoder checked against reference implementations. The HMAC Generator now computes an HMAC with an empty secret key, which RFC 2104 allows (keys shorter than the hash block are padded with zero bytes) but browser Web Crypto refuses; the result matches Python’s hmac module for SHA-1, SHA-256 and SHA-512, and a note reminds you that real signatures need a secret. In the Cipher Decoder, Bifid, Trifid, Hill, Nihilist, Porta, Four-square, Two-square, ADFGX, ADFGVX, columnar transposition, Base45, Ascii85, Base32, Plus Codes and quoted-printable were checked against published worked examples and independent implementations: all correct. Its 227 codec tests now run on every release check (they were not part of it).
  • FIX Meeting Time Zone Converter: right offsets on the meeting date, real clock-change notes. In the Meeting Time Zone Converter, the UTC offset on each city card is now the offset on the meeting date; before, it was today’s, so a December meeting in London showed UTC+1 in October. The vague “more than 2 weeks away” notice is replaced by the actual clock changes between now and the meeting, per city, with the date (the US and Europe change on different weekends, so the gap between them moves for a few weeks). A time that does not exist in your timezone (clocks jump forward) or happens twice (clocks go back) is now flagged; a repeated time uses the first occurrence, as the Timestamp Converter does (it used the second). Best meeting windows now check the whole one-hour meeting, in 15-minute steps: before, only the start was checked on the hour, so a 17:30 start in India counted as business hours though it ends at 18:30. If your browser’s timezone is not in the city list, the menu now shows it instead of another city. Checked against Python zoneinfo for every zone in the city list and every 2024 clock change (4,126 wall times, 122 offset changes, 192 window cases).
  • FIX QR Code Generator: Wi-Fi, email, phone and SMS codes in the formats phones expect. In the QR Code Generator, an open Wi-Fi network is now written as T:nopass with no password field (it was an empty type, which some phones refuse). Email codes follow RFC 6068: characters like & and ? in the address are encoded, empty subject and body are left out, and line breaks in the body are written as CRLF. Phone and SMS numbers drop spaces, which RFC 3966 does not allow, service codes such as *123# work (the # is encoded), and a number with letters now shows an error instead of a broken code. An invalid entry also hides the previous code, so you cannot scan one that no longer matches. Missing fields (no network name, no password for a secured network, no email address) now say what to fill in. The code now has the 4-module light margin that ISO/IEC 18004 requires (it had 1), so it scans reliably when printed next to other content or on a coloured background.
  • FIX .htaccess Generator: tested in a real Apache, four fixes. Output from the .htaccess Generator was loaded into Apache 2.4 in 312 option combinations (both the 2.4 and the 2.2 syntax) and checked with real requests: no errors, and the redirects, blocks, headers, caching and compression did what the options say. Four things did not, and are fixed: browser caching and compression now also cover JavaScript served as text/javascript, the type current servers use (RFC 9239), and icons served as image/vnd.microsoft.icon; before, those files got neither. “Add trailing slash” no longer redirects a missing file such as /old.html to /old.html/, so it gets your 404 page. Image hotlink protection now always allows your own site; before, with no extra domains entered, your own pages lost their images. And /.well-known without a final slash is no longer blocked by the dotfile rule. Also: a Permissions-Policy that lists an origin in quotes now comes out as a valid header, and a custom rewrite rule ending in a backslash no longer swallows the next line.
  • FIX Phishing Simulator: corrected facts, real NIST Phish Scale, readable colours. The phishing simulator now shows the NIST Phish Scale as NIST defines it (Least, Moderately to Least, Moderately, Very difficult; NIST TN 2276), only for phishing messages, instead of an invented 1 to 5 scale. Explanations were checked against official sources and corrected: asking for an MFA code is real-time phishing, not MFA fatigue; BEC is among the costliest cybercrimes (second to investment fraud in the FBI IC3 2024 report); FedEx asks for reports at abuse@fedex.com; Microsoft consent and Teams link advice brought up to date. Text and buttons now meet contrast guidelines in both views, links inside a simulated message no longer jump to the top, and the simulator and the phishing field manual each have a page heading and are listed in the sitemap. Also fixed: the score badge now updates right after a legitimate message, keyboard and screen reader focus moves to the new scenario and then to the feedback, and the feedback is announced once instead of twice.
  • FIX PDF Scanner: “opens another document” is no longer reported as sending data. In the PDF Scanner, a PDF that links to another document (a GoToR or GoToE action) or fills its form from a file (ImportData) was listed under “Sends data out” as “Can send what you type to” that file, which is not what those actions do; only a form submission sends data. They are now listed as what they are, under Links. A PDF that opens a document on a web server or a network share by itself when you open it is now flagged: if your PDF reader follows it, the owner of that server can tell that the file was opened, and a network share can leak your Windows sign-in hash. In the Actions table, the colour of each action now matches its weight in the result.
  • FIX MAC Address Lookup: every IEEE registry, right countries, well-known addresses. The MAC Address Lookup now searches all of IEEE’s public registries, not only the 24-bit one: 18,446 smaller vendor blocks (28-bit MA-M, 36-bit MA-S and the older IAB) and 221 Company IDs. Before, an address in one of those blocks came back as “IEEE Registration Authority” instead of the real vendor. The vendor country was wrong for 1,042 vendors, because it was guessed from a squashed address line where Dutch postcodes like “5633 AD” read as Andorra; it now comes from the country line of IEEE’s own records, and countries show their full name. The data is refreshed (195 new vendor prefixes). Multicast addresses now name the vendor behind them, and well-known addresses are explained: broadcast, IPv4 and IPv6 multicast, Spanning Tree, LACP, 802.1X, LLDP and VRRP. You can also enter only the first 6 hex digits to look up a prefix. 3,100 sample addresses were checked against answers built directly from IEEE’s files.
  • FIX VRAM calculator: right KV cache for DeepSeek, right GPU sizes. In the VRAM tab of the Token Counter, DeepSeek V3 and R1 now use their Multi-head Latent Attention cache: one compressed vector of 576 values per layer and token (DeepSeek-V2 paper; V3 config.json), not a full key and value per head. At 8,192 tokens with a 16-bit cache, their KV cache estimate drops from 30.5 GB to 549 MB. A new “MLA latent size” field lets you enter it for other models. GPU names now match NVIDIA’s spec pages: the RTX 5090 has 32 GB (it was grouped with the 24 GB RTX 4090), and the 16 GB card is the RTX 4070 Ti SUPER (the plain 4070 Ti has 12 GB). The “smallest GPU that fits” now really picks the one with the least memory; before, it took the first in list order, so a 15 GB model got an 18 GB Mac instead of a 16 GB card. The model shapes of all 20 presets were checked against their config.json files on Hugging Face.
  • FIX ICS Calendar Generator: right time in every time zone. In the ICS Calendar Generator, the time you type is now read in the time zone you choose. Before, choosing UTC, or using the Google Calendar and Outlook buttons, read it in your browser’s own zone, so the event could be hours off. Files now include the time zone rules (VTIMEZONE) that the iCalendar standard requires, so Outlook and other apps place the event correctly. A repeat that ends on a date now keeps its last occurrence in zones west of UTC. An end before the start, a missing date or time, or an invalid number of occurrences is now pointed out, and the file and calendar buttons wait until it is fixed. An event that runs across a clock change now gets the rules for its end too. The time zone rules were checked against Python’s time zone database in 448 zones, for open-ended repeating events starting in 8 sample years from 1998 to 2024 and checked up to 2040; with the same database version on both sides they matched in all of them.
  • FIX NATO Phonetic Converter uses the official spellings. The NATO Phonetic Converter now writes Alfa and Juliett, as in the ICAO alphabet, instead of Alpha and Juliet. All 36 letter and digit words were checked against the ICAO table in FAA Order JO 7110.65 (2-4-16).
  • FIX security.txt Generator refuses http:// links. The security.txt Generator now reports an error for any http:// link, including in Contact, where it was accepted before: RFC 9116 says web links in every field must start with https://. A value with a space in it is also reported, since a URI cannot contain one.
  • IMPROVE URL Parser warns about deceptive links. The URL Parser now flags a user name or password before @ (the link really goes to the host after it), shows the readable form of punycode (xn--) domains and calls out names that mix Latin with Cyrillic or Greek letters, and spots hosts written as odd numbers such as 0x7f.1 or 2130706433. Defanged links like hxxps[:]//example[.]com are accepted. Punycode decoding was checked against Python on 3,000 domain labels.
  • FIX HTTP status codes checked against IANA. All 62 codes in the HTTP Status Code Reference were compared with the official IANA registry: all are registered under the same names. 510 Not Extended is now marked obsolete, as IANA lists it, and 418 is described as reserved rather than a working code (RFC 9110; IANA lists it as unused).
  • IMPROVE UUID Generator accepts the URN form. The UUID Generator validator, and the custom namespace for v5, now accept urn:uuid:… as well as plain, braced and no-dash UUIDs. v5 results were checked against Python’s uuid module on 2,000 names.
  • IMPROVE Timestamp Converter: clearer errors. In Timestamp Converter, an error no longer leaves the previous result on screen, a value too large for the chosen unit says so, and changing the unit converts again straight away. 1 January of year 1 is no longer a year off in named time zones.
  • FIX Timestamp Converter: exact around clock changes. In Timestamp Converter, “Date to Unix” now handles daylight-saving changes correctly: a time skipped in spring (such as 02:30 in New York on 10 March 2024) moves forward to summer time instead of an hour back, and a repeated autumn hour gives its first occurrence. Dates that do not exist, such as 31 April, are refused instead of rolling over. The Timestamp Unit menu now works (it was ignored), with microseconds and nanoseconds added, and ISO 8601 results include the time zone offset. Checked against Python’s time zone database on 984 cases in 14 zones.
  • FIX CSV Converter keeps numbers as numbers. In CSV Converter, with the CSV-injection guard on, plain numbers such as -5 or +3.2 are no longer prefixed with a quote, so they still add up and sort in a spreadsheet. Cells that could run as a formula, such as =SUM(A1) or -1+cmd, are still made safe.
  • SITE Easier to read and tap. In Risk Matrix Builder, the score in Critical cells now uses full-strength text, so it is readable on the red fill. Reference links in CVSS 4.0 Calculator, Prompt Injection Playground and other tools now sit a little further apart, so they are easier to tap on a phone.
  • SITE Two small screen-reader fixes. The “Page not found” page now puts its message and links in the page’s main region, so assistive technology can jump straight to them. In PGP Key Lookup, the box that shows a found key’s armored text now has a name screen readers announce.
  • FIX PGP Key Lookup: a found key now shows only its own details, and says when it is revoked. When a keyserver returned several keys for one address, the user IDs and subkeys of the other keys were listed under the first key’s fingerprint; now only the first key’s own parts are shown (the notice about the other keys stays). Expiry, capabilities and dates now come from the key’s own newest signature instead of whichever signature came first, so a certification by someone else no longer makes a key look like it never expires or its user ID look revoked. A key its owner has revoked is now marked Revoked with a warning.
  • FIX CSV and TSV exports are safe to open in a spreadsheet, on every tool. A cell that starts with =, +, - or @ can run as a formula when the file is opened in Excel, LibreOffice or Google Sheets. Exported data often comes from outside (link text on a scanned page, DNS records, scan results), so a hostile value could create a misleading link or pull data out of the sheet (“CSV injection”). Many tools already guarded against this; now all of them do, including the Phishing Checker link and report exports, the shared export buttons and the GRC hub exports. Such cells get a leading ' so the spreadsheet shows them as plain text; numbers such as -5 are left as they are. Re-importing an export into the same tool removes the quote again. In the CSV/TSV Converter the guard is now on by default and can still be switched off.
  • FIX PGP Key Lookup, Inspect a key: certifications by other people no longer change what the key says. When someone else had signed a user ID, their signature could be read as the key’s own: an expiring key showed “never”, its capabilities were blank, and if that person later withdrew their signature, the user ID was marked revoked. Expiry, capabilities, primary user ID and dates now come only from the key’s own signatures. Fingerprints were not affected.
  • IMPROVE The design switch now reads “Classic view / Dashboard view”. The newer design was labelled “New view”; it is now called “Dashboard view”, which says what it is. Only the name changed: both designs look and work as before, and your saved choice is kept.
  • NEW RSS Hub: filter by hashtag and build your own feed. Type words such as RCE, Linux or ransomware to show only the items that mention them, highlighted in the list (vuln also finds “vulnerability”, and remote-code finds “remote code”); start a word with a minus (-sponsored) to hide items instead, and choose whether an item needs any or all of your tags. My feed combines up to 10 sources in one list, newest first, and shows a story published by several sources once, naming the others. If one source fails you see why and can retry it; a source that is down shows its last saved copy. The Sophos feed, which had moved, works again. Filtering happens in your browser, so your tags are never sent to us. Your tags and sources can be kept in this browser if you allow it, shared as a link, and exported with the list.
  • FIX Regex Tester: the first check after opening the page could wrongly say "Stopped after 2 seconds". On a slow connection the background helper that runs your pattern took longer than 2 seconds just to load, and that time was counted against your pattern. The 2-second limit now starts only once the helper is ready.
  • IMPROVE Regex Tester: redesigned around two clear jobs. Check a pattern colours each part of your regex, says right away whether it is valid (or exactly where it breaks), explains every part in plain words, and highlights and numbers each match in your text. Results have tabs for Matches, Replace, Split and Code, where the pattern is ready to copy for JavaScript, Python and Splunk, with a warning when something does not carry over. Find a pattern works the other way: list examples it should match and near misses it should skip, and it suggests up to three patterns. Each one shows how many of your examples it really catches and skips. Everything still runs in your browser, and a slow pattern is stopped after 2 seconds so the page never freezes. Testing several patterns at once is now under Advanced, and old share links still open. The Arrange option (hiding and moving panels) was removed with the new fixed layout; tell us if you miss it.
  • NEW Tools now keep your unsaved work if you close or reload the tab. What you type in a tool is kept in this tab and offered back with Restore or Discard when you return. If you allow it, work is also kept in this browser for up to 7 days, so it survives closing the browser. Drafts are encrypted on your device, never leave it, and anything that looks like a password, key or token is never saved. Tools built for secrets (password generator, AES encryptor, JWT decoder and others) do not autosave at all. On Your local data you can delete all drafts or lock them with your own passphrase.
  • NEW Regex Tester: build a pattern from blocks. Under the pattern field, Build with blocks shows the selected box as small colour-coded blocks — characters such as \d or \w, sets like [a-z], repeats (+, *, {n,m}), positions (^, $, \b) and groups. Click a block to add it after the selected one (or drag it into place), then change, move, nest or remove it; each block says in plain English what it matches, and a repeat with nothing to repeat is flagged. The blocks and the pattern text stay in sync both ways: typing a pattern turns it into blocks, and parts the builder does not model are kept exactly as typed. Also fixed: a long pattern in a box no longer makes the page scroll sideways on phones.
  • IMPROVE Regex Tester: safer share links and better accessibility for pattern boxes. Opening a share link no longer replaces the boxes you saved in this browser: the shared boxes are shown as a preview and you choose Keep shared boxes or Back to my boxes. A share link pasted into a tab that already has the tester open now loads too. Screen readers now hear each box’s pattern and match count, with one short summary after matching; the box buttons are larger touch targets (44 px). A box that is slow or timed out is no longer re-run while you edit another box, and hovering an error count shows why.
  • NEW Regex Tester: pattern boxes and a movable layout. Test several patterns on the same text at once: each box has its own pattern, flags and colour, a live match count, and highlights its matches in that colour (text matched by more than one box gets a dashed outline; hover it to see which boxes). Add up to eight boxes, switch each on or off, reorder them by dragging or with the arrow buttons, and select a box to edit it, replace with it, split with it or have it explained. Arrange layout lets you move panels, hide the ones you do not need and, in the classic view, use two columns. A share link carries your patterns (never your test text), and if you allow local saving your boxes and layout are kept in this browser only.
  • SITE The site now uses your system’s own fonts and PNG icons, so corporate proxies have nothing to block. Some company filtering proxies return 403 for web-font files (.woff2) and SVG images. The earlier fallback kept pages legible, but the browser still requested the blocked files, so errors stayed in the console and the offline cache could fail to install. Pages now download no web fonts at all (headings, body text and code use the operating system’s sans-serif and monospace fonts), and the favicon and logo are PNG/ICO instead of SVG.
  • SITE CyberRamen is now English only. The French and German versions of the GRC pages and the language menu have been removed, so every page has one version that is kept accurate. Old /fr/ and /de/ links still work: they now open the matching English page.
  • FIX CSV and Markdown downloads now work across the GRC generators. The CSV and Markdown export buttons (where a tool offers them) on the GRC generators — the Evidence Request List, the Board Reporting Pack, the Risk Register, the NIST CSF 2.0 self-assessment, the DORA gap tool and the crosswalk, policy-template and regulatory-calendar generators — now produce their files correctly. They had stopped responding on these pages; the Excel and PDF exports were unaffected. Everything still runs in your browser.
  • NEW The Evidence Request List Generator now works natively in French and German. The ERL generator is available at /fr/grc/evidence and /de/grc/evidence alongside /en/grc/evidence: the framework picker, the full catalogue of 94 evidence items (each item’s name and description), the evidence type / owner / freshness / accepted-format labels, the review table, the client cover letter and the CSV / Excel / Markdown / PDF exports all follow the page language. Framework names use the official EUR-Lex wording for legal acts — for example DORA — règlement (UE) 2022/2554 and NIS2 — Richtlinie (EU) 2022/2555 — with every act number kept exactly as published, and the catalogue terminology follows DORA/NIS2 usage (ICT → TIC / IKT, management body → organe de direction / Leitungsorgan). CyberRamen’s own wording carries a discreet “translation under review” note until a native speaker has checked it. Everything still runs in your browser and the English page is unchanged.
  • NEW The Board Reporting Pack now works natively in French and German. The board-pack generator is available at /fr/grc/board-pack and /de/grc/board-pack alongside /en/grc/board-pack: the inputs, the auto-drafted executive summary, the data-source detection, the snapshot list and the generated pack’s section headings and tables (CSF 2.0 maturity, DORA gaps, top risks, upcoming regulatory milestones, maturity trend) all follow the page language, as do the PDF / Markdown / Excel exports. The 27 regulatory-calendar milestones shown in the pack use the official EUR-Lex French and German wording for legal acts — for example DORA entre en vigueur / DORA tritt in Kraft, règlement délégué (UE) 2024/1774 / Delegierte Verordnung (EU) 2024/1774, délai de transposition / Umsetzungsfrist — while every act number is kept exactly as published. CyberRamen’s own wording carries a discreet “translation under review” note until a native speaker has checked it. The report-cover field labels in the shared PDF engine stay English for now; everything still runs in your browser and the English page is unchanged.
  • NEW The Risk Register now works natively in French and German. The ISO/IEC 27005-aligned risk register is available at /fr/grc/risk-register and /de/grc/risk-register alongside /en/grc/risk-register: the 5×5 likelihood and impact scales, the inherent vs. residual heatmaps, the four risk treatments, the status lifecycle, the ENISA-derived threat catalogue, the optional FAIR-lite Monte-Carlo panel, the CSV import wizard and the Excel / CSV / Markdown / PDF exports are all shown in the page language. The risk vocabulary is CyberRamen’s own editorial wording — generic ISO/IEC 27005 risk terms and an ENISA-paraphrased threat taxonomy, not verbatim law — so, for example, the treatments read Atténuer / Mindern, Transférer / Übertragen, the top threat is Rançongiciel / Ransomware, and ICT is written TIC / IKT for DORA consistency. The stored record values (threat, treatment and status identifiers) are kept as their canonical English strings so a register exported in one language re-imports unchanged in another. All of this carries a discreet “translation under review” note until a native speaker has checked it. Everything still runs in your browser; the English page is unchanged.
  • NEW The NIST CSF 2.0 Self-Assessment now works natively in French and German. The maturity self-assessment is available at /fr/grc/csf-assessment and /de/grc/csf-assessment alongside /en/grc/csf-assessment: all six Functions and 22 Categories, the 0–4 maturity tiers, the radar chart, the per-Category results table and the CSV / JSON / Excel / PDF exports are shown in the page language. The Function, Category and Tier names use the official NIST CSF 2.0 French and German translations (NIST CSWP 29) — for example Gouverner / Governance, Récupérer / Wiederherstellen, and the tiers Partiel / Informé sur les risques / Répétable / Adaptatif and Teilweise / Risikoinformiert / Wiederholbar / Anpassungsfähig. The canonical Category identifiers (GV.OC, PR.AA …) and the name “NIST CSF 2.0” are kept exactly as published. CyberRamen’s own wording carries a discreet “translation under review” note until a native speaker has checked it. Everything still runs in your browser; the English page is unchanged.
  • NEW The DORA Engine now works natively in French and German. The DORA applicability & proportionality checker is available at /fr/grc/dora-engine and /de/grc/dora-engine alongside /en/grc/dora-engine: the Article 2 entity catalogue and Article 2(3) exclusions, the in-scope / simplified (Art. 16) / out-of-scope verdict and its reasoning, the Level 1 and RTS control summaries, the major-incident classification thresholds and reporting clock, and the threat-led penetration testing (TLPT) scoping are all shown in the page language, as are the exportable outputs. Legal terminology was checked against the official EUR-Lex French and German texts of Regulation (EU) 2022/2554 — for example établissement de crédit / Kreditinstitut, organe de direction / Leitungsorgan, autorités compétentes / zuständige Behörden, and ICT as TIC / IKT — and every article, regulation and threshold number (Arts. 2, 4, 5–30; the 4h / 24h / 72h / one-month deadlines) is kept exactly as published. CyberRamen’s own wording is translated and carries a discreet “translation under review” note until a native speaker has checked it. The Register of Information editor (tab 3) stays in English for now; everything still runs in your browser and the English page is unchanged.
  • IMPROVE The language switcher is now visible in the default view and opens as a dropdown. The control that switches a page between English, French and German was previously only in the classic header, so visitors on the default (“New view”) layout had no way to change language. It now also sits in the left sidebar, next to the Classic / New view switch, on every page and in the mobile menu. On both layouts it is now a compact dropdown (a globe and the current language) that expands to the full list, instead of the languages sitting side by side — so it stays tidy as more languages are added. Each option is still a real link search engines can follow, the current language is marked, and a language a page has not been translated into yet is greyed out and points to that language’s home. Nothing about the pages themselves changed.
  • NEW The NIS2 Engine now works natively in French and German. The NIS2 applicability checker and Article 21 risk-management self-assessment is available at /fr/grc/nis2-engine and /de/grc/nis2-engine alongside /en/grc/nis2-engine: the sector list, the essential/important verdict and its reasoning, every Article 21 question and recommended action, the Article 23 reporting timeline and the exportable gap report (Markdown and CSV) are all shown in the page language. Legal terminology was checked against the official EUR-Lex French and German texts of Directive (EU) 2022/2555 — for example incident important / erheblicher Sicherheitsvorfall, alerte précoce / Frühwarnung, entité essentielle/importante / wesentliche/wichtige Einrichtung — and the article references (Art. 2, 3, 20, 21, 23) are kept exactly as published. CyberRamen’s own question wording is translated and carries a discreet “translation under review” note until a native speaker has checked it. Everything still runs in your browser; the English page is unchanged.
  • IMPROVE The GRC hub’s live overview and section tabs now follow the page language. On /fr/grc and /de/grc, the interactive “Overview” panel the hub builds from the work you have saved in your browser — readiness rows, the CSF tier summary, the open-risk breakdown and the suggested next steps — and the section tab labels (Start here, Overview, Assess, Reference & learning, Reporting, Engagement checklist) are now shown in French and German, matching the rest of the hub. Regulation and product names (NIS2, DORA, RTS 2024/1774, NIST CSF 2.0, Risk Register, Board Pack) are kept as published. Everything still runs in your browser; no data leaves the page, and the English hub is unchanged.
  • NEW The GRC hub landing page is now in French and German. The entry page to the GRC (governance, risk & compliance) area — its how-to-use guide, the tool catalogue and the engagement checklist — is now available at /fr/grc and /de/grc alongside /en/grc, with the header language switcher greying out pages not yet translated. Regulation names and legal references (DORA, NIS2, GDPR — shown as RGPD in French and DSGVO in German — CRA, and the article and CELEX numbers) are kept exactly as published by the EU; the hub’s own explanatory copy is translated and carries a discreet “translation under review” note until a native speaker has checked it. Product names (NIS2 Engine, DORA Engine, Risk Register, Board Pack, Crosswalk) stay in English. The English page is unchanged, and the individual GRC tools behind the hub are still English for now — more GRC pages will follow one at a time.
  • NEW The GRC section is starting to speak French and German. The GRC (governance, risk & compliance) area is being made usable in French and German for European teams, beginning with one page: Methodology & Sources is now available at /fr/grc/methodology and /de/grc/methodology, with a language switcher in the header that greys out languages a page is not yet translated into. The regulation names and legal references (NIS2, DORA, GDPR and their CELEX numbers) are kept exactly as published by the EU and are never machine-translated; CyberRamen’s own explanatory text is translated and carries a discreet “translation under review” note until a native speaker has checked it. The English pages are unchanged, and the technical Blue Team tools stay in English for now. More GRC pages will follow one at a time.
  • FIX Placeholder text in tool input fields is now easier to read. Several tool inputs — such as the Glossary filter and the Colour Converter field — had no explicit placeholder colour, so they fell back to the browser default grey, which measured only about 3.8:1 against the site’s cream fields and fell short of the 4.5:1 minimum in WCAG 2.2 (Success Criterion 1.4.3, Contrast). Input placeholders now use the site’s muted-text colour (about 5.5:1 on those fields) in both light and dark mode, so the hint text is legible for everyone. Only the placeholder colour changed; the fields and what you type are unaffected.
  • IMPROVE Copy buttons are now full-size tap targets. The small “Copy” buttons used across the tools — beside each generated password and passphrase, next to the colour values in the Colour Converter, and in several other tools — were about 22 pixels tall, below the 24-pixel minimum of WCAG 2.2 (Success Criterion 2.5.8, Target Size) and the 44-pixel touch target the rest of the site already uses. They are now 44 pixels tall everywhere, matching the toolbar buttons (Clear, Upload File, Load Sample) that were already that size, so they are easier to tap on a phone. Only the button height changed; the copy action, the labels and the surrounding layout are unchanged.
  • FIX MAC Address Lookup: the vendor icon no longer mis-matches look-alike names. The MAC Address Lookup picked the small vendor icon by checking whether the manufacturer name contained a known brand, so a registry name such as "Telematica Sistems Inteligente" matched "Intel" (inside "Inteligente") and showed the laptop icon, and names like "Intellinet" or "Delloro" matched "Intel"/"Dell" the same way. The brand is now matched as a whole word, so those names get the neutral default icon while genuine entries ("Intel Corporate", "HP Inc.", "TP-Link Corporation") keep theirs. The vendor name, country and all lookups are unchanged — only the decorative icon was affected.
  • FIX User-Agent Parser: Samsung Internet is no longer mis-reported as Chrome. A Samsung Internet user-agent always contains a Chrome/ token as well as SamsungBrowser/, and the User-Agent Parser checked for Chrome before Samsung, so every Samsung Internet string was reported as "Chrome" and the Samsung branch never ran. The Samsung check now runs before Chrome (as the Edge and Opera checks already do), so a Samsung Internet UA is correctly identified as "Samsung Browser" with its version. Chrome, Edge, Firefox and other browsers are unaffected.
  • IMPROVE SRI Generator: the single integrity value now uses the strongest selected hash. When several hash algorithms were ticked in the SRI Generator but the "all in one attribute" option was left off, each result showed one integrity value — and it was taken from the weakest selected algorithm (sha256) rather than the strongest. A lone integrity attribute should carry the strongest hash available, so the tool now shows the strongest of the selected algorithms (for example sha512 when sha256 and sha512 are both ticked). The hash values themselves were always correct, and the combined (space-separated) mode is unchanged. Selecting a single algorithm — the default sha384 — is unaffected.
  • FIX CSR Generator: IPv6 addresses are now accepted in Subject Alternative Names. An IP: SAN in the CSR Generator & Decoder was parsed as four dot-separated numbers, so an IPv6 address such as IP:2001:db8::1 was silently mangled into a one-byte, invalid iPAddress value, and an out-of-range IPv4 octet (for example IP:999.1.2.3) was emitted unchecked. IP SANs are now encoded as the raw address octets required by RFC 5280 — four octets for IPv4, sixteen for IPv6 (with :: compression and embedded-IPv4 forms handled) — and an invalid address is rejected with a clear message instead of producing a broken CSR. The decoder renders a 16-octet iPAddress back as a canonical IPv6 literal. DNS SANs and the rest of the CSR are unaffected; the encoding is unit-tested against an independent oracle and OpenSSL accepts the generated requests.
  • FIX PGP Key Lookup: version-6 signatures are now read correctly. When the PGP Key Lookup parsed a key carrying an OpenPGP version-6 signature (RFC 9580), it read the length of the signed (hashed) subpacket area as a 2-octet number as in v4, but v6 uses a 4-octet length. The parser therefore saw a length of zero and skipped every hashed subpacket, so a v6 key's creation time, key flags and expiry were silently dropped. The length is now read as 4 octets for v6 and 2 octets for v4/v5, matching the sibling Key Inspector tool; v4 and v5 keys are unaffected.
  • FIX CSR Generator: ECDSA signatures now use strict minimal DER encoding. When the CSR Generator & Decoder signed a request with an EC key (P-256 / P-384), the signature's two integers (r and s) were emitted at a fixed width, so occasionally one carried a leading zero byte that made it non-minimal — valid per BER (OpenSSL accepts it) but a violation of strict DER (X.690 §8.3.2) that a strict parser could reject. The encoder now strips redundant leading zero bytes while preserving the sign byte, so every generated CSR is strict-DER-clean. RSA CSRs and the decoder are unaffected; the fix is unit-tested against an independent minimal-DER oracle.
  • FIX CIDR / Subnet Calculator: invalid subnet masks are now rejected. The CIDR / Subnet Calculator accepted a dotted mask with non-contiguous bits — for example 255.255.0.255 — and silently counted its bits into a wrong prefix (/24) instead of flagging it. A subnet mask must be a run of 1-bits followed by 0-bits, so such input is now rejected with a clear message, and a /N prefix that is not a number (for example / or /abc) is rejected too rather than producing a blank result. Valid masks and prefixes are unaffected.
  • IMPROVE Risk Matrix Builder: High and Critical risks are now easier to tell apart. On the heat-map matrix and its legend, the Risk Matrix Builder drew High and Critical cells in the same shade of red, so the four severity bands looked like three. Critical now uses a distinctly deeper red — a clear step darker than High — so all four bands (Low, Medium, High, Critical) are distinguishable by brightness, not only hue, which also helps readers with colour-vision differences. Scoring is unchanged.
  • FIX Robots.txt Analyzer: percent-encoded paths are matched correctly. The Robots.txt Analyzer compared the request path against a rule without normalising percent-encoding, so an encoded URL such as /%7Euser and a rule written as /~user (or the other way round) were treated as different paths and could give the opposite allow/block answer. Both sides are now canonicalised per RFC 9309 §2.2.2 — percent-encoded "unreserved" characters are decoded and the rest stay encoded — so the verdict and the "most specific rule" length are accurate.
  • FIX Mod_Rewrite Tester: a slow pattern can no longer freeze the page. The Mod_Rewrite Tester compiled and ran your RewriteRule / RewriteCond regexes on the main thread, so a pattern with catastrophic backtracking (for example ^(a+)+$) against a crafted URL could lock up the browser tab. Evaluation now runs in a terminable background worker that is stopped after 2 seconds, showing a clear "timed out — a pattern is backtracking catastrophically" result instead of hanging. Normal rulesets are unaffected and still show the full step-by-step trace.
  • FIX Risk Matrix Builder: CSV export is protected against formula injection. The Risk Matrix Builder can export your risk register as CSV. A risk title, owner or mitigation that began with =, +, - or @ was written to the file unchanged, so opening the CSV in Excel or Google Sheets could execute it as a formula (a known "CSV injection" risk). Such values are now prefixed with a quote so the spreadsheet treats them as plain text; ordinary fields and the numeric scores are unaffected. The behaviour is unit-tested.
  • FIX MAC Address Lookup: the vendor icon now shows correctly. For a recognised vendor, the MAC Address Lookup displayed the raw text &#127823; instead of the intended icon, because the icon was stored as an HTML character code and written into a plain-text slot that does not decode it. The icons are now the actual characters, so looking up, for example, an Apple address shows an emoji rather than a code. Unknown and randomised addresses were already fine.
  • FIX Password Hash Verifier: LDAP scheme labels are now accurate. The Password Hash Verifier treated any LDAP/RFC 2307 scheme tag starting with "S" as salted, so unsalted {SHA}, {SHA256}, {SHA384} and {SHA512} were wrongly reported as salted and shown with a green "modern scheme" badge — contradicting their own "fast digest, not a password KDF" warning. Only {SSHA} and {SMD5} are now marked salted, and no LDAP digest scheme is labelled a modern/secure scheme, since none has a work factor. Detection and the plain-language assessment are unchanged.
  • FIX User-Agent Parser: parsed values are HTML-escaped in the results. The User-Agent Parser showed the detected device model, brand and engine straight from the user-agent string without escaping, so a crafted string (for example an Android model field containing angle brackets) could inject markup into the results panel. Those values are now escaped before display, matching the already-escaped raw-components list. The site's strict content-security policy already blocked script execution; this closes the output-encoding gap.
  • FIX Log Parser Builder: a slow pattern can no longer freeze the page. Testing a pattern with catastrophic backtracking (for example nested quantifiers like (a+)+) against a long log line could lock up the browser tab, because the matching ran on the main thread and a single line could not be interrupted. The Log Parser Builder now runs matching in a terminable background worker and stops it after 3 seconds, showing a clear "timed out — simplify the pattern" message instead of hanging. Normal patterns are unaffected.
  • FIX Diff Tool: large, very different inputs no longer freeze the tab. Comparing two large blocks of mostly-unrelated text at the character or word level could lock up the browser for many seconds (and crash it on bigger inputs) because the matching algorithm grew with the square of the input size. The Diff Tool now caps that work: when two inputs are too large and too different to compute a minimal diff quickly, it instantly shows the changed section as a single block replacement and tells you so, suggesting the Line level or smaller sections. Ordinary diffs — including large files with scattered edits — are unaffected and still minimal.
  • FIX Markdown Preview: stronger, allow-list HTML sanitizing. The Markdown Preview rendered and exported HTML after scrubbing it with pattern-matching, which determined attackers can slip past. It now parses the rendered HTML and keeps only a safe allow-list of tags and attributes, dropping scripts and event handlers and checking every link and image address, so the preview and the Copy HTML / Download HTML output are genuinely safe to reuse elsewhere. The sanitizing rules are unit-tested.
  • FIX STIX Formatter: identity class values match the final STIX 2.1 vocabulary. The producer identity_class selector in the STIX 2.1 Formatter offered unspecified — a value from a pre-release STIX 2.1 draft that OASIS renamed to unknown before the standard was finalised. It now offers the six finalised identity-class-ov values (individual, group, system, organization, class, unknown), adding the previously missing system (for a SIEM or other automated producer) so strict STIX validators accept the bundle. Verified against the OASIS STIX 2.1 specification.
  • FIX HTTP Status Codes: two names updated to the current IANA registry. The HTTP Status Codes reference now shows 413 Content Too Large and 422 Unprocessable Content — the names RFC 9110 gave these codes and the ones the IANA registry now lists. The former names (“Payload Too Large” and “Unprocessable Entity”) are kept in each entry’s description, so searching for either name still finds the code. Verified against the IANA HTTP Status Code Registry.
  • FIX ICS Calendar Generator: standards-correct files for non-English text and all-day repeats. Three RFC 5545 issues in the ICS Calendar Generator were fixed. Long lines are now folded by octets (UTF-8 bytes) instead of characters, so an event title or description with accents, emoji or non-Latin scripts no longer produces an over-length line or a split character that some calendar apps reject. Text values now strip stray carriage returns, and a repeating all-day event with an end date now emits an UNTIL value of the correct type (a date, not a date-time), which previously made the recurrence rule invalid. The calendar-building logic moved to a tested module verified against an independent oracle (every folded line is now at most 75 octets, and folding round-trips multibyte text exactly). Everything still runs entirely in your browser.
  • IMPROVE UUID Generator: v5 and v7 now work, and the version notes are accurate. The tool advertised UUID v5 but could only generate v4 and v1. It now generates all four: v4 (random), v1 (time-based), v5 (namespace + name, SHA-1 — deterministic, with DNS/URL/OID/X.500 or a custom namespace), and v7 (RFC 9562 time-ordered, so the IDs sort by creation time — a good default for database keys). The v1 generator now uses a random node id with the RFC 4122 multicast bit set (no MAC address is exposed), and the help text no longer claims v1 is sortable (it is not — v7 is). The generator and validator logic moved to a tested module verified against Python’s uuid library and hashlib SHA-1 (the canonical v5 of example.com in the DNS namespace is cfbff0d1-9375-5685-968c-48ce8b15ae17); the validator also recognises v6/v7/v8 and the Nil and Max UUIDs. Everything still runs entirely in your browser.
  • SITE The largest tool category is now three clearer groups. “Dev & Everyday Utilities” had grown to 28 tools — more than double every other category — mixing formatters, web/HTTP tools, file tools and everyday generators in one long list. It is now split into Formatters & Converters, Web, HTTP & Files and Everyday Utilities & Generators, so each category is a short, scannable list. This is a grouping change only: no tool address changed and nothing was added or removed.
  • IMPROVE Local-model VRAM sizing joins the Token Counter. The standalone Local-Model VRAM Calculator is now a third tab — Local VRAM — of the Token Counter, Cost, Context & VRAM tool, so token cost, context-window fit and GPU memory all live in one place. Pick a model preset or enter your own shape, choose a quantization (FP16/Q8/Q5/Q4/INT4), set context and batch, and see the weights + KV-cache + activations breakdown and a fits-on-this-GPU table. The old /en/tools/vram-calculator link now redirects to the VRAM tab. The VRAM arithmetic is verified against an independent oracle and two closed-form anchors (an 8B model at FP16 is 16 GB of weights; the sample KV cache is exactly 1 GiB).
  • IMPROVE New Text Toolkit: case conversion, cleaning and statistics in one tool. The String Case Converter, Text Cleaner & Normalizer and Text Statistics tools are now three tabs of a single Text Toolkit — convert between camelCase, snake_case, kebab-case and URL slugs; strip HTML, remove diacritics and invisible characters, fix whitespace and line endings; and get word/character counts, reading time, word frequency and readability scores. Everything still runs entirely in your browser. The old links (/en/tools/string-converter, /en/tools/text-cleaner, /en/tools/text-statistics) now redirect to the matching tab. The Coleman-Liau readability score was also corrected to count letters only (excluding digits and punctuation) per the published formula, and all six readability formulas are now verified against their standard definitions.
  • FIX Color Converter: out-of-range values no longer break, and rgba()/hsla() now parse. The Color Converter now clamps out-of-range input the way a browser does, so rgb(300, 0, 0) or hsl(400, 150, 150) give a valid color instead of an invalid HEX string. You can now also paste rgba(255, 87, 51, 0.5) and hsla(0, 100%, 50%, 0.3) (the alpha is read and ignored). Every HEX/RGB/HSL/CMYK conversion, the relative luminance and the WCAG contrast ratios are now verified against Python’s colorsys and the published WCAG formulas across a full grid of colors.
  • FIX Unix Permissions Calculator: setuid/sticky and ls -l input fixed. The Unix Permissions Calculator now reads a symbolic string exactly as ls -l prints it. A capital S or T (set-user-ID, set-group-ID or sticky bit without the execute bit, as in rwSr--r--) is now kept distinct from lowercase s/t, instead of being silently treated the same. You can also paste a full listing line with its leading type character — drwxr-xr-x, -rw-r--r--, lrwxrwxrwx — and it parses correctly. Every symbolic/octal conversion is now verified against the system ls algorithm for all 4096 permission modes.
  • FIX Cron Parser: correct next-run times and timezones. The Cron Parser now follows standard cron rules exactly. When both the day-of-month and day-of-week fields are set (for example 0 0 1 * 1), it runs when either matches — the 1st of the month or every Monday — as real cron does. Step values like 5/15 now expand correctly (minute 5, 20, 35, 50), and the “Next 10 Run Times” are now computed in the timezone you select, so a 0 9 * * * job shows 09:00 in that zone rather than a shifted hour. The Clear button no longer errors. All results are verified against the croniter reference engine.
  • CONTENT Four new defensive cheat sheets: AD defense, cloud detection, macOS and mobile forensics. Added quick references for blue-team and DFIR work — Active Directory Defense (tiered admin, LAPS, Protected Users, audit policy and the key event IDs), Entra ID & GCP Detection (sign-in error codes, KQL and gcloud hunt queries, persistence signals and incident response), macOS Forensics (unified log, persistence, TCC, quarantine and APFS acquisition) and Mobile Forensics (iOS and Android acquisition, backup artifacts and analysis tools) — now 99 sheets at /en/cheatsheets. Every command, path and ID was checked against official documentation (Microsoft Learn, Google Cloud, Apple, AOSP, MITRE); offensive / red-team sheets stay on OffensiveRamen.com.
  • FIX Encrypted Link Sharing: accented passphrases open on every device. A passphrase with accents (for example café) is now normalized before the key is derived, so a link made on a Mac opens when the passphrase is typed on Windows, Android or Linux, and the other way round. Spaces or a line break around a pasted passphrase, and line breaks inside a pasted key, no longer cause a failed decrypt. Links made before this change still open.
  • IMPROVE Cookie Analyzer: what each cookie is for. Paste the cookies a site stored in your browser (document.cookie or the Cookie: request header) into the Cookie Security Analyzer to see who sets each one, what it is for (analytics, advertising, login, consent, bot protection) and how long it lasts, with a link to the vendor's own documentation. Names that are not documented are shown as unknown, never guessed. Set-Cookie headers also get the purpose next to their security findings, and the exports include it. Listed in the Privacy Guides.
  • NEW New tool: Tracking Link Cleaner. Paste a link, or a whole message, into the Tracking Link Cleaner to remove utm campaign tags, fbclid, gclid and other ad click IDs, e-mail campaign IDs and share IDs, and to see where Google, Facebook, Instagram, YouTube and Outlook Safe Links redirects really go. Each removed item says who adds it and why. It runs in your browser and never opens the link; short links are flagged, not expanded. Listed in the Privacy Guides.
  • CONTENT Twelve new privacy guides, covering every level and topic. Privacy Guides now has a guide for each threat level in every section. New everyday guides: phone privacy settings, and a read-only script that checks your Linux or Windows privacy posture. New medium-threat guides: compartmentalising identities, encrypting files and containers, hardening account recovery, and following up or escalating a GDPR request. New high-threat guides: Tor Browser at the Safest level, operational security, hardware-backed and offline keys, high-stakes messaging, key-only accounts with end-to-end encryption, and an urgent doxxing takedown playbook. Every step is drawn from official documentation.
  • FIX Log Redactor catches more secrets. Log Redactor now redacts env-style lines such as OPENAI_API_KEY=… and export GITHUB_TOKEN=…, which it used to leave in place, and JSON keys like "client_secret": "…". A new detector, on by default, finds API keys and tokens on their own (Anthropic, OpenAI, GitHub, GitLab, Slack, Stripe, Google, npm, PyPI, Docker Hub and more), and PuTTY key files are redacted like PEM keys.
  • IMPROVE Keyboard use. Sorting a table in Actionable CVEs keeps focus on the column you sorted, and the tabs on the awareness pages (such as Passwords) now also answer Home and End.
  • FIX Accessibility sweep across the site. Low-contrast text fixed on about 20 tools, links inside text are now underlined, scrollable code and preview boxes can be reached with the keyboard, toggle buttons tell screen readers which one is selected, sortable table headers in Actionable CVEs are proper buttons, the hidden second tab on five awareness pages (such as Safe Browsing and Passwords) no longer shows below the open one, and two tools no longer run wider than a phone screen.
  • FIX Accessibility: four older issues fixed. The changelog filter buttons now tell screen readers which one is selected, tool counts on the Tools filter buttons and the offensive-tools link are easier to read, and so is the size note in Encrypted Link Sharing.
  • FIX GRC hub: imported values always shown as text. Risk IDs in the Risk Register and the saved headcount and turnover in the NIS2 Engine are now escaped, so a crafted import file cannot add markup to the page.
  • NEW Three more Privacy Guides. Travel with your phone and laptop covers backups, carrying less data, encryption and what a border inspection can involve. Protect your home network walks through the router admin password, firmware, WPA3, a guest network for smart devices and turning off WPS and UPnP. Privacy check-up for your social media accounts reviews audience, connected apps and data downloads, and links your GDPR rights. Each guide says what it does not protect against and links its official sources.
  • FIX Glossary: long titles fit on phones. Long one-word titles such as Cryptographic hash function and SSVC no longer push the page sideways on narrow screens.
  • NEW New tool: Browser Fingerprint Inspector. The Browser Fingerprint Inspector lists what any website can read about your browser without asking: user agent, languages, screen, time zone, hardware, a canvas drawing hash, WebGL graphics strings, which device APIs exist and whether storage is available. Each value is explained, with a hint that links to the Privacy Guides on how to reduce it. It gives no uniqueness score, because it has no population data. Copy the report or download it as .json; nothing leaves your browser. Also listed in Privacy Guides and linked from the browser hardening guide.
  • CONTENT Eight more Privacy Guides and three glossary entries. New guides: choosing and using a password manager, encrypted backups you can restore, protecting your phone number from SIM swaps, getting your data out of data brokers and e-mail aliases (low threat level); VPN or Tor: which one, when and messaging apps compared (medium); iPhone and Mac Lockdown Mode (high). The glossary adds data subject access request, right to erasure and file metadata, each with a worked example using a site tool. The Privacy Guides page now shows how far you got in each guide's checklist (saved only in your browser).
  • IMPROVE Search finds Privacy Guides. Search now lists matching Privacy Guides above the tools, with their threat level, as you type. The small section labels on tool results are also easier to read.
  • CONTENT Six new Privacy Guides. Privacy Guides now covers full-disk encryption, Signal settings, browser hardening, passkeys and hardware keys (low threat level), and GrapheneOS and Tails (high threat level). Each one says what it protects and what it does not, links the official documentation and shows the date it was last checked.
  • IMPROVE Remove metadata from PDF and Office files. The Strip tab of the EXIF & Metadata Analyzer now also cleans PDFs and Word, Excel and PowerPoint files (.docx, .xlsx, .pptx). It shows the author, company, editing time, software and dates the file holds, removes them, checks the result, and lists what it cannot remove for you (comments, tracked changes, earlier PDF versions). The document content is not changed, and nothing is uploaded.
  • NEW New tool: GDPR Request Generator. The GDPR Request Generator writes a request to see, correct, delete or export your data, or to stop it being used for marketing (GDPR Articles 15, 16, 17, 20 and 21), in English, French or German. It shows the one-month reply deadline and how to complain to a data protection authority. Copy it, download it as .txt or .pdf, or open it in your e-mail app; nothing you type leaves your browser. Also listed in Privacy Guides.
  • FIX Compliance quiz: all CRA, NIS2, DORA and GDPR questions checked. We checked the remaining 1,189 compliance quiz questions on the Cyber Resilience Act, NIS2, DORA (including the incident-reporting rules in Delegated Regulation (EU) 2025/301) and the GDPR against the official text, and fixed 40 of them. Most fixes make an explanation more precise; 14 questions now cite the right article, and a few had wording errors in the question or an answer option. No correct answer changed.
  • FIX Regulatory Calendar: DORA review dates corrected. We checked the Regulatory Calendar against the official text. The January 2026 DORA item is the Commission review of statutory auditors (Article 58(3)), not a general review; the general DORA review (Article 58(1), 17 January 2028) and the date from which Cyber Resilience Act notified-body rules apply (11 June 2026, Article 71(2)) were added. Register of Information dates now say that the national supervisor sets the yearly reporting date.
  • FIX GRC hub: accessibility and sorting fixes. The sortable columns of the Risk Register now use real buttons in their headers, and a click no longer sorts twice after the table has been redrawn. Fields in the Board Pack and NIS2 Engine now have labels for screen readers, wide tables can be scrolled with the keyboard, links inside notes are underlined, and the Crosswalk and NIS2 Engine forms no longer push the page sideways on phones.
  • FIX Compliance quiz: nine answers checked and corrected. We re-checked the 88 compliance quiz questions on DORA Articles 5 and 26, NIS2 Article 21 and GDPR Articles 16, 17, 21 and 32 against the official text. Two cited the wrong article (internal testers are DORA Article 27(2); stricter national rules are NIS2 Article 5) and seven explanations are now more precise. No correct answer changed.
  • IMPROVE GRC hub: a "Start here" guide, and import. The GRC hub now opens with four short paths: find out which laws apply, measure where you stand, track your risks, and prepare an audit or board report. Each path lists the tools to use, in order. It also explains where your work is saved (only in your browser). The new Import engagement button restores an exported engagement on this or another computer, and the export now includes your NIS2 Engine answers.
  • SITE New addresses for three renamed tools, and plain wording everywhere. The Cipher Decoder, Document Watermark and Encrypted Link Sharing now live at addresses that match their names. The old addresses redirect permanently, links already shared from Encrypted Link Sharing keep opening, and your pinned and recent tools follow the new names. Training Labs levels are now Beginner, Intermediate, Advanced and Expert, the Spot the Phish levels and ranks use plain names, and the food-themed phrases on the homepage, the daily set, the tools hub and several tool pages are replaced by plain descriptions.
  • SITE Plain names across the site. Tool categories now show only what they cover (for example Network & DNS or GRC & Compliance), without the food-themed second name. Three tools are renamed after what they do: the Cipher Decoder, Document Watermark and Encrypted Link Sharing. The decorative Japanese labels are gone from headings, menus and the daily set, so every label is readable at a glance. Tool addresses are unchanged.
  • NEW New section: Privacy Guides. Privacy Guides sorts practical privacy guides and in-browser tools by threat level (low, medium or high). Every guide says what it protects and what it does not, links its official sources and shows when it was last verified. Start with Build your threat model: eight steps with a checklist that stays in your browser.
  • SITE MIME types are back in Dev utilities. The File Signature Identifier & MIME Types tool is now listed under both Incident response and Dev utilities on the tools menu, so the MIME lookup is where developers looked for it before the merge.
  • SITE Sitemap refreshed. The sitemap no longer lists the nine tool addresses that were merged into other tools (they redirect), and it now lists the GRC quiz and six SOC and network tools that were missing. It is now built before each release instead of on the server.
  • FIX Follow-ups to the tool merges. The Extract links tab fills its URL field from a ?url= link again, as the old Link Extractor did (nothing is fetched until you press Extract). On phones the ASCII table now scrolls sideways inside its keyboard-focusable frame instead of in an inner box a keyboard could not reach. The Lorem ipsum amount box now shows the right maximum for the chosen unit (100 paragraphs or sentences, 1000 words), and the 100 words preset is back. The Context-window fit table can be scrolled with the keyboard. Site-wide, the “100% client-side” notices no longer split text and links into separate columns.
  • IMPROVE Context-Window Fit Checker is now the Context-window fit tab of the Token Counter & Cost Estimator. One page now answers both questions about a prompt: Cost estimate keeps the per-family token estimates, the editable price matrix and the exports, and Context-window fit shows which model context windows (128k, 1M and more) hold your pasted text or files plus a reserved response budget. A button copies the text from the Cost tab, so you can check fit and price without pasting twice. Both tabs now use the same token estimate, very large files are counted in full instead of being cut off, the file picker is a real button you can reach with the keyboard, and response budgets above 8,000 tokens typed into the number box now count. The old /en/tools/context-window-checker address redirects to the new tab.
  • IMPROVE QR Code Scanner is now the Scan tab of the QR Code Generator. One page now makes and reads QR codes: Generate builds codes for URLs, text, Wi-Fi, email, phone and SMS, and Scan a QR code decodes a dropped, chosen or pasted image in your browser, shows whether it holds a link, gives a defanged copy for tickets and chat, and opens the link in the Phishing Checker with one click (nothing is checked until you press Check there). Large photos are scaled down before decoding so they no longer stall the page. The old /en/tools/qr-scanner address redirects to the new tab.
  • FIX QR Code Generator: the codes it drew could not be scanned. Its built-in encoder computed the error-correction bytes wrongly and never split data into the blocks the QR standard requires, so phones and decoders rejected every code. The encoder is rewritten: every version (1–40) and error-correction level now decodes, test codes match a reference encoder module for module, emoji and other non-Latin text are encoded correctly, and Wi-Fi codes escape special characters in the network name and password. The QR reader used by the Phishing Checker also gained a fix for version-23 codes, which it could not read before.
  • IMPROVE Lorem Ipsum Generator is now the Lorem ipsum tab of the Test Data Generator. One page now makes every kind of filler: Test data keeps the random emails, usernames, IP addresses, domains, UUIDs and more with table, JSON or CSV output, and Lorem ipsum writes paragraphs, sentences or words as plain text, HTML or Markdown, with quick presets and one-click copy. Sentences no longer all open with the same words, and the amount is capped at 100 paragraphs or sentences or 1000 words so a typo cannot freeze the page. The old /en/tools/lorem-ipsum address redirects to the new tab.
  • IMPROVE ASCII Table is now the ASCII table tab of the Binary/Hex/Decimal Calculator. One page now covers numbers and characters: Convert numbers keeps the base conversion, step-by-step explanation and arithmetic, and ASCII table lists all 128 codes with decimal, hex, octal, binary and HTML entity, converts a character or code in any base and jumps to its row, and filters by control, printable, letters, digits or symbols. Text search now works (it matched nothing before): search for a name such as tab, a code such as 0x41 or the character itself. The old /en/tools/ascii-table address redirects to the new tab.
  • IMPROVE Link Extractor is now the Extract links tab of the Page Content Audit. One tool now looks at a web page from both sides: Audit a page reports content, headings, links, media, design and hidden text, and Extract links lists every link, image, script, stylesheet and iframe URL with type, scope and text filters and TXT, CSV, JSON, HTML or Markdown export. CSV export now quotes every cell and neutralises cells that a spreadsheet would run as a formula. The old /en/tools/link-extractor address redirects to the new tab.
  • IMPROVE MIME Type Lookup is now the MIME types tab of the File Signature Identifier. One page now answers both questions about a file: what its bytes really are (Identify a file: magic number, from a dropped file or pasted hex) and what Content-Type its extension should get (MIME types: search by extension or type, browse by category, one-click copy). The old /en/tools/mime-lookup address redirects to the new tab.
  • FIX PGP / GPG Key Lookup: four fixes. The Inspect tab now decodes every key block when several are pasted together (it used to show only the first). A slow lookup can no longer replace the result of a newer one, an unexpected server reply shows a short message instead of raw server output, and the privacy page now lists every service a lookup can contact (keys.openpgp.org, keys.mailvelope.com, keyserver.ubuntu.com and, for an email address, that domain’s Web Key Directory).
  • FIX PGP / GPG Key Lookup: new example key. Try an example in the Inspect tab now loads a demo Ed25519 key with a fictitious identity (Alice Example, alice@example.com) generated for this page.
  • IMPROVE One CVSS calculator for v4.0 and v3.1. The CVSS v3.1 Calculator is now the CVSS v3.1 tab of the CVSS calculator, next to v4.0, with the same Base, Temporal and Environmental scoring, score breakdown, example vectors, JSON export and share link. Paste a vector of either version, or open a link with ?vector=, and the matching tab opens from its CVSS:4.0 or CVSS:3.1 prefix. Old CVSS v3.1 Calculator links, including shared vectors, open the v3.1 tab, and the "Score it in CVSS" link in Today’s set opens the right version pre-scored.
  • IMPROVE PGP Key Inspector is now the Inspect tab of the PGP / GPG Key Lookup. One tool now finds and decodes OpenPGP keys: the Look up a key tab searches keys.openpgp.org, WKD, Mailvelope and keyserver.ubuntu.com as before, and the Inspect a key tab decodes a pasted public key entirely in your browser (fingerprint, user IDs, subkeys, expiry, key flags, weak or revoked keys), still refusing private key blocks. A key found by the lookup opens in the Inspect tab with one click, and a key block pasted into the lookup box is decoded there automatically. Old PGP Key Inspector links open the Inspect tab directly.
  • IMPROVE Metadata Stripper is now the Strip tab of the EXIF & Metadata Analyzer. One tool now reads and removes image metadata: the View metadata tab shows GPS, camera, date and software details as before, and the Strip metadata tab removes all metadata from one or many images (JPEG, PNG or WebP output, quality setting, before/after preview, download all), still entirely in your browser. Stripping also works again: it had been failing with "Failed to load image" because images were loaded in a way the site's security policy blocks; they now load as data URLs, with the policy unchanged. Old Metadata Stripper links open the Strip tab directly. This is the first step of reducing overlapping tools.
  • IMPROVE LLM Token Cost Estimator and Context Window Checker: current models added. Both tools now list the models the providers currently publish, with prices and context sizes taken from each provider’s own page on 9 October 2026: Claude Fable 5.1, Opus 5.5, Sonnet 5.5 and Haiku 5.5; OpenAI GPT-6 Astra, GPT-6.1 Sol, GPT-6 Luna, GPT-5.5 and GPT-5.4 mini; Gemini 3.8 Flash, 3.5 Flash-Lite, 3.1 Flash-Lite and 3.1 Pro (preview); DeepSeek Flash and V4 Pro; and Mistral Large. Retired or no longer listed models are removed: Claude Opus 4 and Sonnet 4, DeepSeek V3 and Mistral Large 2. Where a provider charges more for long prompts (OpenAI GPT-6 and GPT-5.5 above 272K tokens, Claude Haiku 5.5 above 100k, Gemini 2.5 Pro and 3.1 Pro above 200k), the estimator now switches to that rate. Claude Opus 4.7 and later use a newer tokenizer that Anthropic says produces about 30% more tokens, so their token counts are scaled by 1.3 in both tools. DeepSeek prices are the peak-hour rate (off-peak is half), and the Gemini 3.8 Flash price is the 2026 rate (it rises on 1 January 2027).
  • FIX Fixes across ten tools: wrong times, prices, alignment hints and missed keys. Meeting Time Zone Converter: times entered for a source zone other than your own were converted as if they were in your browser’s zone (a 10:00 New York meeting showed as 08:00 UTC from Europe; it is 14:00), midnight could show as hour 24, and the calendar and Google Calendar exports wrote an invalid end time for meetings starting after 23:00. All three are fixed, including across daylight-saving changes. LLM Token Cost Estimator and Context Window Checker: prices and limits re-checked against the providers’ pages: Claude Haiku 4.5 is $1 / $5 per million tokens (not $0.80 / $4), Gemini 2.5 Pro output is $10 and its context is about 1M tokens (not 2M), Gemini 2.5 Flash output is $2.50; the shut-down Gemini 2.0 Flash is removed, retired Claude models are marked, and each row shows the date it was checked. DMARC Report Analyzer: relaxed-alignment hints now use Mozilla’s full Public Suffix List instead of a short built-in list, so for example you.github.io and other.github.io are no longer treated as one organisation. System Prompt Linter: Anthropic API keys and newer OpenAI and AWS key formats in a prompt were not detected; key formats now match the shared secrets ruleset, which also gains two AWS key prefixes (ABIA, ACCA). Security Posture Scanner: a 6-month HSTS max-age still passes, but the result now says the HSTS preload list needs 1 year. IP Geolocation: carrier-grade NAT (100.64.0.0/10) and benchmarking (198.18.0.0/15) addresses are refused like other private addresses instead of returning a location. Actionable CVEs: the EPSS bar colours no longer carry rating words (“High”, “Low”); FIRST publishes no EPSS bands, so they now show the score range. MITRE ATLAS search: Impersonation links to ATT&CK T1684.001, which replaced the revoked T1656. Sysmon Config Builder: adds event 28 (FileBlockShredding).
  • FIX Compliance Database: DORA, NIS2 and CRA articles now match the official texts. Many article entries had the wrong title and content for their number. For example, DORA Article 9 was shown as access control instead of “Protection and prevention”, and Article 12 as access control instead of backup and recovery. Every DORA (64), NIS2 (46) and CRA (71) article is now built from the official EUR-Lex text: official title, the opening paragraph, a shortened version of the other paragraphs, and a link to the article on EUR-Lex. Cross-references now point to the right articles. The practical topic entries (for example “Network Security Monitoring”) are marked Editorial: they are our implementation guidance, not legal text. Their citations were checked against the regulations, and 51 were corrected: NIS2 Article 21(2) points, DORA Article 9(4), the named DORA RTS (EU) 2024/1774 and NIS2 Implementing Regulation (EU) 2024/2690 articles, and CRA Annex I points. One entry citing a provision that does not exist was removed. Figures that are not in the law, such as a 2-hour DORA recovery time or a 6-month log retention, are no longer presented as legal requirements. DORA incident reporting time limits now cite Delegated Regulation (EU) 2025/301 Article 5 (not Article 6) in the DORA Compliance Checker, the Incident Report Generator and the CSSF guide: initial notification within 4 hours of classification and no later than 24 hours after becoming aware, intermediate report within 72 hours of the initial notification, and final report within one month of the latest intermediate report. The Risk Matrix Builder now uses the same bands as the GRC risk register (High 10–14, Critical 15–25), and two ISO/IEC 27001 Annex A control titles were corrected (A.5.20, A.8.22). In the new view, the Compliance Database result count no longer floats over the results.
  • FIX MITRE ATLAS Technique Search: now the full, official ATLAS — 208 techniques instead of 33, with corrected IDs. The tool used a hand-written summary of 33 techniques, and most of it no longer matched MITRE’s ATLAS: 22 entries had an outdated or wrong name and 16 were under the wrong tactic. For example, AML.T0050 was shown as “Phishing”, which is AML.T0052 (AML.T0050 is Command and Scripting Interpreter). The search now uses MITRE’s official ATLAS data, release 2026.09: all 16 tactics and 208 techniques and sub-techniques, including the newer AI agent techniques, with MITRE’s descriptions, the mitigations ATLAS maps to each technique and how each one applies, the case studies where it was seen, platform (Generative, Agentic, Predictive AI, Enterprise) and maturity. The previous detection and mitigation notes were not MITRE text and are gone. You can filter by tactic and platform, open a technique directly with a link such as #AML.T0051, and search old IDs that MITRE retired (for example AML.T0019) to find the technique that replaced them. Techniques already in your report keep their meaning: entries saved under a wrong ID are moved to the right one. The Markdown report now lists MITRE’s mitigations. The AI/ML Threat Model Builder’s ATLAS references were updated to the same release, and a test now checks them against the dataset.
  • IMPROVE Container Manifest Linter: reads kubectl output, adds Pod Security checks, and gives fewer false alarms. You can now paste the output of kubectl get -o yaml or -o json, including List results, and JSON manifests. New Kubernetes checks: seccomp set to Unconfined or not set, capabilities not dropped, and hostPort. Mounting the container runtime socket (/var/run/docker.sock, /run/containerd…) or the host root is now critical. Pod-level securityContext no longer hides container-level problems, and a ServiceAccount with automountServiceAccountToken: false is taken into account. New Dockerfile checks: copying key or credential files into the image, and turning TLS verification off (curl -k, pip --trusted-host…). The linter now also catches chmod 0777, COPY --chmod, bash -c "$(curl …)" and commands inside heredocs. It no longer reports FROM scratch as an unpinned base image, and no longer flags ADD --checksum. It no longer reports distroless :nonroot images (gcr.io/distroless/…:nonroot) or a USER set in an earlier stage as running as root, and no longer treats variables such as GPG_KEY and *_FILE as secrets. A missing memory limit is the issue now, not a missing CPU limit. Very large pastes no longer freeze the tab, and a Docker Compose file gets a clear message instead of a generic error. On phones, findings with a long fix no longer run off the side of the screen.
  • FIX IAM Policy Analyzer: findings fit on phone screens. On narrow screens, a finding with long evidence (for example in the Azure example) was wider than the screen and its text was cut off. It now wraps to the screen width.
  • IMPROVE IAM Policy Analyzer: checks role trust policies, reads pasted CLI output, and gives fewer false alarms. It now flags trust policies that anyone can assume, GitHub Actions OIDC trust without a repository limit (no sub, or repo:*), Cognito trust without an aud and EKS/OIDC trust without a sub, plus NotPrincipal in an Allow. You can paste the output of aws iam get-role, get-policy-version, get-bucket-policy, URL-encoded policies, the Azure role file format and one-item az lists as-is. iam:PassRole or sts:AssumeRole on one named role is no longer reported as privilege escalation; writing policies or creating a user’s keys or console password still is. Action * on arn:aws:*:*:*:* now counts as full admin. A public policy limited only by aws:SecureTransport is still reported as public. An Azure role with * minus the authorization writes is rated as a Contributor copy (high), not Owner. GCP key-admin and role-admin bindings are now flagged. Very large or wildcard-heavy pastes no longer freeze the tab. New “AWS trust” example.
  • FIX Secrets & Credential Leak Scanner: large pastes no longer freeze the page. Some inputs made three checks slow down sharply as the text grew: minified JavaScript, long dotted or hyphenated strings, and private-key headers without an end line. A 5 MB paste could hang the tab for minutes. The same input now scans in under a second, and the findings on normal text are unchanged. The LLM Pre-flight Redactor and the other tools that share these rules get the same fix.
  • IMPROVE Secrets & Credential Leak Scanner: 19 more credential formats, and a list of what it detects. It now also finds Azure AD / Entra client secrets, Google OAuth client secrets, Hugging Face, Atlassian, Databricks, Terraform Cloud, Pulumi, Doppler, 1Password service-account, Heroku, PlanetScale, Supabase, Grafana, New Relic, Sentry, Postman, Linear and Slack app-level tokens, auth tokens in .npmrc files, and more GitLab token types. Each finding comes with how to revoke it. A new “What it detects” section lists every format the scanner checks. The LLM Pre-flight Redactor uses the same rules, so it catches these too.
  • FIX Phishing Checker: better advice for links to internal addresses, and a working offline “Try again”. A link whose host points to a private or internal network address (for example 192.168.x.x) is not scanned for safety reasons; the result used to suggest the site “may go live later”, which only fits host names that do not exist. It now says that public websites never use such addresses and what to do. Separately, the “Try again” button on the offline page was blocked by the site’s security policy and sent you to the homepage; it now reloads the page you wanted.
  • FIX YARA results: clearer labels. In the Phishing Checker, the antivirus panel no longer says just “No detection” when a YARA pattern rule matched; it says “No ClamAV detection, YARA pattern match”. In the PDF Scanner, the pattern-rule row now says when an embedded file could not be pattern-scanned instead of leaving it out.
  • NEW PDF Scanner and Phishing Checker: YARA pattern rules next to the antivirus. The PDF (and its first three embedded files) and, in the Phishing Checker deep scan, the page or downloaded file are now also checked with YARA Forge rules, run with YARA-X in the isolated sandbox with no network. Only rule sets published under a licence are used, and every match shows the rule name and its author. Pattern rules spot code typical of malware families, webshells and phishing kits that signature antivirus can miss, but they can also match harmless files, so a match is reported as a hint (“Suspicious” at most), never as proof. It adds well under a second, and runs alongside the antivirus.
  • IMPROVE Antivirus: phishing signatures, faster PDF scans, no stalls during updates. The antivirus in the PDF Scanner and the Phishing Checker now also uses the Sanesecurity community signatures for phishing pages, scams, fake software, malicious links and macro droppers. These catch more phishing than ClamAV’s own set but can raise false alarms, so a match on one of them shows as a “possible match” that raises the score, never as proof of malware. The PDF Scanner now runs the antivirus and the sandbox analysis at the same time, so a large PDF comes back several seconds sooner. Signature updates no longer hold up a scan: the sandbox loads new signatures only when no scan is running.
  • IMPROVE Antivirus scans moved to the isolated sandbox server. The PDF Scanner and the Phishing Checker deep scan now run ClamAV on our separate sandbox server, the same machine that opens pages and PDFs in throwaway containers, instead of on the web server. Files you submit and pages the checker fetches are still scanned in memory only and never executed; a scanner that is busy or unreachable is reported as “not scanned”, never as clean. The privacy page lists what the sandbox logs: sizes, durations and whether the antivirus found something.
  • FIX PDF Scanner: the antivirus now scans every file the tool accepts, up to 20 MB. PDFs larger than 12 MB came back with “No reply from scanner” in the Antivirus row, because the ClamAV service stopped reading at 12 MB. Its limit now matches the 20 MB upload limit, and if a file is ever too large for it the row says so plainly instead. The page now lists the limits: PDF files up to 20 MB, and up to 8 scans per 10 minutes from the same address.
  • FIX Phishing Checker: a link whose host name does not exist now says “Not checked”, not “No warning signs found”. When the host name in a link has no DNS record (taken down, not yet live, or a typo), only the blocklist lookup can run, and a clean blocklist result says nothing about the site itself. The verdict is now a neutral Not checked: this host name does not exist in DNS instead of a green result, and every check row gives that reason instead of a generic “site not examined”. A link that is on a blocklist is still flagged as dangerous.
  • FIX Offline page works again. If you lose your connection and open a page, you now get the CyberRamen offline page, styled, instead of a bare line of text: the site now keeps that page in its offline cache, and when you are offline a page can use the copy of its styles and scripts already saved on your device.
  • IMPROVE IP lookups now stay on our server; certificate logs only on request. IP Geolocation, DNS Mapper and the Phishing Checker now find the country and network (ASN) of an IP address in the free DB-IP Lite databases kept on our own server and checked for updates every day, instead of sending the address to an outside geolocation service. IP Geolocation now reports country and network only; the proxy and VPN rows were removed because no real data stood behind them. DNS Mapper and the Phishing Checker no longer query crt.sh on their own: subdomains from certificate logs are looked up only when you click “Search certificate logs (queries crt.sh)”, and a note says what is sent.
  • IMPROVE MITRE ATT&CK Search: full Enterprise v19.2. The search now covers every current technique (222), sub-technique (475), mitigation (44) and tactic (15), generated from the official ATT&CK STIX bundle, including the new Stealth and Defense Impairment tactics. Results are ranked (ID, then name, then description), and words found only in a full description, such as “ransomware”, still lead to the right technique.
  • FIX ATT&CK IDs revoked in v19.2 replaced. The SIEM Query Library and Windows Event IDs pointed at technique IDs that MITRE revoked in v19.2 (for example T1562.001 and T1070.001). Each now points at its official replacement, and the old Defense Evasion labels and tags now name Stealth or Defense Impairment.
  • IMPROVE CSP Builder: sandbox directive. You can now add sandbox, bare or with flags such as allow-scripts or allow-forms. The builder checks the flag names, notes that sandbox only works in a CSP header and not in a meta tag, and warns when allow-scripts and allow-same-origin are combined, because together they let the page lift its own sandbox.
  • FIX SSL Checker ports and PGP email check. SSL Checker now rejects a port that is not a number from 1 to 65535 with a clear message, instead of silently checking port 443. PGP Key Lookup now refuses an address that contains characters an email address cannot contain, instead of quietly removing them and searching for a different address. Also fixed: GRC tools no longer fail to load when browser storage is blocked or holds a damaged entry.
  • SITE Accessibility fixes. Links inside text are now underlined, not shown by colour alone. Collapsed certification profiles can no longer be reached with the Tab key while hidden, and without JavaScript every profile is shown open. “See the full path” in the certification chooser now updates the address, so Back and shared links work. The PDF Scanner Text tab no longer breaks ordinary words in the middle, the NIS2 engine heading levels are in order, and the services table on the privacy page scrolls on narrow screens instead of widening the page.
  • SITE GRC workspace overview. In the new view the GRC hub opens on an Overview of your engagement, built only from what the GRC tools saved in this browser: readiness with one mark per item you have answered or scored (NIS2 measures, DORA Level 1 and RTS controls, NIST CSF 2.0 categories, the engagement checklist), the CSF 2.0 tier per function as the mean of the categories you scored, open risks by residual level with the top three, and next steps worked out from the gaps. Nothing is estimated: an area you have not touched shows a dash. The engagement checklist now keeps its ticks in your browser, and “Export engagement (JSON)” saves all of it to a file. Nothing is sent to our server. Also: progress bars now read out failures to screen readers, and a request a tool cancels itself no longer leaves a bar behind.
  • SITE New view: tool window as two panels, progress in the Result panel. Input and result now sit on two plates. A running deep scan opens the Result tab and shows the step counter, the bar and one row per step with the time your browser saw that step take (a step that finished between two checks shows a dash rather than a guessed time). Every other tool that asks our server shows an honest “Waiting for the server” bar with the elapsed time when the answer takes more than a moment; it has no percentage because the server does not report one.
  • IMPROVE Live progress for deep scans. The Phishing Checker deep scan and the PDF Scanner now show a progress bar with one segment per real step — for a link: resolve, certificate and domain, page and DNS, antivirus, hosting, sandbox visit, blocklists and verdict; for a PDF: upload (measured in bytes sent), antivirus, sandbox analysis, embedded files, links and report. The server reports which step it is on; when a step’s length is unknown the bar shows a moving block instead of an invented percentage. The server keeps only the step number for a random job id, never your link or file, and deletes it when the scan ends. In the new view, the home page has a “Running” panel that shows scans still running in your other tabs, a Today’s set panel that marks what you opened from it today (kept in your browser only), and dates on recently updated tools.
  • SITE New view: a light, quieter design. The new view moves to a light, minimal look: a warm grey ground, light panels with thin lines and no shadows, one clear typeface (Instrument Sans) and colour kept for meaning only — orange for tools that use our server, green for tools that run in your browser. The main button on each screen is now near-black with a small orange dot, labels and tabs inside tools are calm ink instead of orange, and links stay orange. A new Tools | GRC switch at the top takes you between the tool desk and the GRC hub. All text keeps WCAG AA contrast. The classic view is unchanged.
  • SITE New view: a calmer, clearer side menu. The selected category is now marked by a plate that glides to it (also from one page to the next), and only its icon is lit, so the menu no longer shows thirteen orange badges at once. The Japanese and letter badges are replaced by simple line icons that show what each category is about (a globe for Web & Domain, a key for Crypto & Keys, a bug for Vulnerabilities…). Rows keep the same weight when selected, so the text no longer jumps, and the GRC hub, cheat sheets and other sections now sit under their own “Sections” heading, aligned with the categories. Motion is switched off when your system asks for reduced motion.
  • FIX Site updates show up straight away. The new design’s script and stylesheet could stay cached in your browser for up to a week after an update, so changes (such as today’s tabbed hub pages) did not appear. Their addresses now carry a version, and the offline cache always fetches fresh copies.
  • SITE New view: GRC hub, cheat sheets, glossary, awareness and certifications fit on one screen. In the new design each of these pages is split into tabs (for example Assess, Reference & learning and Reporting on the GRC hub; one tab per category for cheat sheets and the glossary), and only the tab you pick scrolls. Typing in the cheat sheet or glossary filter searches every tab at once. Links such as /en/certifications#roadmaps open the right tab. The classic view now groups GRC tools, awareness topics and cheat sheets under the same headings.
  • IMPROVE Phishing Checker: no more third-party screenshot service. The optional “Load preview from thum.io” button is gone: every deep scan already shows a screenshot taken by our own isolated browser, so the address you check and your IP are no longer sent to thum.io. The links to urlscan.io, the Wayback Machine and VirusTotal stay, under “Look it up elsewhere”.
  • IMPROVE PDF Scanner: read the document in Preview and Text tabs. Right after the verdict, a Document panel shows the pages as safe pictures in a Preview tab and the document’s text in a Text tab (with a Copy text button and web addresses defanged), instead of two separate sections with the text at the very bottom. When the sandbox cannot draw the pages, the Preview tab offers to render them in your browser with scripts, forms and links turned off. Files that are too large for the server now get a clear message instead of “No file received”.
  • FIX Phishing Checker: tidier message when the browser sandbox is down. If the deep scan could not reach our sandbox server, the result quoted the raw connection error, including the server’s address. It now says only “sandbox unreachable” or “sandbox timed out”; the rest of the scan is unchanged.
  • FIX PDF Scanner: every address in the script report is defanged. When a PDF script passed a web address inside an options object (for example a form submission target), the emulator list showed it as plain text instead of the safe hxxps://example[.]com form used everywhere else on the page.
  • NEW New tool: PDF Scanner. Check a suspicious PDF before you open it. The file is scanned with ClamAV, then opened on our isolated sandbox server in a throwaway container with no network access. The sandbox lists every web address (and flags page-sized or invisible links), runs the document’s JavaScript in an emulated Acrobat environment to record what it tries to do, finds Launch actions that start programs, checks the real type of every embedded file and scans it with ClamAV, and spots hiding tricks such as obfuscated keywords, old revisions and data appended after the end of the file. Every page is shown as a picture with its clickable areas outlined, so you can read the document without opening it. Addresses are checked against local blocklists and link to the Phishing Checker; the report exports as JSON or a defanged summary. Nothing is stored.
  • SITE Headings in order on every page, for screen-reader users. About 80 tool pages jumped from the page title straight to a third-level heading (or skipped a level inside results), which breaks heading navigation in screen readers. Headings now go down one level at a time in both the classic and the new design, including the ones that appear after you run a tool. Nothing changes visually: the headings keep their exact size and style. An automated check now guards this on every page.
  • SITE Classic header fits laptop and tablet-landscape screens. Between about 860 and 1240 px wide the classic header was wider than the screen, so every page scrolled sideways and “Browse the menu” was cut off. Search and RSS now become icon buttons at those widths (with the same names for screen readers), and below 1024 px the duplicate “Browse the menu” button and the header view switch step aside (the Tools menu and the footer switch remain). “Search tools” no longer wraps onto two lines on wide screens.
  • SITE New design, phase 4: polish and speed. Scripts are now sent compressed (they were going out uncompressed in both designs), so pages show their content sooner on slow mobile connections. In the new design, every field and button in a tool’s input pane is at least 44 px tall and fits the pane: forms built for wide screens (for example the CVE / CPE builder, SOC Alert Triage, Control Mapper and the time zone converter) switch to one column there. On phones and in portrait, the home omnibox shows what it detected in a hint under the box instead of hiding it. Links inside running text are underlined, and the smallest notes and card descriptions are easier to read. Tool logic, results and exports are unchanged, and the classic design looks exactly the same.
  • SITE New design, phase 3: every tool page now uses the one-screen workspace. In the new design all 143 tools get the same layout as the four pilots: 129 put the input on the left and the results on the right (with “How it works” for the guide, FAQ and privacy notes, and plain export buttons in the bottom bar), the DNS Mapper keeps its full-width layout, and 13 large dashboards and assessments (for example the CVSS v4.0 calculator, Actionable CVEs, the BIA calculator and the ISO 27001 SoA builder) keep their own page under the new header row with the mode chip, share and star. The “Use next” strip is visible again in the new design, and “field + button” rows no longer squeeze the field on narrow screens. Tool logic, results and exports are unchanged, and the classic design is pixel-for-pixel the same.
  • SITE New design, phase 2: a one-screen home and one-screen tool pages (pilot). In the new design the homepage is now a control center that fits a tablet screen: a “Paste anything” box in the top bar that recognises a URL, IP, hash, JWT or CVE in your browser and points you to the right tool; your pinned tools first, then the most used ones; the three Workflows; and Today’s set with Recently updated alongside. The rail filters the tools in place (/en/?cat=network-dns links can be shared). Four pilot tools — HTTP Security Headers Grader, IOC Defanger, DNS Mapper and Hash Toolkit — get the new workspace: input on the left, results on the right with their export buttons and a “Next” tool at the bottom, the guide and FAQ under “How it works”, a star to pin the tool, and a short “Recent in this session” list kept in the tab’s memory only. Tool logic, results and exports are unchanged, and the classic design is pixel-for-pixel the same.
  • SITE A new “control center” design, with the classic one a tap away. The site gets a calmer, more professional layout built for tablets as much as desktops: a category rail on the left (a drawer on narrow screens), a slim bottom strip with the privacy promise and an “In browser / Uses our server” legend, IBM Plex type and a dark palette checked for WCAG AA contrast. A Classic view / New view switch in the menu and footer lets you go back at any time; the choice is remembered in your browser only (cr-ui, listed on Your local data) — no cookie, nothing sent to us — and ?ui=classic links work too. Without JavaScript you get the classic design. Fonts stay self-hosted; no new third-party request. This is phase 1 (the shell); the new homepage and one-screen tool pages follow.
  • IMPROVE Regex Tester: match, explain, and stay safe from runaway patterns. The Regex Tester now shows every match with positions and numbered and named capture groups, a replace mode ($1 / $<name> / $&) and a split mode, plus an Explain view that breaks a pattern into plain language token by token. Matching runs in a terminable Web Worker with a 2 second timeout, so a catastrophic-backtracking pattern reports “timed out” instead of freezing your tab, and obviously-dangerous nested quantifiers are flagged before you run them. Match highlights are built with safe DOM APIs (5 innerHTML sinks removed). Runs in your browser.
  • IMPROVE Diff Tool: a real minimal diff with a valid patch export. The Diff Tool now uses a proper LCS algorithm to produce the minimal edit script (not a naive line-by-line compare), with line, word and character modes, side-by-side and inline views, line numbers and intra-line word highlighting. Options to ignore whitespace, case and blank lines; a summary of added/removed/changed; and a Unified-diff export (---/+++/@@ hunks with context) that actually applies with patch. All diff output is rendered with safe DOM APIs (3 innerHTML sinks removed). Client-side.
  • IMPROVE JSON / YAML / PHP Formatter: precise validation and DOM-safe output. The JSON / YAML / PHP Formatter now validates JSON with a hand-written parser that reports the first error with its line, column and position (and rejects trailing commas, leading zeros and unterminated strings with a clear message), warns on duplicate keys (which JSON.parse silently drops) and flags integers beyond safe precision. Pretty-print / minify / sort-keys, a collapsible tree view, and conversions JSON↔YAML (vendored js-yaml) and JSON↔PHP array literal with a documented supported subset. All output is built with safe DOM APIs — 14 innerHTML sinks removed. Runs in your browser.
  • IMPROVE SQL Formatter: dialect-aware and token-preserving. The SQL Formatter now tokenises SQL so formatting is round-trip safe — string literals (with ’’ escapes), quoted identifiers and -- / # / block comments are preserved verbatim and never split — and reformats clauses onto their own indented lines, with nested subqueries indented and multi-statement input handled. Keyword case (UPPER / lower / preserve), configurable indent, a minify mode, and identifier quoting tuned per dialect (ANSI, MySQL, PostgreSQL, SQLite, SQL Server, Oracle). Highlighting is built with safe DOM APIs (3 innerHTML sinks removed). Client-side.
  • IMPROVE CSV Converter: a correct RFC 4180 parser with an injection guard. The CSV Converter now parses CSV strictly per RFC 4180 — quoted fields, embedded commas and newlines, doubled quotes, CRLF/LF — with delimiter auto-detection and a header toggle, and converts to JSON, TSV, Markdown, SQL INSERT and HTML-table source (as copyable text, never injected). Output CSV uses correct RFC-4180 quoting, and an optional CSV-injection guard neutralises cells starting with = + - @ before they reach a spreadsheet. The live preview table is built with safe DOM APIs (a critical innerHTML sink over user data removed). Client-side.
  • NEW RACI Matrix Builder: responsibility assignments that validate themselves. The new RACI Matrix Builder maps tasks (rows) to roles (columns) and enforces the rules people get wrong by hand: it flags any task with no Accountable or more than one Accountable (RACI’s cardinal “exactly one A” rule), no Responsible, only Consulted/Informed, plus role overload and orphan rows/columns — each finding with a severity. Supports RACI and RASCI (adds Support), a keyboard-accessible grid that stacks on mobile, and Markdown / CSV / JSON export with JSON re-import. Runs entirely in your browser.
  • IMPROVE Third-Party Risk Register: a documented risk model with concentration & cadence checks. The Third-Party Risk Register now scores inherent and residual risk on a shown 5×5 likelihood×impact matrix (controls reduce likelihood by their effectiveness, never below the floor), tiers each vendor’s criticality, drives review cadence by criticality (overdue / due-soon flags), and detects concentration risk by provider and hosting region. Supplier-relationship fields are mapped to ISO/IEC 27001:2022 Annex A (A.5.19–A.5.22) and, for financial entities, DORA (Reg (EU) 2022/2554) Art. 28. Consent-gated local persistence plus encrypted export; Markdown / CSV / JSON with re-import. A register and aid — it does not make you compliant.
  • IMPROVE Vendor Risk Questionnaire Generator: scoped to the engagement, mapped to the frameworks. The Vendor Risk Questionnaire Generator now tailors the questionnaire to the deployment model (SaaS/cloud/on-prem/hybrid), whether personal data or AI is involved, sub-processor use and criticality — cloud, privacy (GDPR Art. 28) and AI/ML-governance (ISO 42001 / EU AI Act) sections appear only when they apply. Every question is original (no SIG/CAIQ text is reproduced) and tagged with its control domain (ISO/IEC 27001:2022 Annex A, CSA CCM, GDPR, DORA, NIS2). Add or remove questions, then export Markdown / CSV / JSON. A starting template to adapt, not legal advice.
  • IMPROVE NIST CSF 2.0 Tier Self-Assessment: faithful to the publication. The NIST CSF 2.0 Tier Self-Assessment now takes its Tier 1–4 descriptors (Partial, Risk Informed, Repeatable, Adaptive) directly from NIST CSF 2.0 (NIST.CSWP.29, Table 2), applied to cybersecurity risk governance and management — not to individual controls. It states plainly, as NIST does, that Tiers are not maturity levels. You self-rate five faithful dimensions; the overall Tier uses an honest “weakest-practice” rule (labelled as a tool convention, since NIST prescribes no aggregation), with a gap narrative to the next Tier and Markdown / CSV / JSON export.
  • IMPROVE DORA Register of Information Builder: official sections, no invented codes. The DORA Register of Information Builder now organises the Register into its official RoI sections (entity, contractual arrangements, ICT third-party service providers, ICT services, supply chains, functions, and the assessment of services supporting critical or important functions) as required by DORA (Reg (EU) 2022/2554) Art. 28(3) and the ITS (Commission Implementing Regulation (EU) 2024/2956). It validates LEIs (ISO 17442 format + ISO/IEC 7064 MOD 97-10 check digits), checks cross-section references, flags CIF-supporting arrangements, and exports structured CSV / JSON (re-importable) + a Markdown summary. The previous version’s fabricated template codes were removed; exact template/field IDs are to be confirmed against Reg (EU) 2024/2956. A preparation aid, not the official supervisory submission.
  • IMPROVE BIA / RTO-RPO Calculator: a transparent business-impact model. The BIA / RTO-RPO Calculator now takes an escalating impact curve per process (financial / operational / reputational / regulatory across 1h–1week), derives a time-weighted criticality score and tier, and computes WRT = MTD − RTO. It validates the continuity logic (RTO ≤ MTD, RTO + WRT ≤ MTD, RPO within the acceptable data-loss window), ranks processes, proposes a recovery sequence ordered by RTO, and flags single-points-of-failure among shared dependencies. Terminology follows NIST SP 800-34 Rev.1 and ISO 22301; every formula is shown. Markdown / CSV / JSON export. A planning aid, not a compliance claim.
  • IMPROVE SOC Sizing & Cost Calculator: rebuilt as an auditable staffing & budget model. The SOC Sizing & Cost Calculator now turns alert volume and analyst capacity into analysts-per-shift, FTE headcount and an annual budget — and every formula is shown and derived, not asserted. The classic 24/7 coverage factor is computed in the open (a 24×7 seat needs 168 h/week staffed, one FTE is contracted ~40 h/week → 168/40 = 4.2 gross FTE per seat, rising once annual/public-holiday/sick/training leave is deducted), and every input — minutes per alert, utilisation, shift length, overhead multiplier, tier ratios, salary — is an editable default you can override for your own HR and jurisdiction. Results render through safe DOM APIs; runs entirely in your browser. This replaces the previous fixed six-vendor SIEM-infrastructure sizing/TCO view, which relied on vendor pricing we could not keep accurate; the tool now sizes the team, which is what the numbers depend on most.
  • IMPROVE QRadar AQL Assistant: a real Ariel query builder and linter. The QRadar AQL Assistant now composes valid IBM QRadar Ariel Query Language — SELECT with field lists and functions, FROM events/flows, WHERE with properly single-quote-escaped string literals, GROUP BY, ORDER BY and time ranges (LAST / START…STOP) — and lints a pasted query for the common mistakes (unescaped quotes, missing time bound, invalid clause order). Output is copy-ready; the builder runs entirely in your browser and never touches a console.
  • IMPROVE SIEM Query Library: 30 detection templates across three query languages. The SIEM Query Library now offers 30 ready detection queries in QRadar AQL, Splunk SPL and Microsoft Sentinel KQL, each mapped to its MITRE ATT&CK technique and with a one-line description of what it finds and the fields it assumes. Filter by language, tactic or keyword, read the template, and copy it to adapt to your field names. Content-only reference — nothing leaves your browser.
  • IMPROVE SOC Alert Triage: ITIL priority and a NIST-anchored first-response guide. The SOC Alert Triage helper now derives an incident priority (P1–P5) from an explicit ITIL Impact×Urgency matrix and pairs it with a first-response checklist anchored to NIST SP 800-61r2’s detection-and-analysis and containment guidance — so an analyst gets a defensible severity and clear next steps, not a guess. Every result is rendered through safe DOM APIs; runs fully client-side.
  • NEW Cloud Bucket Exposure Checker: is this bucket publicly listable? The new Cloud Bucket Exposure Checker tells you, for an S3/GCS/Azure bucket URL you are authorised to test, whether anonymous requests can list its contents — reporting an honest verdict (public-listable, private, not-found or inconclusive) and never downloading or displaying object bodies. The lookup runs server-side through the same SSRF-guarded fetch as our other network tools (IP-pinned, redirects not followed, private and reserved ranges blocked) and is rate-limited. Authorised testing only.
  • IMPROVE EU AI Act Readiness Checker: rebuilt and verified against the Regulation. The EU AI Act Readiness Checker now classifies a system against the Act’s own decision structure — prohibited (Art. 5), high-risk (Art. 6 + Annex I/III, with the Art. 6(3) profiling override), GPAI (Chapter V) or transparency-only (Art. 50) — then produces the applicable provider/deployer obligation checklist with each item cited to its article/annex and its staged application date, including the high-risk deadline deferrals from the Digital Omnibus on AI (Annex III high-risk to 2 Dec 2027, Annex I to 2 Aug 2028; prohibitions 2 Feb 2025, GPAI 2 Aug 2025 and Art. 50 transparency 2 Aug 2026 unchanged). Every citation was checked clause-by-clause against the official text (Regulation (EU) 2024/1689, EUR-Lex CELEX 32024R1689); four errors in the old tool were corrected (Annex II→I, the R&D carve-out Art. 2(8)→2(6), systemic-risk GPAI Art. 51→55, incident reporting “within 15 days”→“immediately, no later than 15 days”). Documented reproducible readiness score; Markdown/CSV/JSON export. Educational readiness aid, not legal advice.
  • IMPROVE NIST AI RMF Checker: a full four-function self-assessment. The NIST AI RMF Checker now covers the complete AI RMF 1.0 Core — GOVERN, MAP, MEASURE and MANAGE with their 19 categories and 72 subcategories (NIST AI 100-1) — each item carrying its function/category reference and a plain-language ask. Per-function and overall readiness use a documented, reproducible rule with honest N/A handling, plus a prioritised gap list and Markdown/CSV/JSON export. An unsourced “GenAI profile” overlay from the old version was removed rather than left unverifiable; the tool states clearly that the AI RMF is voluntary guidance, not law.
  • IMPROVE AI/ML Threat Model Builder: sourced threats, reproducible risk rating. The AI/ML Threat Model Builder now selects applicable threats from a 31-entry catalogue where every entry is cited to a recognised taxonomy — MITRE ATLAS technique IDs, the OWASP Top 10 for LLM Applications (2025) and OWASP ML Top 10 — with LLM-specific threats (prompt injection, system-prompt extraction, excessive agency) surfaced only for LLM/GenAI systems and classic-ML threats (evasion, model inversion, membership inference, model theft) for predictive models. Risk is rated on a documented likelihood×impact scale with a per-threat factor trace, and ATLAS names were corrected to current (e.g. AML.T0018 “Manipulate AI Model”). Markdown/CSV/JSON export. Runs fully in your browser.
  • IMPROVE LLM Pre-flight Redactor: safer rendering, stable placeholders, export. The LLM Pre-flight Redactor — which scrubs PII and secrets out of text before you paste it into an LLM — now renders every result through safe DOM APIs (the four innerHTML sinks that handled pasted, attacker-controllable text are gone). Redaction uses consistent stable placeholders (the same value always maps to the same token, so the prompt stays coherent), offers mask vs locally-reversible pseudonymise modes, shows live per-type counts, and exports the redacted text and a value-free JSON summary. Detection still runs on the shared PII/secret engines; everything stays in your browser.
  • SITE LLM Red-Team Checklist moved to OffensiveRamen. The LLM red-team checklist is offensive/red-team tradecraft, so it now lives on our red-team sister site at offensiveramen.com/tools/llm-redteam-checklist (rebuilt there, organised by the OWASP Top 10 for LLM Applications 2025 and cross-referenced to MITRE ATLAS). The old CyberRamen URL now redirects there. CyberRamen stays the defensive/blue-team and GRC resource — for LLM assessment here, see the OWASP LLM Top 10 Checker and the AI/ML Threat Model Builder.
  • IMPROVE .htaccess Generator: Apache 2.4-correct output, safer defaults, tested. The .htaccess Generator now emits Apache 2.4-correct directives by default (Require all denied via mod_authz_core) with a clearly-labelled, never-mixed Apache 2.2 legacy option, and wraps module-dependent blocks in <IfModule> guards. Dotfile protection was fixed so it actually blocks /.git/config while keeping /.well-known reachable for ACME; the HTTPS redirect is proxy-aware (no loops behind a CDN/load balancer); HSTS preload is only emitted with its prerequisites; the deprecated positive X-XSS-Protection is gone; and user-supplied domains/paths/rules are sanitised so they cannot inject a directive. Runs on a unit-tested, DOM-free core with safe DOM rendering.
  • IMPROVE Mod_Rewrite Tester: a real rewrite engine with a step-by-step trace. The Mod_Rewrite Tester is now a full Apache mod_rewrite simulator rather than a single-rule toy: it evaluates a whole rewrite block against a URL, honouring RewriteCond gates, [OR], the flags L/END/R/QSA/QSD/NC/NE/F/G/S/C, condition operators (lexical, numeric, filesystem -f/-d) and the server variables, with correct $1–$9 / %1–%9 substitution and a restart loop capped against runaway rules. It shows a per-pass, per-rule, per-condition trace and is explicit about what it does not emulate (PCRE-only regex features, server-context rules, real filesystem state — flagged, never silently guessed). Unit-tested, DOM-free core; all rendering via safe DOM.
  • IMPROVE Server Config Validator: honest static lint for Apache & Nginx. The Server Config Validator now runs on a comment- and quote-aware tokeniser and reports each finding with a severity, the line (and column where computable), a one-line reason, a fix and a source. It catches unbalanced Nginx {} blocks and mismatched Apache <Section> blocks, missing Nginx semicolons, and insecure TLS settings (SSLv2/3 as errors, TLSv1.0/1.1 as warnings), while treating unrecognised directives as “verify” info rather than false errors (module directives are open-ended). It states plainly that it is a static text lint, not a replacement for apachectl configtest or nginx -t. Unit-tested, DOM-free core; findings rendered with safe DOM.
  • IMPROVE CAA & HSTS Preload Checker: accurate parsing and real preload rules. The CAA & HSTS Preload Checker now parses CAA records per RFC 8659/8657 (issue / issuewild / iodef, the critical flag, CA parameters) and correctly reports deny-all and the “no CAA = any CA may issue” rule — fixing a bug where an issue ";" deny record was misread as an empty “any issuer” entry. HSTS preload eligibility is now checked against the actual hstspreload.org submission requirements (HTTPS, max-age ≥ 1 year, includeSubDomains, preload, correct redirect chain), each reported pass/fail/not-checked. A failed fetch is never shown as “secure”. Server-side lookups stay behind the existing SSRF-guarded fetch; results render with safe DOM; unit-tested core.
  • IMPROVE Domain Security Posture Scanner: cited checks and a reproducible grade. The Domain Security Posture Scanner grades security.txt (RFC 9116), DMARC (RFC 7489), SPF (RFC 7208), MTA-STS (RFC 8461), CAA (RFC 8659), DNSSEC (resolver-asserted AD bit, stated as such) and HSTS (RFC 6797), each with a pass/warn/fail verdict, the record found as evidence and a cited standard. “Absent”, “present-but-weak” and “could not check” are now distinct states — a failed lookup is never scored as pass or fail — and the overall letter grade is computed by a documented, reproducible weighted rule (shown in a “How the grade is computed” panel). Server-side lookups keep the existing SSRF-guarded, IP-pinned fetch; results render with safe DOM; unit-tested core.
  • IMPROVE IOC Defanger: IPv6 support, more refang notations, hashes left untouched. The IOC Defanger / Refanger now defangs IPv6 addresses (colons → [:]) without mangling clock times, MAC addresses or URL ports, and refangs the full set of common SOC/TI notations ([.] (.) {.} [dot], [@] (@) [at], hxxp/h__p/fxp:// and more). Defang and refang round-trip cleanly and are idempotent (already-defanged input is not double-bracketed); file hashes (MD5/SHA-1/SHA-256) and CVE IDs are deliberately left intact. Runs on a unit-tested, DOM-free core and renders results with safe DOM construction.
  • IMPROVE IOC Pivoting Tool: classify an indicator and jump straight to the right sources. The IOC Pivoting Tool now classifies an indicator (IPv4/IPv6, domain, URL, email, MD5/SHA-1/SHA-256 hash, or CVE — defanged input is normalised first) and builds correct, URL-encoded deep links to the reputable sources that actually support that type (VirusTotal, Shodan, AbuseIPDB, GreyNoise, Censys, AlienVault OTX, URLhaus, urlscan.io, crt.sh, MalwareBazaar, Hybrid Analysis, NVD/MITRE and more). Nothing is fetched — it only generates links, so no indicator leaves your browser until you click. Rebuilt on a unit-tested, DOM-free core with safe DOM construction throughout. (STIX/CSV export moved to the dedicated STIX 2.1 Formatter.)
  • IMPROVE Incident Report Generator: a NIST SP 800-61r2-structured report, in your browser. The Incident Report Generator now structures the report on the NIST SP 800-61r2 incident-handling life cycle (detection & analysis; containment, eradication & recovery; post-incident activity) with severity guidance, timeline, affected assets, IOCs, impact, root cause and lessons learned. It exports to Markdown, plain text, an IOC CSV (guarded against spreadsheet formula injection) and a clean print-to-PDF view, keeps an optional draft entirely in your browser, and runs on a unit-tested, DOM-free core rendered with safe DOM construction. Regulatory report-type deadlines are quoted from the legal texts, never invented.
  • IMPROVE Incident Timeline Builder: correct across time zones, honest about bad timestamps. The Incident Timeline Builder now reduces every event to a single absolute UTC instant, so timestamps with different offsets (+01:00 vs Z) sort correctly instead of being string-compared; naive timestamps (syslog, Windows, bare date-time) are all interpreted in one explicit, user-selectable assumed zone (default UTC) rather than silently mixing the browser’s local zone with others. Impossible dates are rejected, unreadable timestamps are flagged for manual fixing (never replaced with “now”), and elapsed-time and total-span maths are computed from the instants. Exports to CSV (formula-injection guarded), JSON and Markdown; unit-tested, DOM-free core with safe DOM construction.
  • IMPROVE Log Redactor: precise detectors, stable pseudonyms, honest limits. The Log Snippet Anonymizer & Redactor now runs on a unit-tested, DOM-free core with precise, backtracking-safe detectors: IPv4/IPv6 (octet- and RFC-validated, so 10.0.0 or a version string isn’t caught), emails, URLs, PEM private-key blocks, JWTs, AWS key IDs, bearer/basic credentials, sensitive key=value pairs, session cookies, MAC addresses, and credit-card numbers gated by a Luhn check to reject random 16-digit IDs; hostnames and usernames are available but off by default (higher false-positive). A pseudonymise mode maps each distinct value to a stable TYPE_n token so the log stays analysable; exports contain redacted text only. It renders attacker-controlled log text exclusively via safe DOM construction (the key XSS fix), stays 100% client-side (logs never leave your browser), and states plainly that it is an aid, not a guarantee, and that pseudonymisation is locally reversible — not legal anonymisation.
  • IMPROVE DORA Compliance Checker: tested engine, corrected legal citations, policy deep links. The DORA Compliance Checker now runs on a DOM-free, unit-tested core anchored strictly to Regulation (EU) 2022/2554 and its RTS/ITS, rendered entirely with safe DOM construction (all raw-HTML sinks removed). Legal citations were corrected — the major-incident reporting deadlines are attributed to Commission Delegated Regulation (EU) 2025/301 Art. 6, and TIBER-EU/TIBER-LU is noted as the recital-level delivery method, not a verbatim article obligation. It adds “N/A — out of scope” scoring, CSV/JSON/Markdown exports, and a per-gap deep link to the matching document in the Policy Document Generator.
  • IMPROVE NIS2 Self-Assessment: cited checklist, scope wizard, Article 23 reporting timeline. The NIS2 Self-Assessment now runs on a tested, DOM-free core anchored only to Directive (EU) 2022/2555, with every checklist item citing its article. It adds a scope-determination wizard (essential vs important entity), the Art. 23(4) reporting-timeline calculation (early warning / notification / final report), and CSV/JSON/Markdown exports. Every result is rendered with safe DOM construction (raw-HTML sinks removed).
  • IMPROVE ISO 27001 SoA Builder: real Annex A control set, filters, testable core. The ISO 27001 Statement of Applicability Builder keeps the authoritative ISO/IEC 27001:2022 Annex A set (93 controls) and now runs on a unit-tested, DOM-free core: control indexing with de-duplication and honest valid/invalid state, a Statement-of-Applicability record model with completeness stats, theme / applicability / status / free-text filters, a justification & reference field, and CSV/JSON/Markdown exports. The table and dashboard render with safe DOM construction (raw-HTML sinks removed).
  • IMPROVE NIST CSF 2.0 Profile Builder: a proper Organizational Profile with gap analysis. The NIST CSF 2.0 Profile Builder is now a real Organizational Profile tool: Current vs Target state per outcome, gap = Target−Current math with priority buckets, completeness statistics, filtering, an import sanitiser, and CSV/TSV/JSON/Markdown/text exports — all on a unit-tested, DOM-free core. The page builds every node with safe DOM construction (raw-HTML sinks removed).
  • IMPROVE Control Mapper: honest provenance on every crosswalk entry. The Control Mapper (NIST CSF 2.0 ↔ ISO 27001:2022 ↔ DORA) now runs on a tested, DOM-free core and states its provenance plainly: the CSF 2.0 taxonomy (NIST CSWP 29) and the ISO 27001:2022 Annex A list are authoritative inventories, but the crosswalk between them is not reproduced from an official, attributable source — so all 106 shipped mappings are labelled “indicative” (editorial), with a per-row Source badge, a provenance column in exports, and a scope note. Nothing is presented as an authoritative equivalence.
  • FIX Dependency Scanner: vulnerability lookups no longer leave your browser to a third party. The Dependency Scanner previously called the OSV database directly from your browser — which the site’s security policy blocks and which exposed your dependency list to a third party. It now parses the manifest in your browser and routes only the vulnerability query through our own server (fixed upstream host, SSRF-guarded, nothing stored), honestly disclosed on the privacy page. It now parses package.json, package-lock, requirements.txt, composer.json/lock, go.mod and Gemfile.lock (exact vs approximate versions marked, unpinned entries listed not faked), computes CVSS v3 base scores by the FIRST formula instead of guessing, guards CSV export against spreadsheet formula injection, and renders every result with safe DOM construction.
  • IMPROVE Actionable CVEs: triage prioritisation, at-a-glance summary, honest data freshness. The Actionable CVEs Dashboard now layers a transparent triage-priority ordering (known ransomware use, a passed CISA BOD 22-01 deadline, then EPSS — documented as an ordering aid, not a risk rating), adds click/keyboard-sortable columns and summary chips (total / ransomware / past-deadline / due-soon / EPSS-scored), and shows a freshness banner that distinguishes fresh from aging, stale, cached-after-an-unreachable-feed or EPSS-unavailable — a failed refresh is never shown as “no actionable CVEs”. All fetched data is rendered with safe DOM construction.
  • IMPROVE CVSS v4.0 Calculator: scoring verified against the authoritative engine, testable core. The CVSS v4.0 Calculator engine was cross-checked against the Red Hat / FIRST.org reference implementation across all 104,976 base vectors and a 300,000 full-metric random sweep with zero disagreements; no coefficient or rounding was changed (the Round-Half-Up fix from Red Hat PR #67 / FIRST issue #4 was confirmed correct and kept). The scoring logic now lives in a unit-tested core module with cited known-answer vectors, and the page renders results with safe DOM construction.
  • IMPROVE CVE / CPE Builder: spec-correct CPE 2.3 escaping, round-trip and paste-to-parse. The CVE / CPE Search Builder now follows NISTIR 7695: it escapes the full set of special characters correctly (not a partial list), handles ANY (*) vs NA (-) vs quoted-value semantics, converts losslessly between the CPE 2.3 formatted string and the 2.2 URI binding (including the packed ~edition attributes), and can parse a pasted CPE back into the form with precise, spec-cited validation messages. All output is rendered with safe DOM construction.
  • IMPROVE EPSS Lookup: batch lookups, probability vs percentile kept straight, honest states. The EPSS Score Lookup now accepts many CVE IDs at once (validated, de-duplicated, capped, with invalid tokens listed rather than silently dropped), and clearly separates the EPSS probability (estimated 30-day exploitation likelihood) from the percentile (relative rank) instead of conflating them, citing FIRST and inventing no severity thresholds. Results are sortable, export to CSV (formula-injection-guarded) and JSON, and a lookup failure, no-data and a real zero score are now three distinct, honest states.
  • IMPROVE DNS Mapper: real SPF/DMARC/CAA mail-security analysis, honest scope, safer output. The DNS Mapper was billed as mapping mail and SPF/DMARC but only fetched raw records; it now parses and scores SPF (RFC 7208, incl. the 10-DNS-lookup limit and the -all/~all qualifier), DMARC (RFC 7489, policy strength) and CAA (RFC 8659), each shown with its raw record as evidence and an RFC citation. CSV export now neutralises spreadsheet formula injection, every result is rendered with safe DOM construction (no innerHTML), the map honours light/dark theme tokens, and per-section states distinguish a lookup failure from “no records”. It now states honestly that DNSSEC validation is not performed (PHP’s resolver cannot query DNSKEY/DS) and discloses the server-side ASN lookup.
  • FIX DNS Record Lookup: honest per-type results, reverse lookups, CAA/SRV/PTR. The DNS Record Lookup used to collapse three different outcomes into one misleading “no records found”; it now reports a distinct status per record type (found / none / lookup error), and because PHP’s resolver cannot observe NXDOMAIN it no longer claims a domain is unregistered — it says it cannot distinguish that and links the WHOIS tool. Added CAA (RFC 8659), SRV (RFC 2782) and reverse PTR lookups (verified against dig), a per-type “what was checked” row, and safe DOM construction in place of all previous innerHTML rendering.
  • FIX WHOIS Lookup: correct DNSSEC + status meanings, honest states, safer output. The WHOIS Lookup read DNSSEC only from one RDAP flag and so reported signed zones (e.g. many .de domains, which publish key data without that flag) as unsigned; it now detects DNSSEC from delegation, DS or key data and names the algorithm. EPP/RDAP status codes are mapped to their authoritative ICANN meanings instead of a crude active/locked guess, a 404 is reported as “not registered” rather than an error, and unsupported TLDs, registry rate-limits and timeouts are distinct states. Registrant data is treated as redacted-by-default, registrar abuse contacts are surfaced, and all RDAP text is rendered with safe DOM construction (no innerHTML).
  • FIX IP Info: exhaustive, RFC-cited address classification and new conversions. The IP Info tool misclassified the broadcast address 255.255.255.255 as “reserved” and silently reported CGNAT, TEST-NET, 6to4, Teredo, NAT64 and IPv4-mapped addresses as ordinary public; every IANA special-purpose range is now matched and cites its RFC. IPv4-mapped IPv6 now parses, invalid IPv6 (e.g. a :: standing for zero groups) is rejected per RFC 5952, and new client-side conversions were added (integer↔IP for v4 and v6, reverse-DNS PTR names, and CIDR membership for both families). All results are rendered with safe DOM construction (no innerHTML); the tool makes no network requests.
  • FIX Port Lookup: input validation, honest states, corrected and sourced notes. The Port Lookup used to look up out-of-range numbers (e.g. 70000) and show “no information”; it now validates 1–65535 and distinguishes assigned / unassigned / dynamic ports per RFC 6335. The stale note calling port 465 deprecated was corrected (RFC 8314 reinstates it for implicit-TLS submission), every security note now carries its source and commonly-abused ports are badged, and all results are rendered with safe DOM construction (no innerHTML).
  • FIX Certificate Decoder: now reads EC and Ed25519 certificates, and refuses private keys. The Certificate Decoder previously failed on any non-RSA certificate — a large share of the modern web — showing only “Invalid certificate”; it now reads the public-key algorithm and curve straight from the ASN.1, so EC P-256 and Ed25519 certs decode correctly (verified against openssl). A multi-certificate chain no longer hashes stray PEM markers, so SHA-256/SHA-1 fingerprints match openssl x509 -fingerprint byte for byte. It now surfaces URI SANs, AIA (OCSP / CA Issuers), CRL distribution points and the Authority Key Identifier, and flags weak signatures (MD5/SHA-1), RSA keys under 2048 bits, expiry and over-long TLS validity. A pasted private key is refused with a warning, oversized input is capped, and every certificate field is rendered with safe DOM construction (no innerHTML).
  • FIX SSL/TLS Checker: accurate fingerprints and honest connection states. The SSL/TLS Checker was dropping the last hex digit of the certificate fingerprint; the SHA-256/SHA-1 fingerprints now match openssl exactly. A failed connection is reported as a precise, distinct state (TLS handshake failure, connection refused, timeout, host unreachable, or DNS failure) instead of a single ambiguous error that could read as “secure”. SAN wildcard matching follows RFC 6125, IPv6 literals and a timezone bug are fixed, the connection timeout is tightened and the chain length capped, and the server-side connection’s SSRF posture was reviewed (IP-pinned connect, DNS-rebind safe). All certificate data is rendered with safe DOM construction.
  • IMPROVE HTTP Security Headers Grader: fixes to the grading logic and safer rendering. The HTTP Security Headers Grader no longer rewards a deprecated X-XSS-Protection header or passes a cookie flag on a substring match, and the grading of CSP, HSTS, Permissions-Policy and frame protection was corrected against current guidance. Each header’s finding states what was observed and how to fix it, and the parsed, attacker-controllable header values are rendered with safe DOM construction (no innerHTML). The core grading logic is now unit-tested.
  • IMPROVE Cookie Analyzer: RFC-correct flag checks and clearer verdicts. The Cookie Analyzer now applies the __Host- and __Secure- prefix rules correctly (a __Host- cookie requires Secure, Path=/ and no Domain, per RFC 6265bis), no longer passes a flag on a substring match, and explains each Secure/HttpOnly/SameSite finding with its risk. Parsed cookie attributes are rendered with safe DOM construction, and the core parser is unit-tested.
  • IMPROVE CSP Builder: catches silently-ignored directives and renders safely. The CSP Builder now warns when a policy relies on frame-ancestors, report-uri or report-to in a <meta> tag, where those directives are silently ignored, and sharpens its advice on unsafe-inline, nonces/hashes and strict-dynamic. The generated policy and all findings are produced by a unit-tested core and rendered with safe DOM construction (no innerHTML).
  • FIX Email Header Analyzer: fixed a false “forged authentication” verdict and hardened rendering. The Email Header Analyzer was flagging legitimate Gmail-style mail as forged because it read the receiving host from a Received hop that has no hostname; it now picks the first real domain per RFC 8601, so genuine SPF/DKIM/DMARC passes are reported correctly. Header parsing now stops at the blank line (so message-body lines are no longer misread as headers), decodes RFC 2047 encoded subjects/names without inventing text, handles IPv6 Received hops, and computes per-hop delays and the originating IP. Every header value is now rendered with safe DOM construction (no innerHTML), so a crafted header cannot inject markup. Phishing indicators state what was observed and why, and the heuristic score shows its per-item basis.
  • IMPROVE Email Security Checker: honest DKIM state and safer rendering. The Email Security Checker no longer shows a contradictory DKIM result (a red fail in one place, amber warning in another): because DKIM selectors cannot be enumerated over DNS, an absent key is now reported consistently as unknown with an explanation, not a misconfiguration. Looked-up record content (SPF/DMARC/MX and recommendations) is rendered with safe DOM construction instead of HTML strings. The SPF 10-lookup limit (RFC 7208) and DMARC policy checks (RFC 7489) are unchanged and correct; the server-side domain lookup’s input validation and SSRF defences were reviewed and confirmed sound.
  • FIX Email Auth Record Builder: RFC-correct records, a linter, and lookup counting. The Email Auth Record Builder now treats an empty DKIM p= as a key revocation (RFC 6376 §3.6.1) rather than “layout only”, counts the SPF 10-DNS-lookup limit correctly (only include/a/mx/ptr/exists/redirect count, per RFC 7208 §4.6.4) and flags over-limit records as a permerror risk, and emits the required authorisation record when DMARC reports are sent to an external domain (RFC 7489 §7.1). A new “Lint existing” mode checks a pasted SPF/DKIM/DMARC record for multiple-SPF permerrors, ptr, a missing all, a mis-ordered p tag and more. Input is validated (IPv4/IPv6/CIDR, selectors, pct, mailto), and all output uses safe DOM construction. Each finding cites its RFC.
  • IMPROVE DMARC Report Analyzer: XXE-safe parsing, aligned vs raw results, and hardened output. The DMARC Report Analyzer now parses aggregate (RUA) XML with a DOM-free reader that resolves no external entities (no XXE, no “billion laughs”) and caps input size. It separates the reporter’s DMARC-aligned verdict from the raw SPF/DKIM authentication results (shown in their own columns) so the two are never conflated, and derives relaxed/strict alignment hints per RFC 7489. Report content is rendered with safe DOM (no innerHTML), CSV/JSON exports neutralise spreadsheet formula injection, and gzip’d .xml.gz reports are inflated locally. Typed states replace a silent empty table (not-DMARC, malformed, or a valid zero-record window).
  • FIX PGP Key Inspector: correct curve names, expiry and revocation. The PGP / GPG Key Inspector now recognises the legacy Curve25519 ECDH OID, so modern GnuPG encryption subkeys show the curve name instead of a raw OID, and unknown OIDs are labelled as such rather than looking like a valid curve. Expiry, key flags and revocation are now read from the correct self-signature per RFC 4880 (direct-key or primary-UID self-cert; subkey binding signatures for subkeys), which fixes wrong results on keys with multiple user IDs or subkeys, and the tool states which signature a value came from. It refuses secret-key material, caps input at 1 MB, and the fingerprint / key-ID wording is corrected (v4 vs v6; v5 is LibrePGP). Signature/trust verification remains out of scope and is stated as such.
  • IMPROVE PGP Key Lookup: hardened rendering and honest per-source results. The PGP / GPG Key Lookup result view was rebuilt to construct every element with safe DOM APIs (zero innerHTML), so attacker-controlled user-ID text from a keyserver can never become markup. Each source (keys.openpgp.org, WKD, Mailvelope, Ubuntu) reports its own explicit state — found / not found / error / timeout — so a keyserver being down is never shown as “no key”, and source disagreement is flagged. The looked-up email is never logged. The server-side proxy’s SSRF defences (allow-listed input, fixed keyserver hosts, per-redirect-hop IP validation with DNS-rebinding pinning, timeouts and size caps) were reviewed and confirmed sound.
  • FIX Password Policy Tester: aligned to NIST SP 800-63B-4 (2025) with corrected attributions. The Password Policy Tester was updated to the final NIST SP 800-63B-4 (published August 2025), including the new section numbers (§3.1.1 / §3.2.2) and the raised single-factor minimum length of 15 characters, and now reads your MFA stance when judging length. Three incorrect attributions to NIST were fixed: memory-hard hashing (bcrypt/Argon2id) is OWASP guidance, a ≤10 lockout threshold is NCSC/CIS, and NIST only caps at 100 consecutive failures. Each criterion now shows the observed value, the cited requirement, a pass/warn/fail state and how to fix it; a reproducible scoring table and a standards-conflict disclosure are shown on the result.
  • FIX Password Generator: honest passphrase entropy and a bcrypt length warning. The Password Security Suite corrected its passphrase entropy figures: the wordlist is 2048 words (exactly 11 bits per word), so a 4-word / 6-word passphrase is ~44 / ~66 bits, not the previously shown ~51 / ~77. Entropy is now labelled a lower bound and the appended-number bonus is computed exactly. A warning now fires when a password exceeds bcrypt’s 72-byte limit (which silently truncates). The generator’s randomness was audited and confirmed sound — it uses crypto.getRandomValues with rejection sampling (no modulo bias, no Math.random) — as was the server-side bcrypt hash/verify endpoint (CSRF, rate limiting, constant-time verify, no password logging).
  • IMPROVE LLM Output Scanner: now flags prompt-injection and unsafe-rendering signals, not just PII and secrets. The LLM Output Scanner gains a fourth detection category covering OWASP LLM01:2025 (prompt injection / jailbreak / system-prompt-leak markers, explicitly labelled heuristic) and LLM05:2025 (improper output handling — raw <script>, inline event handlers, javascript:/data:text/html URLs, and markdown-image data exfiltration). Each finding shows its class, byte offset, line/column, evidence and the relevant OWASP reference; empty states say “no patterns matched (not a guarantee of safety)”. Added JSON and CSV export (CSV is RFC-4180 quoted and formula-injection-safe); exports mask secret and PII values exactly as the UI does. Results without any signal are byte-identical to before.
  • FIX System Prompt Linter: rules trimmed to defensible, sourced checks. The System Prompt Linter dropped two rules that produced false positives on legitimate prompts (a “contradiction” heuristic that flagged normal “always… never…” instructions, and a language-drift penalty), and fixed a scoring bug where one signal was both rewarded and penalised. It now runs 14 rules each mapped to an OWASP LLM Top 10 (2025) reference, with explicit pass / warn / not-applicable states rather than treating “not flagged” as safe. The score formula is shown on the result (score = max(0, 100 − Σ rule weight)).
  • IMPROVE Prompt Injection Playground: reframed as a defensive catalogue. The Prompt Injection Playground was reworked from a gamified “can you break it” framing into an educational reference: each technique (OWASP LLM01:2025) is shown with how it works, why it matters, and the concrete defences — input/output separation, privilege limiting, human-in-the-loop, output validation. All examples are defensive illustrations with sources; no payloads are presented as ready-to-use attacks.
  • FIX OWASP LLM Checker: aligned to the 2025 list with a documented score. The OWASP LLM Checker corrected two risk titles to their OWASP LLM Top 10 for 2025 wording (LLM05 Improper Output Handling, LLM03 Supply Chain) and now shows exactly how its readiness score is computed from the answered controls, so the number is reproducible rather than opaque. Each control links to its OWASP reference.
  • IMPROVE Token Cost Estimator: dated, sourced, editable prices and an honest token estimate. The Token Cost Estimator now stamps every model price with its source and as-of date and lets you override any price inline, so an out-of-date figure is visible and fixable rather than silently wrong. The token count is clearly labelled an estimate (character/word heuristic, not a real tokenizer) with the method shown, and the cost breakdown separates input and output explicitly.
  • FIX Sigma Rule Builder: SIEM queries now honour the full rule condition. The Sigma Rule Builder’s Splunk/QRadar/Sentinel export used to AND every selection together and silently drop filter (negation) selections, so the generated query did not match the rule’s own condition. It now parses the condition (and/or/not, parentheses, 1 of/all of them) into a tree and transpiles it faithfully per backend, with correct handling of Sigma value modifiers and wildcards; modifiers with no faithful inline equivalent (e.g. |base64) are omitted with a clear note rather than mistranslated. Output is labelled best-effort (use pySigma for production pipelines). Built to the SigmaHQ specification v2.0.0.
  • FIX YARA Rule Builder: the condition tester works again and no longer guesses. The tester in the YARA Rule Builder evaluated conditions with new Function(), which the site’s security policy (no unsafe-eval) blocks — so on the live site it never produced a verdict. It has been rebuilt with a dedicated parser (no eval) using three-valued logic: a string it cannot faithfully evaluate (xor/base64 transforms, hex with wildcards/jumps, filesize/offset conditions…) is reported as NOT EVALUATED rather than a misleading match or miss. Hex strings are now matched byte-exactly, and invalid modifier combinations (e.g. xor+nocase) are rejected before they reach the rule. Per YARA 4.x documentation.
  • FIX Sysmon Config Builder: generated XML is now schema-valid and the presets behave correctly. The Sysmon Config Builder could emit a configuration Sysmon would reject (a field left attached to the wrong event type after switching events), and its “verbose” preset used include-mode empty groups, which actually log nothing. Both are fixed: fields are reconciled to the selected event and validated, and “log everything” now uses exclude-mode groups as documented. All 16 documented condition operators are available, values and names are XML-escaped, and a live validation panel flags rejects (red) and noisy-but-valid rules (amber). Built to the Sysmon configuration schema (schemaversion 4.90).
  • FIX Windows Event ID Lookup: corrected an ATT&CK mapping and added sharable search + export. In the Windows Event ID Lookup, event 4771 was mapped to AS-REP Roasting (T1558.004); per Microsoft and MITRE, 4771 is not produced in that scenario and its pre-auth failure code 0x18 signals password brute-forcing — it is now mapped to T1110 (Brute Force) with a sourced note. The whole dataset is validated for shape, search supports ?q=/?id= deep links you can bookmark and share, and the current results export to JSON, CSV (formula-injection-safe) and Markdown.
  • FIX MITRE ATT&CK Search: honest scope, and the technique deep links finally work. The ATT&CK Technique Search described itself as a complete copy of ATT&CK Enterprise v14; it is in fact a curated subset, and the page + FAQ now say so and show the version and provenance. The ?q= deep link that other tools (Windows Event ID, glossary pages) use was never read, so those links landed on an unfiltered page — it now pre-fills and runs the search, expands an exact match, falls back from a sub-technique ID to its parent, and offers an attack.mitre.org link for techniques outside the subset. Sub-technique names are now searchable, results export to JSON/CSV, and the cards are keyboard-accessible.
  • FIX Binary/Hex/Decimal Calculator: exact big-number arithmetic and correct bitwise operations. The Binary/Hex/Decimal Calculator previously used floating-point and 32-bit signed operators, so values above 253 lost precision and bitwise operations on 64-bit values (for example 0xFFFFFFFFFFFFFFFF AND …) and shifts wrapped or gave wrong results. All conversion and arithmetic now use arbitrary-precision integers (BigInt): 256-bit hex↔decimal is exact, bitwise AND/OR/XOR/shift run on a selectable 8/16/32/64-bit two’s-complement width, division reports quotient and remainder, and invalid digits for the chosen base are now rejected with a clear message instead of being silently dropped. Bases 2–36 are supported.
  • IMPROVE Hash Toolkit: selectable output encoding, UTF-8 correctness and a long-input MD5 fix. The Hash Toolkit now outputs each digest as lowercase hex, uppercase hex or Base64 without re-hashing, counts input as UTF-8 bytes, and shows per-result evidence. MD5 and SHA-1 are now clearly labelled as collision-broken and not for security use (with references). A latent bug in the hand-written MD5 length field (it wrote only a 32-bit length) that would have produced a wrong digest for inputs larger than 512 MB has been fixed; all algorithms are covered by tests against published vectors.
  • FIX Encoding Toolkit now handles Unicode and emoji correctly. Several modes in the Encoding Toolkit mangled non-ASCII text: hex/decimal/octal/binary read UTF-16 code units (so an emoji such as 😀 was split and could not round-trip), Base64 and the detector decoded bytes as Latin-1 (turning 4oKs into mojibake instead of €), and numeric HTML entities above U+FFFF were truncated. These now use UTF-8 byte encoding (with a strict decoder that reports invalid input instead of guessing) and full code-point handling, so every mode round-trips for ASCII, accents, CJK, combining marks and emoji. A dependency-free Base64 codec and a real ASCII85 decoder replace the previous btoa/atob path.
  • IMPROVE SSH Key Analyzer now shows the MD5 fingerprint and refuses private keys safely. The SSH Key Generator & Analyzer now prints both the SHA256: and the legacy MD5: fingerprint (matching ssh-keygen -lf byte-for-byte across RSA, Ed25519, ECDSA and DSA keys), derives the key type and size from the key blob rather than its text label, and parses authorized_keys option prefixes and multiple keys. Pasting a private key by mistake is now refused with a privacy warning instead of a confusing error, weak keys (RSA<3072, DSA) are flagged against NIST SP 800-57, and everything stays in your browser.
  • FIX Password Hash Verifier no longer reports a false “does not match”. The Password Hash Verifier used to run the verification on any pasted hash, but for schemes it cannot actually compute (phpass, raw unsalted MD5/SHA/NTLM, scrypt, PBKDF2, Argon2d) that always returns false — so it showed “does not match” even for the correct password. It now detects the hash family and parameters in your browser, only runs a real verification for the algorithms it can compute correctly (bcrypt, Argon2i/id, sha-crypt), and otherwise returns an explicit NOT CHECKED state. Each result grades the cost/parameters against the OWASP Password Storage Cheat Sheet and separates observed facts from recommendations.
  • FIX CIDR Calculator no longer breaks on very large ranges. The CIDR / Subnet Calculator’s range→CIDR conversion used 32-bit signed shifts, so any range reaching a /1 or /0 (for example 0.0.0.0–255.255.255.255) overflowed — emitting a duplicate 0.0.0.0/0 and a runaway list. It now computes block sizes with full-width arithmetic and returns the correct minimal, gap-free, non-overlapping set of CIDR blocks across the whole address space (the full range is now simply 0.0.0.0/0). Small ranges are unaffected.
  • FIX CVSS v3.1 Calculator now rejects invalid vector tokens instead of silently scoring NaN. Pasting a vector with an illegal metric value (e.g. AV:Z) or an unknown metric used to produce a silent NaN or a score computed as if the bad token weren’t there. The CVSS v3.1 Calculator now validates every Metric:Value token against the allowed set before scoring and shows a specific message (invalid value, unknown metric, duplicate metric, or which required base metrics are missing). Valid vectors score exactly as before (pinned to the FIRST CVSS v3.1 specification).
  • FIX File Signature Identifier: corrected magic numbers for VirtualBox VDI, Firefox XPI, installers, MP4 and MP3. Several signatures in the File Signature Identifier were wrong or never matched: the VirtualBox VDI entry now uses the real <<< Oracle VM VirtualBox Disk Image >>> header; Firefox add-ons (.xpi) are correctly identified as ZIP archives; the mislabeled “Inno Setup” entry is now the actual InstallShield Cabinet (ISc(), with a note that Inno/NSIS installers are ordinary PE executables; MP4/QuickTime files are now matched by the ftyp box at offset 4 regardless of the (variable) box size; and tag-less MP3s are recognised by their raw MPEG frame sync in addition to ID3. References: Gary Kessler’s file-signature table and libmagic.
  • IMPROVE JWT Decoder now verifies RSA and ECDSA signatures, not just HMAC. The JWT Decoder can now verify RS256/384/512, PS256/384/512 and ES256/384/512 tokens: paste the issuer’s public key as PEM (SPKI) or JWK and the signature is checked in your browser with the Web Crypto API (ES tokens use the raw R||S signature format per the JWS spec; ES512 uses P-521). HMAC verification (HS256/384/512) is unchanged, a key/alg mismatch or malformed key now gives a specific error, and a display bug that showed a successful verification on a red background has been fixed.
  • IMPROVE AES Encryptor now defaults to 600,000 PBKDF2 iterations (OWASP guidance). The AES-256-GCM Encryptor now derives keys with 600,000 PBKDF2-HMAC-SHA256 iterations by default — the current OWASP Password Storage Cheat Sheet minimum — up from 250,000 (still selectable). The iteration count is stored in the encrypted output, so existing ciphertext still decrypts automatically; nothing you encrypt or decrypt leaves your browser.
  • FIX SSVC Decision Tree now follows the official CISA decision table exactly. The SSVC Decision Tree previously used a hand-written heuristic (and an “Exposure” input that is not part of the CISA model), so its Track / Track* / Attend / Act verdicts could diverge from CISA’s own calculator. It now evaluates the vulnerability against the published CISA SSVC decision tree verbatim — all 36 outcomes over Exploitation × Automatable × Technical Impact × Mission & Well-Being — and shows CISA’s own outcome wording and recommended timeline. The decision table is transcribed from the CERT/CC SSVC reference data (CISA coordinator table, cisa_coordinator_2_0_3). The tool states clearly that this is the CISA tree, not the separate CERT/CC Deployer tree.
  • FIX STIX 2.1 Formatter now emits standards-conformant TLP markings. The STIX 2.1 Indicator Formatter previously wrote TLP marking-definition objects that validated as neither TLP 1.0 nor FIRST TLP 2.0 (wrong definition_type casing, a missing definition property, and a TLP 2.0 extensions block bolted onto non-canonical UUIDs). It now outputs the four predefined STIX 2.1 static markings verbatim — TLP:WHITE/GREEN/AMBER/RED with their canonical OASIS UUIDs, definition_type: "tlp" and definition: {"tlp":"…"} — so a bundle imports cleanly into TIPs and libraries. TLP:CLEAR and TLP:AMBER+STRICT (which exist only in FIRST TLP 2.0, not as STIX 2.1 static markings) have been removed rather than faked. Marking IDs verified against the OASIS python-stix2 reference library.
  • FIX CSR Generator now encodes accented and non-Latin subject fields correctly. The CSR / Key-Pair Generator was emitting subject UTF8String values (O, OU, CN, L, ST) as UTF-16 code units with a wrong length, so a name such as Café, Zürich or a CJK organisation produced a corrupt CSR that a CA would reject — a real risk for EU/non-ASCII applicants. Subject fields are now UTF-8 encoded with the correct DER length (verified byte-for-byte against the RFC 5280 encoding and cross-checked with OpenSSL), emailAddress (IA5String) now rejects non-ASCII input with a clear message instead of corrupting it, and a decoder bug that left the Decode tab’s Subject blank was fixed at the same time.
  • SITE Pages now stay legible when a corporate proxy blocks our web fonts or icons. Some filtering proxies return 403 for self-hosted sub-resources (.woff2 fonts, the SVG favicon) even though the origin serves them correctly. The font stacks now fall back to the operating system’s own monospace and sans-serif fonts (with font-display: swap, already in place, preventing invisible text), so layout and spacing hold up without IBM Plex Mono, and the favicon falls back to a classic .ico when the SVG is blocked. No change was needed to how the origin serves these files — they return the correct MIME types and were never the source of the 403.
  • IMPROVE Network Flow Matrix now saves your work in the browser and flags cleartext flows across trust boundaries. The Network Flow Matrix now keeps your zones and flows in this browser between visits (debounced autosave, with a “Clear saved data” button and an explicit note that nothing is sent to a server), so a segmentation or PCI-scoping matrix survives a reload. Validation now flags any allowed flow that carries a cleartext or credential-exposing protocol across a trust boundary — Telnet (→SSH), FTP (→SFTP/FTPS), HTTP (→HTTPS), SNMP v1/v2c (→SNMPv3), LDAP (→LDAPS), POP3/IMAP/SMTP without TLS, rlogin/rsh, VNC — and warns when a database/admin service (SMB, MS-SQL, MySQL, PostgreSQL, Redis, MongoDB) is reachable from an untrusted zone, each with the safer alternative. Port-to-service mapping follows the IANA registry; guidance follows NIST SP 800-52r2/800-123 and the CIS Benchmarks.
  • IMPROVE Firewall Rule Analyzer now reads Cisco IOS ACLs and stays fast on very large rulesets. The Firewall Rule Analyzer adds Cisco IOS access-list support — numbered standard/extended lists and named ip access-list blocks — converting wildcard (inverse) masks to CIDR and running the same shadowed/redundant/overly-permissive and sensitive-port checks it already applies to iptables, UFW and nftables. The rule-versus-rule analysis is now bounded (compared only within a chain, capped at 5,000 rules) so a large ruleset no longer freezes the tab; when the cap is reached it tells you exactly how many rules were set aside, and the per-rule checks still run on every line. Port operators it can’t prove (gt/lt/neq) and non-contiguous masks are treated conservatively so they never raise a false “shadowed” verdict.
  • IMPROVE SRI Hash Generator now does several files at once and writes the exact tag to paste. The SRI (Subresource Integrity) Hash Generator now takes multiple files in one go — each gets its own card with the filename, the integrity value and a ready-to-paste tag. A script / stylesheet toggle emits the right element (<script src… integrity… crossorigin="anonymous"> or <link rel="stylesheet" href…>), an editable filename field fills in the real src/href, and you can choose SHA-256/384/512 (384 default) or emit all three in one attribute. Hashing is over the raw bytes with standard base64, entirely in your browser for pasted and uploaded content. Changing the type, algorithm or filename re-writes the tag instantly without re-hashing.
  • IMPROVE HMAC Generator now takes hex/base64 keys and messages, hashes a file, outputs base64url, and verifies an expected MAC. The HMAC Generator lets you supply the message and the key as UTF-8 text, hexadecimal or base64 (so a raw-bytes key works, not just a passphrase), or drop in a file to HMAC its exact bytes. The result is shown as hex, base64 and base64url (URL-safe, unpadded), each with a copy button, for SHA-1/256/384/512. A new verify mode takes an expected HMAC in any of those encodings and does a constant-time, byte-for-byte comparison (so a truncated or wrong-length value can’t falsely match). HMAC is computed with the browser’s Web Crypto engine; nothing you enter leaves the page. Correctness is pinned to the RFC 4231 test vectors.
  • IMPROVE Nmap XML Parser now reads host-level NSE scripts, “not shown” port counts and exports structured JSON — and parses hostile files safely. The Nmap XML Parser now surfaces host-level <hostscript> results (e.g. smb-os-discovery, smb2-security-mode) with their <elem>/<table> detail, shows the per-host <extraports> summary (“994 closed port(s) not shown”), and adds an Export JSON button with a structured per-host/port/script object and a severity flag on each port (alongside the existing Markdown and CSV exports). IPv6-only hosts and host MAC/vendor are parsed correctly. It warns before parsing very large captures and caps the on-screen table at 1,500 rows (export for the full set). Because a scan file can come from an untrusted source, the parser is a hand-rolled, DOM-free reader that never resolves external or nested XML entities (no XXE, no “billion laughs”), handles a malformed or pathological file without freezing, and HTML-escapes all parsed values so crafted script output cannot inject into the page.
  • IMPROVE TOTP Generator now shows a scannable enrolment QR, imports otpauth:// URIs, and lets you tune the secret length and verification drift. The TOTP Generator renders the otpauth://totp/… provisioning URI as a QR code you can point an authenticator app at (SHA-1/256/512, 6–8 digits, custom period all carried through), and a paste box reads an existing otpauth:// URI back into every field so you can verify what a QR you were given actually enrols. A secret-length selector generates 20-, 32- or 64-byte (160/256/512-bit) secrets, and the code verifier now has a configurable ±N-step drift window (0–10) so you can match a server’s tolerance instead of a fixed ±1. A styling bug that tinted a valid verification result with the error colour is fixed. Everything runs in your browser; no secret leaves the page.
  • FIX Log Parser & Pattern Builder now produces valid patterns from its own examples, and analyses a whole sample. The Log Parser & Pattern Builder previously errored the moment you loaded its built-in example (the bundled Grok library used Oniguruma atomic groups and possessive quantifiers that a browser’s regex engine rejects, so %{COMBINEDAPACHELOG} and most real Apache/syslog patterns threw “Invalid group”). Patterns are now sanitised to browser-compatible regex before they run, so the Apache, syslog and ISO 8601 examples all compile and extract their fields. It also now tests every line of your sample (not just the first), shows a match rate and a per-field coverage table, and — when a line does not match — points at the first pattern token that failed. The SIEM field-extraction export no longer truncates fields whose sub-pattern contains parentheses.
  • FIX robots.txt Analyzer now follows RFC 9309, so its crawlability verdicts match real crawlers. The robots.txt Analyzer had two correctness bugs: consecutive User-agent lines were not treated as one shared group (so a rule written for several bots was applied to only the last), and Allow/Disallow precedence used “first Allow wins” instead of the RFC’s longest-match-wins (tie to Allow). Both are fixed, with full * wildcard and $ end-anchor support and most-specific user-agent selection, so a URL tested against a policy now returns the same ALLOWED/BLOCKED decision a real crawler would. Sitemap: values are only turned into links when they are valid http(s) URLs, and common non-standard directives (crawl-delay, host, clean-param, noindex, request-rate) are recognised rather than flagged as unknown.
  • IMPROVE CISSP question bank reworked for accuracy and fairness: corrected answers, authoritative citations, and less test-wise bias. A full review of the CISSP quiz bank (313 questions) corrected one keyed answer on media sanitisation to match NIST SP 800-88r1 (overwrite is Clear; Purge is ATA Secure Erase or cryptographic erase), re-pointed roughly fifty citations to the standard that actually defines the point (for example TACACS+ to RFC 8907, HMAC to FIPS 198-1, DoT/DoH to RFC 7858/8484, private address space to RFC 1918, email authentication to NIST SP 800-177r1), refreshed references to current revisions (NIST SP 800-61r3 and SP 800-63-4), and replaced four duplicated items with new cited concepts (pseudonymisation vs anonymisation, hybrid cryptosystems, gap assessment, threat hunting). Answer options were also balanced so the correct choice is no longer usually the longest — the longest-answer rate dropped from 67% to 28% — and several weak distractors were tightened. Still original, still randomised per play, nothing invented, not affiliated with ISC2.
  • IMPROVE CompTIA Security+ (SY0-701) practice-question bank expanded to 306 original questions cited to authoritative standards (NIST/RFC/OWASP) + the CompTIA SY0-701 exam objectives, randomised per play, nothing invented, not affiliated with CompTIA. The Security+ quiz bank grows from 81 to 306 questions, drawn in a fresh random order every play and distributed across all five domains by their official exam weights — General Security Concepts (12%), Threats, Vulnerabilities & Mitigations (22%), Security Architecture (18%), Security Operations (28%) and Security Program Management & Oversight (20%). Every question is original (we never reproduce real CompTIA exam items) and tests an objective from the public SY0-701 exam objectives, with the specific technical fact it turns on cited to an authoritative standard shown in the answer — NIST SP 800-series (800-53, 800-63B, 800-61, 800-88, 800-207, 800-41, 800-40), NIST FIPS (197 AES, 180-4 SHA, 186-5 signatures), IETF RFCs (8446 TLS 1.3, 5280 X.509, 6749 OAuth, 6238 TOTP, 4301 IPsec, 7489 DMARC), OWASP (Top 10, ASVS, cheat sheets), MITRE ATT&CK/CWE, CISA KEV, FIRST CVSS, ISO/IEC 27001 and the GDPR — while the CompTIA SY0-701 exam objectives supply the domain and objective structure and weights only. Nothing invented, not affiliated with or endorsed by CompTIA. Pick how many questions you want; it runs entirely in your browser.
  • IMPROVE CISSP practice-question bank expanded to 313 original questions, randomised per play, nothing invented. The CISSP quiz bank grows from 80 to 313 questions, drawn in a fresh random order every play and distributed across all eight domains by their official exam weights — Security and Risk Management, Asset Security, Security Architecture & Engineering, Communication & Network Security, Identity & Access Management, Security Assessment & Testing, Security Operations, and Software Development Security. Every question is original (we never reproduce real ISC2 exam items) and tests an objective from the ISC2 CISSP exam outline, with the specific technical fact it turns on cited to an authoritative standard shown in the answer — NIST SP 800-series (800-53, 800-63B, 800-37, 800-61, 800-88, 800-207), NIST FIPS (197, 180-4, 186-5, 199), IETF RFCs (8446 TLS 1.3, 5280 X.509, 4120 Kerberos, 6749 OAuth), ISO/IEC 27001/27002, OWASP and others — while the ISC2 exam outline supplies the domain and objective structure and weights only. Nothing invented, not affiliated with or endorsed by ISC2. Pick how many questions you want; it runs entirely in your browser.
  • FIX Tool tab strips no longer overflow on small phones. On narrow screens (around 320 px) the three-tab row on tools such as the QRadar AQL Assistant (Builder / Validator / Explainer) pushed a couple of pixels past the edge. The tab strip now scrolls sideways within its own bounds instead of nudging the page, so there is no stray horizontal scroll on any tool that uses the mode tabs.
  • IMPROVE NIST CSF 2.0 quiz expanded to 366 questions cited to NIST CSWP 29, randomised per play, nothing invented. The NIST CSF 2.0 bank grows from 84 to 366 questions, drawn in a fresh random order every play across all six domains — framework fundamentals, Tiers & Profiles, then the six Functions GOVERN (GV), IDENTIFY (ID), PROTECT (PR), DETECT (DE) & RESPOND (RS), and RECOVER (RC) with implementation resources. Every new answer is a well-established fact transcribed from the public-domain framework document and cited to a specific Function, Category or Subcategory — the Core’s 6 Functions, 22 Categories and 106 Subcategories, matching each Subcategory outcome (such as GV.OC-01, PR.DS-11 on backups, DE.AE-08 on declaring incidents or RC.RP-03 on verifying backup integrity) to its ID, and the four Tiers from Partial (1) to Adaptive (4). Nothing invented. Pick how many questions you want; it runs entirely in your browser.
  • IMPROVE NIST SP 800-53 Rev. 5 quiz expanded to 334 questions cited to NIST SP 800-53 Rev. 5, randomised per play, nothing invented. The NIST SP 800-53 Rev. 5 bank grows from 84 to 334 questions, drawn in a fresh random order every play across all six domains — catalog fundamentals & the Rev. 5 changes, access, identity & accountability (AC, IA, AU, PS), system & network protection (SC, SI, CM, MA, MP), resilience & response (CP, IR, RA, CA), program, acquisition & supply chain (PM, SA, SR, PL, PE, AT) and baselines, tailoring & privacy (PT). Every new answer is a well-established fact parsed from the control catalog of the public-domain publication — the 20 control families and their two-letter identifiers (Table 1), the title of each base control matched to its identifier and family (AC-6 Least Privilege, SI-2 Flaw Remediation, SC-7 Boundary Protection, SR-4 Provenance among them), the Rev. 5 changes (outcome-based controls, the new SR family, baselines relocated to SP 800-53B) and the glossary definitions of control enhancement, security control, common control, control baseline, tailoring and overlay. Nothing invented. Pick how many questions you want; it runs entirely in your browser.
  • IMPROVE DORA quiz expanded to 341 questions. The DORA bank grows from 84 to 341 questions, randomised per play across all five chapters — scope, governance & ICT risk management (Art. 1–16), incident management & reporting (Art. 17–23 and Delegated Regulation (EU) 2025/301), resilience testing (Art. 24–27), ICT third-party risk & oversight of critical providers (Art. 28–44) and information sharing, authorities & penalties (Art. 45–64). Every answer is cited to the specific Article of Regulation (EU) 2022/2554 — threat-led penetration testing at least every 3 years (Art. 26), the register of information (Art. 28(3)), periodic penalties on critical providers of up to 1% of average daily worldwide turnover for at most six months (Art. 35) — and the reporting clock of 4h/24h, 72h and one month (Delegated Regulation (EU) 2025/301, Art. 5); two existing answers on the intermediate and final report deadlines were corrected to match that text. Nothing invented. Pick how many questions you want; it runs entirely in your browser.
  • IMPROVE NIS2 quiz expanded to 306 questions cited to Directive (EU) 2022/2555, randomised per play, nothing invented. The NIS2 bank grows from 84 to 306 questions, drawn in a fresh random order every play across all six domains — scope, sectors & entity classification (Art. 2–3, 6, Annexes I–II, 26–28), governance & risk-management measures (Art. 20–25), incident reporting (Art. 23, 30), supervision, enforcement & penalties (Art. 31–37), EU cooperation, CSIRTs & vulnerability disclosure (Art. 7–19, 29) and relationship to other law, timeline & implementation (Art. 1, 4–5, 38–46). Every new answer is a well-established fact drawn from the public text of the Directive and cited to the specific Article — the 24-hour early warning, 72-hour notification and one-month final report (Art. 23), the two fine tiers of at least €10M/2% for essential and €7M/1.4% for important entities (Art. 34), the ten baseline measures (Art. 21(2)) and the 17 October 2024 transposition / 18 October 2024 application dates (Art. 41) among them. Nothing invented. Pick how many questions you want; it runs entirely in your browser.
  • IMPROVE GDPR quiz expanded to 300 questions. The GDPR bank grows from 86 to 300 questions, drawn in a fresh random order every play across all six chapters — principles & lawful bases (Art. 5–10), data-subject rights (Art. 12–22), controller & processor duties (Art. 24–36), the DPO & accountability (Art. 37–39), international transfers (Art. 44–50) and scope, supervision, remedies & fines (Art. 1–4, 51–84). Every new answer is a well-established fact drawn from the public text of Regulation (EU) 2016/679 and cited to the specific Article — the 72-hour breach notice (Art. 33), the two fine tiers of €10M/2% and €20M/4% (Art. 83), the one-month response to rights requests (Art. 12), the Art. 28(3) processor-contract terms and the Art. 46 transfer safeguards among them. Nothing invented. Pick how many questions you want; it runs entirely in your browser.
  • IMPROVE CRA quiz expanded to 316 questions. The Cyber Resilience Act bank grows from 84 to 316 questions, randomised per play across all six themes — scope, definitions & exclusions (Art. 1–5), the essential cybersecurity requirements (Annex I Part I and Art. 6, 13), vulnerability handling, the SBOM & the support period (Annex I Part II and Art. 13, 24), reporting obligations (Art. 14–17), conformity, CE marking & product classes (Art. 7–8, 27–33 and Annexes III–VIII) and governance, enforcement, penalties & timeline (Art. 18–23, 35–71). Every answer is cited to the specific Article, paragraph/point or Annex of Regulation (EU) 2024/2847 — the 24h early warning, 72h notification, 14-day (vulnerability) and one-month (incident) final reports to the CSIRT coordinator and ENISA (Art. 14), the five-year minimum support period (Art. 13(8)), the three fine tiers of €15M/2.5%, €10M/2% and €5M/1% (Art. 64), and the dates it applies — generally from 11 December 2027, with the Art. 14 reporting duties from 11 September 2026 (Art. 71). Nothing invented. Pick how many questions you want; it runs entirely in your browser.
  • IMPROVE Domain Availability Checker: simpler, with registry restriction notes. The Domain Availability Checker drops the TLD-group checkboxes for one TLDs for base names field (default com net org), with a live counter (“2 names × 3 TLDs = 6 / 100”). Every available result gets a one-click Copy button, and domains on restricted registries — .eu, .it, .ie, .fr, .es and more — now show a plain-language Restricted note (e.g. “EU/EEA residents only”) in the table and in the CSV/JSON/TXT exports. Still stateless: nothing you type is stored or logged.
  • NEW NIST SP 800-53 Rev. 5 quiz. The GRC quiz adds NIST SP 800-53 Rev. 5 — the U.S. security and privacy control catalog — as a full bank of 80+ questions drawn in a fresh random order every play. It covers the 20 control families (AC, IA, AU, SC, SI, CM, CP, IR, RA, CA, PM, SA, SR, PT and more), the Rev. 5 changes (outcome-based controls, the new PT and SR families, baselines relocated to SP 800-53B), canonical controls such as AC-6 least privilege, SI-2 flaw remediation and SC-7 boundary protection, and how baselines, tailoring and overlays fit the Risk Management Framework. Every answer is drawn from the public-domain NIST publication and cited to a specific control or family. That makes seven GRC topics in all — browse them at /en/grc/quiz.
  • NEW NIST Cybersecurity Framework 2.0 quiz. The GRC quiz adds the NIST CSF 2.0 — a full bank of 80+ questions, randomised every play, across the six Functions (Govern, Identify, Protect, Detect, Respond, Recover) and their Categories and Subcategories, plus the Tiers (Partial→Adaptive) and Organizational/Community Profiles. Every answer is drawn from NIST CSWP 29 (the public-domain framework document) and cited to a specific Function, Category or Subcategory. That makes six GRC topics in all — browse them at /en/grc/quiz.
  • NEW NIS2 and Cyber Resilience Act quizzes. The GRC quiz adds two more EU instruments, each a full bank of 80+ questions drawn in a fresh random order every time: NIS2 (Directive (EU) 2022/2555 — scope and essential/important entities, the Article 21 risk-management measures, the 24h/72h/one-month incident reporting, supervision and fines, EU cooperation and coordinated vulnerability disclosure) and the Cyber Resilience Act (Regulation (EU) 2024/2847 — products with digital elements, the secure-by-design essential requirements, vulnerability handling and the SBOM, the Article 14 24h/72h reporting, CE marking and the 2026/2027 timeline). Every answer is a well-established fact cited to a specific article. That makes five GRC topics in all — browse them at /en/grc/quiz.
  • NEW GDPR and ISO/IEC 27001 quizzes, and bigger banks. The GRC quiz now covers three topics, each a full bank of 80+ questions drawn in a fresh random order every time you play: GDPR (Regulation (EU) 2016/679 — principles and lawful bases, data-subject rights, controller/processor duties, the DPO, international transfers, supervision and fines), ISO/IEC 27001 (the ISMS clauses 4–10, risk management and the Statement of Applicability, the Annex A controls, the certification cycle, and the 27000 family — 27002/27005/27017/27018/27701), and an expanded DORA bank (now 84 questions). Every answer is a well-established fact cited to a specific article, clause or control; the ISO questions describe the standards’ public structure and do not reproduce their copyrighted text. Browse them at /en/grc/quiz.
  • NEW New GRC & compliance quiz, starting with DORA. A sister quiz to the certification practice tests, but for EU regulations and security frameworks: a DORA question bank (Regulation (EU) 2022/2554), tagged by chapter — ICT risk management, incident reporting, resilience testing (TLPT), third-party risk and information sharing. Every answer is a fact cited to a specific article, with quiz and flashcard modes and per-chapter scoring. It runs entirely in your browser; GDPR, NIS2, ISO 27001 and more to follow. Start at /en/grc/quiz.
  • CONTENT Five more Security+ practice questions. The CompTIA Security+ bank grew from 76 to 81 questions, each written from an authoritative public source with the citation shown in the answer: incident-response phases (NIST SP 800-61r2), SIEM log correlation (SP 800-92), password policy (SP 800-63B), risk-based patching (SP 800-40r4) and business email compromise (CISA). Practise them at /en/certifications/quiz.
  • IMPROVE Clearer, more accessible certification quiz. After you answer, the correct and the chosen option now carry a ✓/✗ marker (not colour alone), the progress bar fills as you go, the Quiz/Flashcards switch is keyboard-navigable with arrow keys, and the domain label no longer shows a blank name. At /en/certifications/quiz.
  • CONTENT 20 new SOC cheat sheets. Added quick references for security operations: Windows security event IDs & logon types, PowerShell logging, Wireshark/tshark, QRadar AQL, auditd, journalctl, rsyslog, Winlogbeat, DNS log analysis, email-header analysis, MITRE ATT&CK, IOC enrichment, ss, Windows persistence locations, ransomware & account-compromise triage, lateral-movement detection and CyberChef recipes — now 95 sheets at /en/cheatsheets.
  • FIX More tools fit narrow phones without sideways scrolling. Fixed 375px horizontal overflow on the Favicon Generator, YARA Rule Builder, Resource Health, Password Policy Tester, CSF Tier Assessment, CVE Feeds, Base Converter, AES Encryptor, Risk Matrix Builder and CSF Profile Builder.
  • FIX No more sideways scrolling on narrow phones. The “client-side” notice on Kaidoku and the Network Flow Matrix, and long links in this changelog, now wrap properly instead of pushing the page wider than the screen at 375px.
  • IMPROVE Certifications hub: the free practice quizzes are now one click from the top of the page. The hub links straight to the Security+ and CISSP question banks and flashcards from its header, instead of only deep inside each certification’s section.
  • FIX Old cheat-sheet links no longer hit a dead end. A request to /cheatsheet (with or without a sheet name) now redirects to the current /en/cheatsheets section instead of showing “not found”.
  • FIX Phishing Checker: tidier related-hostnames messages. A message that already ends with a full stop no longer gets a second one.
  • FIX Phishing Checker and DNS Mapper: certificate-log lookups accept only valid domain names. A malformed name is now refused before anything is sent to crt.sh, instead of being cleaned up into a different name, and the Phishing Checker no longer offers a pointless “Try again” for it.
  • NEW Phishing Checker: takedown contacts, takedown re-check, QR codes and related hostnames. The takedown request is now addressed for you: the platform’s abuse form for sites on github.io, pages.dev and similar, otherwise the hosting network’s abuse address from its regional internet registry, with the registrar’s in copy, each with its source. Re-check a takedown loads an earlier JSON export, scans the address again and says whether the page was taken down, is still online, or changed; nothing is stored on our side. Scan a QR code image (or paste a screenshot) decodes the code in your browser and scans the address it hides. For dangerous results, other hostnames under the same domain found in certificate transparency logs are added to the indicators as “related, unverified”.
  • IMPROVE Homepage: “Your usual” is now “Your tools”, easier to read and to use. The row of tools you pinned or used recently now looks like the other homepage rows: readable cards, pinned tools first with a 📌, and on a phone one row you swipe sideways instead of a tall pile. Every tool page has a 📌 Pin button next to its title, so pinning no longer needs the Ctrl K palette (which phones do not have). “Clear” can now be undone for a few seconds. As before, the list stays in your browser only: tool names, never what you typed or got back.
  • SITE Homepage: “Recently updated” instead of two “new tools” rows. The homepage showed the newest tools twice, in “Recently added” at the top and “New on the menu” further down. They are now one row, Recently updated, that also shows tools that just gained a feature: each card says “Updated” with what changed, or “New” with the date the tool arrived. The details of every change stay here in the changelog.
  • NEW Phishing Checker: results ready to paste into a ticket. Under the verdict of the Phishing Checker, a new panel prepares the texts a security team writes after checking a reported link: a ticket note (verdict, every check, what was not covered, indicators, next steps, ATT&CK reference), an email to the person who reported it (dangerous, suspicious or no warning signs, with what to do), a short status message for the team chat and, for dangerous or suspicious links, a takedown request for the hosting provider. Edit the text if needed, then copy it with one click. Addresses are written defanged (hxxps://example[.]com) so nobody opens them by accident. The TXT, JSON, PDF, CSV and HTML downloads moved up next to it; the JSON now starts with a stable summary block, the PDF and HTML reports include the screenshot from the isolated browser instead of loading an image from a third party, and all reports label the score from the address alone as a quick check, not the verdict.
  • FIX Phishing Checker: more free hosting platforms recognised. Sites on Tencent EdgeOne Pages (edgeone.dev), Dothome (dothome.co.kr) and Contabo server host names (contaboserver.net) are now treated like github.io or pages.dev: anyone can get an address there, so the Phishing Checker no longer shows the platform’s own registration date as the age of the site, and two sites on the same platform are no longer counted as the same site.
  • IMPROVE Phishing Checker: the answer comes first. Results of the Phishing Checker now open with one verdict (red ✗ dangerous, amber ! suspicious, green ✓ no warning signs) and a checklist of what was checked: blocklists, fake login page, where the data goes, antivirus, encryption, domain age, redirects, page content and the browser visit. Each row says what was found and links to its details, which are now folded underneath. A green check means that check found nothing, not that the site is safe, and checks that could not run are marked as not checked. The score from the address alone no longer sits on top, where it could show “Low risk” for a listed phishing page. Exports start with the same summary.
  • IMPROVE Phishing Checker: every deep scan now opens the page in an isolated browser. Many phishing kits build their login form with JavaScript, so a plain download of the page shows nothing suspicious. The Phishing Checker now also opens the link once in a headless Chrome on a separate server: a fresh container for each visit, deleted afterwards, with no access to our network. The report shows where the browser ended up, the forms and password fields it found, the hosts the page contacted and a screenshot, and runs the same phishing checks on the page as the browser saw it. Testing on 30 live phishing links and 32 real login and banking pages also led to new rules that apply to every scan: a password field outside a form now counts as a login form (kits often send it by script), Cloudflare’s own “Suspected phishing” warning page is recognised, and OneDrive, SharePoint, WeTransfer and Spotify lookalikes are detected. Without the blocklists, 18 of the 30 phishing links now score as suspicious (9 before), with still no false alarm on the 32 real sites. Kits that hide from automated browsers can still look harmless, and the report says so. We log only the host name and duration of each visit, for 14 days.
  • FIX Clearer message for internal IPv6 addresses. When you give a URL tool (such as the Phishing Checker) an IPv6 address in brackets, like http://[::1]/, it now says the address is on an internal network instead of saying the host name does not resolve. These addresses were already refused; only the explanation was wrong. Public IPv6 addresses in brackets can now be checked.
  • IMPROVE Phishing Checker: antivirus scan, blocklist lookup and fewer false alarms. The Phishing Checker now scans the page it fetches — plus up to six of its scripts and frames, or the file itself when the link is a download — with ClamAV running on our own server, and shows the SHA-256 and MD5 of each object so you can look them up elsewhere. Every URL in the redirect chain is also checked against three public blocklists (URLhaus, OpenPhish, Phishing Army), held on our server and updated every hour: nothing you submit is sent to a third party. A match on a blocklist or an antivirus signature gives a “Known malicious” verdict; everything else is still a heuristic score, and the report now lists any check that could not run instead of scoring it as safe. Accuracy fixes found by testing against real banking, webmail and login pages: domains are now worked out with the Public Suffix List (so www. redirects and co.uk-style domains are no longer “different sites”, and github.io-style shared hosts are recognised), security headers are graded on the final page rather than the first redirect, the TLS check now verifies the certificate chain and host name, a freshly renewed certificate is no longer a warning, and tag-manager iframes and hosting providers no longer add points.
  • SITE Guidance for network administrators. The home page now explains our allow-list stance: CyberRamen is a defensive, blue-team resource whose tools run entirely in your browser, so it is safe to allow for security, SOC and GRC teams — while offensive / red-team tooling lives on a deliberately separate domain, offensiveramen.com, that you can restrict to your pentest team. Set policy per site.
  • NEW Cheat Sheets: 75 plain-text quick references for defenders. A new Cheat Sheets section collects fast references for the blue-team, DFIR and admin work you actually do — detection engineering (Sigma, YARA, Suricata, Zeek), SIEM and KQL (Splunk, Sentinel, Defender), forensics (Volatility, Autopsy, Linux and memory forensics), cloud & container security, compliance (DORA, NIS2, ISO 27001, SOC 2) and everyday Linux/Windows commands. Each sheet is its own page you can read, search or print — no login, no tracking. They come from our older cheatsheet.johlem.net site; offensive / red-team sheets live on OffensiveRamen.com.
  • SITE The red-team tools moved to their own site. Five offensive tools — Recon / OSINT Helper, Google Dork Builder, LOLBin / GTFOBins Browser, Reverse Shell Generator and the Hashcat / John rule & mask builder — now live on our sister site OffensiveRamen.com. Keeping them on a separate domain lets an organisation allow cyberramen.com for its SOC and GRC teams while scoping the offensive tools to its pentest team, and keeps this site cleanly classifiable as a defensive resource that corporate proxies do not block. Your old links redirect there automatically, nothing else changed, and the Reverse Shell glossary entry now walks through how to detect one with our ATT&CK, Windows Event ID and Sigma tools.
  • IMPROVE Every tool page now suggests three related tools. The “From the same menu” box at the bottom of a tool page, with three tools from the same category, was only on 27 of the 148 tools. It is now on all of them.
  • IMPROVE The Tools Hub is quicker to find your way around. The Tools Hub now opens with two short rows: Start here, six good first tools (security headers, email security, phishing, CVSS 4.0, JWT, NIS2), and Recently added, the newest tools with the date they arrived; the homepage has a matching Recently added row. Long categories show their first six tools with a Show all button. The category buttons now stay in one row at the top of the screen as you scroll, take you straight to a category, and highlight the one you are reading; on a phone the Categories button does the same and shows where you are. Two fixes to the filter chips (client-side only, exports CSV, soc, …): switching a chip off now brings the hidden tools back, and typing a search no longer clears the chips from the page address, so a filtered search can be bookmarked and shared.
  • IMPROVE Tools Hub cards are easier to scan. Every card on the Tools Hub and the homepage used to carry a “FREE” label; every tool here is free, so the label said nothing and has gone. What remains on each card is the useful part: whether the tool runs in your browser or needs our server. Descriptions on the hub are cut at two lines, so a category reads as a list rather than a wall of text (open a tool for the full description; the Lab cards, which warn that your data goes to a third party, are never cut). Twenty-five tools that shared the same magnifying-glass or robot icon now each have their own. The “From the same menu” suggestions at the bottom of each tool now follow the new categories, and old hub links with a retired category name show the whole menu instead of an empty page.
  • IMPROVE The Tools Hub menu, reorganised around what you are working on. The 148 tools were spread across categories that mixed four different ideas at once — how important a tool is, who you are, which domain it touches, how new it is — so tools often sat where you would not look for them. They are now in twelve categories along a single axis, what you are working on: Email & Phishing, Web & Domain Security, Network & DNS, Detection & SOC, Incident Response & Threat Intel, Vulnerability Management, Crypto, Keys & Passwords, GRC & Compliance, Cloud Security, AI Security, Dev & Everyday Utilities and Offensive / Red Team. The plain-English name now leads, with the ramen name kept as a second label. Every tool sits in exactly one category, the same name is used in the menu, the filter pills, the mega-menu and the footer, and no tool address changed.
  • NEW Six SOC and network tools join the menu. The QRadar AQL Assistant builds, validates and explains Ariel queries; the SIEM Query Template Library gives the same hunt in Splunk SPL, Sentinel KQL and QRadar AQL; SOC Alert Triage walks an alert through a decision tree to a disposition, with a risk score, next queries and ATT&CK references; SecOps Response Templates holds 105 incident, phishing and change emails and ticket texts; the Firewall Rule Analyzer finds shadowed and overly permissive iptables, UFW and nftables rules; and the Network Flow Matrix maps authorized flows between zones and checks them against policy. All run in your browser. They come from our older lab site, lab.johlem.net: its security tools now live here, and each old lab link redirects to the matching page.
  • NEW Email Security Checker now checks MTA-STS and TLS-RPT. Besides SPF, DKIM, DMARC and MX, the Email Security Checker reads the _mta-sts and _smtp._tls records, fetches the MTA-STS policy file from the domain’s mta-sts host, reports its mode, and checks that every mail server is covered by the policy. It also explains a common failure: a policy host that no longer resolves. Both are shown next to the score but do not change it.
  • NEW PGP Key Lookup now checks the sender’s own domain (WKD) and Mailvelope, and can compare every source. Besides keys.openpgp.org and keyserver.ubuntu.com, the PGP Key Lookup now asks the email domain’s Web Key Directory, where only the domain owner can publish, and keys.mailvelope.com. Compare every source asks all four and flags any that hold a different key for the same address. This matters: for some well-known addresses keyserver.ubuntu.com returns dozens of keys that anyone could have uploaded. Fingerprints are computed on our server from the returned keys, and your IP is still never forwarded. A new guide, PGP Keys: find, verify and publish, compares the four sources and walks through checking a fingerprint and publishing your own key with WKD.
  • CONTENT Most-used tools gained a how-to, a guide to the results, and an FAQ. Our most visited tools now explain how to use them, what each part of the result means and what to do about it, with answers to the questions people actually search for. The homepage lists the tools used most this month, taken from the public visitor stats.
  • SITE Public visitor stats, without adding any tracking. /en/stats shows visitors per day, the most viewed pages and where visitors come from. The numbers come from the web server’s standard access log, reduced once a day to totals; no IP address, browser signature, full referrer or query string is stored, and no script, cookie or beacon was added. How it is counted is explained on the page, and the privacy notice was updated to match.
  • NEW A new homepage: paste anything, today’s set, and the tools you use most. The hero now takes whatever you have in hand — a URL (defanged or not), IP, domain, hash, JWT, CVE or raw email headers — recognises it in your browser and suggests the one to three tools that take it; the value travels in the URL fragment (#input=…), which never reaches our server, and the tool clears it from the address bar once read. The same detection works in the Ctrl K palette (also on /), where Tab pins a tool. The old order ticket is replaced by Today’s set: each day, the CVE added to the CISA KEV catalog in the last week with the highest EPSS score (known ransomware use breaks ties), with its CVSS, KEV due date and a vendor advisory, plus a chef’s pick from the menu — with a permalink per day and an Atom feed. It is computed once a day on our server from CISA and FIRST; if a fetch fails the last good pick stays with its real dates, and it disappears after 48 hours without fresh data rather than going stale. EPSS Score Lookup now draws the 30-day trend for a single CVE. “Your usual” shows your pinned and recent tools (names only, in this browser; manage or clear them). The Tools menu lists every category with its count and description, role shortcuts (SOC analyst, pentester, GRC, developer) sit under the search box, and workflows moved to /en/workflows — old links redirect, and each IR Flow playbook has its own address.
  • FIX Six more tools were labelled client-side but use our server; every tool now says exactly where it runs. Each tool in the manifest now carries one of three labels, decided by reading its code: in-browser (nothing is sent to our server), server-assisted (it runs in your browser, but one feature calls our server — the Phishing Checker deep scan, the bcrypt mode of the Password Security Suite, the URL modes of the SRI Generator and Page Content Audit, and the URL scan of the HTTP Security Headers Grader) or server-only. The audit found six tools that called our server while claiming to run in your browser: the HTTP Security Headers Grader (URL scan), DNS Record Lookup, Email Security Checker, CAA & HSTS Preload Checker, Domain Availability and the Password Hash Verifier; Security Feeds, which our server fetches, is now marked server-only too. The footer note and the privacy notice are now generated from the same field, so they cannot drift from the labels again, and a wider test catches any tool page that calls our server while marked in-browser. The “all tools are client-side” wording in llms.txt, the web app manifest and the search page is gone.
  • IMPROVE Certification quiz: every new question now shows its source. The practice quizzes gained an editorial layer. Each question can now carry the exam objective it maps to, a topic, a question type and difficulty, per-choice rationales, and one or more primary sources — and after you answer, the objective and those sources appear under the explanation, linked, so you can check the claim against NIST, an RFC, OWASP, MITRE, CISA or the regulation itself instead of taking our word for it. The rules are enforced rather than aspirational: a source must be https and name its publisher, dates must be real dates, review dates cannot run backwards, and partial metadata is rejected outright, because a half-filled record looks sourced without being sourced. Questions can also be retired with a stated reason — they stay in the file for provenance and are never served again. The house lint now reports, per bank, how many questions are sourced, how many objectives are mapped, and the gap to target for each exam domain. Fixing that reporting immediately caught a real error: the Security+ blueprint weights in our data summed to 97 %, because “Security Program Management and Oversight” was recorded as 17 % instead of the official 20 %; the lint now fails any bank whose weights do not total 100. Both banks grew, with every new question fully sourced and distributed by official domain weight rather than evenly. Security+ goes from 40 to 76 — more on Security Operations (28 %) and Threats & Vulnerabilities (22 %), fewer on General Security Concepts (12 %). CISSP goes from 40 to 80, weighted across all eight domains (7 new on Security and Risk Management at 16 %, 4 each on Asset Security and Software Development Security at 10 %), covering professional ethics and canon precedence, quantitative versus qualitative risk, risk avoidance, the policy-standard-procedure-guideline hierarchy, STRIDE, fourth-party supply-chain risk, the BIA as the prerequisite for recovery objectives, custodian versus owner, media sanitisation and data remanence, data minimisation, Biba and Brewer-Nash, Diffie-Hellman, the reference monitor, side-channel attacks, stateful inspection, VLAN hopping, IPsec tunnel mode, S/MIME end-to-end mail, software-defined networking planes, OpenID Connect on OAuth, Kerberos ticket-granting, attribute-based access control, the identification-authentication-authorisation sequence, biometric crossover error rate, static versus dynamic testing, fuzzing, rules of engagement, accountability through unique accounts, board-level reporting, recovery sites, differential versus incremental restores, need to know, event correlation, egress filtering, allowlist input validation, pipeline secrets, DevSecOps and source code escrow. Topics added include tokenisation, certificate trust, forward secrecy, on-path and credential-stuffing attacks, CSRF and SSRF, TOCTOU race conditions, KEV-driven prioritisation, jump servers, immutable backups, synchronous replication, SOAR, credentialed scanning, order of volatility, containment and eradication, cryptographic erase, log integrity, risk appetite, agreement types, controller vs processor, and audit evidence. And the original 80 questions were retrofitted to the same standard, so every question in both banks now carries its objective and a primary source — 156 of 156, with 70 distinct exam objectives mapped. With no unsourced questions left, both banks were switched into strict mode: a new question that does not carry the full editorial record is now rejected by the build, not merely reported. Still community-written and still not official exam material.
  • IMPROVE Tools now link back to the glossary. The two-way linking is complete: each glossary term already lists the tools it relates to, and now every tool page carries an “In the glossary” strip pointing at the plain-language explainers for the concepts it works with — the JWT Decoder links to JWT and HMAC, the Nmap XML Parser to port scanning and CIDR, the CVSS Calculator to CVSS, CVE, EPSS and SSVC, and so on across 69 tools. It is generated from the same data as the term pages’ related-tool cards, so the two directions can never drift apart.
  • CONTENT Sixteen new glossary terms — the acronyms and techniques our tools already speak, now defined. The Security Glossary grows from 31 entries to 47, each a full page ending in a worked example against a live CyberRamen tool rather than a paraphrased Wikipedia line. Where a heavily-used tool is a product (Nmap, Sysmon), the term is written as the concept and links out to the tool catalog, which is where tool-level reference belongs. Scoring & Metrics: CVE (the identifier itself — not a severity — triaged end-to-end through EPSS, KEV and the CPE builder) and SSVC (CISA's Track / Track* / Attend / Act decision tree, walked in the tool until one changed answer moves the outcome). Frameworks & Standards: the NIST Cybersecurity Framework 2.0 (the six Functions incl. the new Govern, Profiles vs Tiers, scored in the profile builder). Protocols & Acronyms: JWT (signed ≠ secret, the alg:none and weak-secret traps in the decoder), TOTP (why the six-digit code rotates and why servers forgive one window of clock drift), HSTS (the preload eligibility rules, checked against a real domain) and a security reading of HTTP status codes (401-vs-403 account enumeration, 429 as a rate-limit control, the 3xx open-redirect trap, leaky 5xx). Cryptography & Hashing: AES-GCM (authenticated encryption — tamper a byte and decryption fails), HMAC (reproducing a webhook signature check) and the X.509 certificate (subject vs issuer vs SAN, the chain of trust, CSRs). Threat Intel: the YARA rule (strings plus a bounded condition, test-matched before deploy) and the Windows Event ID (4624/4625/4688/4104, logon-type decode, and where Sysmon fits). Techniques & Tradecraft: prompt injection (direct vs indirect vs jailbreak, explored against a local simulator), OSINT (the passive footprint an attacker builds before touching you), port scanning (open/closed/filtered, exposure vs vulnerability, read through the Nmap XML Parser's severity hints) and the reverse shell (why the victim connects out and beats the inbound firewall — for authorized testing). Every page carries DefinedTerm structured data, related-term and related-tool links, and the standing “informational only” note.
  • NEW LLM Output Scanner — the model answered; now check what came out of the pot. The Pre-flight Redactor stops sensitive data going into a model; the new LLM Output Scanner looks at what came out. Paste a chatbot answer, a generated report or a drafted customer reply and get three things: the personal data the model reproduced from its context or training data (e-mails, phones, IBANs, Luhn-valid card numbers, IPs, internal hostnames, session ids — masked, with a per-row reveal), the credentials it reproduced (the same forty-rule set as the Secrets & Credential Leak Scanner), and every URL, DOI, arXiv id, CVE, RFC, regulatory article, author–year citation, numbered reference and quoted figure as a verification checklist. That last part is deliberately a checklist and not a verdict: the page cannot fetch anything (nothing leaves your browser, check the Network tab), so it never claims a citation is real or invented — it asks the question that matters (“this output cites 6 sources — have you verified each one resolves and actually supports the claim made?”), links each item to the place a human can check it (a GDPR or DORA article opens the Compliance Reference Database on that article, a CVE opens NVD, a DOI opens doi.org, an RFC the RFC Editor) and keeps count as you tick them off. A redacted copy and a masked Markdown review report with the [x] / [ ] checklist round it off; no draft, no history, nothing stored. Under the hood the PII detectors that used to live inline in the Pre-flight Redactor are now one shared library that the Redactor, the Log Snippet Anonymizer and this scanner all consume (the Anonymizer keeps its consistent pseudonyms; one side effect: 2001:db8::1 is now matched whole instead of stopping at the ::). And the Vendor Risk Questionnaire’s AI / ML governance bank grew from four to ten questions for AI vendors: where inference runs and what is retained there, a contractual training opt-out rather than a settings toggle, model / system cards, human oversight before a decision touches an individual, use-case evaluation (bias, hallucination rate, prompt-injection robustness), model-incident notification, and the full AI sub-processor chain in the DORA sub-outsourcing sense — and the register hand-off ticks that bank automatically for a vendor filed as an AI / ML service.
  • NEW Certification quiz & flashcards — cram your noodles before exam day. The Certifications Hub gains a study side: practice quizzes and flashcards, starting with CompTIA Security+ (SY0-701) and CISSP (2024 outline), 40 questions each, tagged by exam-blueprint domain. Quiz mode: pick 10 / 25 / 50 / all questions and the domains you want, options are shuffled on every attempt, each answer gets the reason the right one is right and why the tempting one is wrong, and the session ends with a per-domain score that names your weakest domain and lets you review what you missed. Flashcard mode flips the same bank as cards with “got it” / “review again”, and a card you mark for review comes back a few cards later. A coverage view shows how many questions the bank has per domain next to the exam weight — thin bars are where contributions help most. Scores are forgotten at the end of the session unless you tick “Remember my last score”, which uses the local persistence layer (this device only). Every bank carries its blueprint version, the date it was last reviewed and a plain disclaimer: this is community-written, best-effort material, not affiliated with CompTIA or ISC2 and not a substitute for the official objectives; a Suggest a question link on every page goes straight to us, and contributors are credited here with their permission. Behind it is one shared quiz engine that the Password Hygiene quiz now runs on too; the CVSS Calculator points CISSP candidates at Domain 3, certifications with a bank link to their quiz from the hub, and each training lab now links the certifications it names.
  • NEW Swiss FADP (nLPD / revDSG) joins the Compliance Reference Database, with a GDPR mapping — and a Swiss-grade broth check. The site is hosted in Switzerland, so the Swiss data protection act deserved more than a footer line. The Compliance Reference Database now carries 18 entries for the revised Federal Act on Data Protection (SR 235.1, in force 1 September 2023): scope and principles, privacy by design, data security and the Ordinance's minimum measures, processors, the optional data protection advisor, the Swiss representative, the processing register and its small-company exemption, disclosure abroad and the Federal Council's own adequacy list, the duty to inform, automated decisions, DPIA and FDPIC consultation, breach notification to the FDPIC, access and portability, supervision and the criminal fines on natural persons. Select the FADP pill and a side-by-side table maps every obligation to its closest GDPR article with the difference that matters — a high-risk threshold and “as soon as possible” instead of any risk and 72 hours for breaches, an advisor that is optional where the GDPR's DPO is mandatory, an adequacy list that is not the EU Commission's, criminal fines on people instead of administrative fines on companies. The same mapping shows as “Maps to” on the GDPR and FADP cards, and following a cross-framework reference widens the framework filter for you. The new Swiss FADP (nLPD) Self-Assessment mirrors the NIS2 one — 29 items in nine obligation areas, status-scored, browser-local progress with encrypted backup, Markdown / CSV / JSON export — and every gap that a GDPR control usually covers says so, with the Swiss point to re-verify, so you do not build the same control twice. Both carry a visible “content reviewed” date because FDPIC guidance is still moving; reference material, not legal advice. Our own privacy notice now points at the entries it is written under.
  • NEW Secrets & Credential Leak Scanner — found your API key sitting in the broth. Paste code, a .env or config file, a CI pipeline, logs or a chat export into the Secrets & Credential Leak Scanner (or drop a file up to 5 MB) and get every secret-looking value with a confidence tier (how specific the format is: an AKIA… key or a PEM header is high, credentials in a URL medium, a password= heuristic low) and a severity (blast radius if real: a Stripe live key is critical, a test key is low), plus a one-line rotation note and the provider's rotation docs. Forty patterns cover AWS, Azure, GCP, DigitalOcean, Vault, GitHub (classic and fine-grained), GitLab, npm, PyPI, Docker Hub, CI variables, Slack, Discord, Telegram, Stripe, SendGrid, Twilio, OpenAI / Anthropic, Mailgun, Mailchimp, Shopify, Square, age, PEM and PuTTY private keys, JWTs, Basic-auth URLs, Authorization headers and high-entropy assignments. Documentation values (AKIAIOSFODNN7EXAMPLE, your-api-key-here, ${VAR}) are set aside so a tutorial snippet does not cry wolf. Findings are masked on screen with a per-row reveal; “Redact all” produces a shareable copy as type placeholders, partial masks or removals, and a masked Markdown report for the ticket. This one is stricter than the rest of the site: no draft save, no history, no hand-off — nothing is stored anywhere, and you can watch the Network tab to check. Under the hood the rule set is one shared module that the LLM Pre-flight Redactor and the Log Snippet Anonymizer now use for their secret detectors too (the pre-flight redactor gained a “other cloud / SaaS keys” group; the log redactor's placeholders now name the key type), and the phishing and ransomware IR Flows point at it when leaked credentials are on the table.
  • NEW Policy Document Generator: from raw ingredients to a document your auditor can actually eat. The Policy Document Generator drafts the eight policies an ISO 27001, NIS2 or DORA reviewer asks to see first — Information Security Policy, Acceptable Use, Access Control, Incident Response, Third-Party / Supplier Security, Data Classification & Handling, Business Continuity, Password & Authentication — in a three-step wizard: organization basics (shared across all eight, they fill the document control table), the frameworks to align to (ISO 27001, NIS2, DORA, GDPR, PCI DSS), and a handful of scoping questions per document that actually change the text (is MFA mandatory for remote access? NIST passphrases or traditional complexity? how many classification levels?). Every document is assembled from one tagged clause library of 131 statements rather than eight hard-coded templates: a statement comes in when its framework is ticked or your answers switch it on, each carries the Annex A control / article / requirement it helps satisfy, and an appendix maps every statement to the selected frameworks. Untick any statement, add your own sections, then copy Markdown, download it, copy a plain-text version for Confluence or SharePoint, or print to PDF. The legal disclaimer sits above the wizard and inside every document: these are starting points, not legal advice — your legal and compliance functions review them before adoption. Drafts stay in the tab unless you opt into the browser-local persistence layer (one case holds the organization profile and all eight drafts; encrypted backup included). Cross-links: the Compliance Reference Database now says which policy typically evidences a control in each domain, the DORA checker points policy gaps at the generator, the Password Policy Tester links to the authentication policy it can score, and the Third-Party Risk Register hands its tier vocabulary to the supplier policy in one click.
  • NEW TPRM toolkit: a Third-Party Risk Register, and the Vendor Risk Questionnaire learns to tier. The new Third-Party Risk Register is the small, honest version of a vendor-risk platform: one row per ICT third party with a criticality tier, status (not started → questionnaire sent → under review → approved / with conditions / rejected), applicable frameworks, last assessment, next review and contract end dates, and open findings with severity, owner and due date. The tier is not a guess: four DORA-style questions (would its failure impair operations, does it hold sensitive data, is it hard to substitute, is it in a critical path) give a tier and a written justification following the Art. 3(22) critical-or-important logic. Reviews going overdue or due within 30 days are flagged in the table and in the summary chips; sort by any column, filter by tier, status or review state, search notes. Import your existing list as CSV (column names are matched loosely — “Vendor”, “Tier”, “Next review” all work, and a blank cell never erases what the register already knows), export CSV or JSON for your real GRC tool. It is a browser-local register: nothing in the page by default, kept in this browser only when you turn on local saving, carried elsewhere with the same passphrase-protected backup the compliance trackers use, and it nags you when it has not been exported for a month. Every row has a “Questionnaire →” button that opens the Vendor Risk Questionnaire pre-filled with the vendor’s name, tier and frameworks (a one-shot hand-off in the tab, no findings or notes carried over). The questionnaire itself gained the same four-question tiering wizard, prints the justification in the Markdown header, and can copy the questions as numbered plain text for vendor portals and e-mail. The DORA Compliance Checker’s gap report and the Compliance Reference DB’s third-party and supply-chain entries now point at both tools.
  • FIX Two server-assisted tools were silently broken on the live site; fixed. The Subdomain Takeover Checker and the URL-scan mode of the HTTP Security Headers Grader called their own endpoint through the old /tools/….php address, which since the clean-URL routing has redirected to /en/tools/… — and a redirect drops the request body and the query string, so the check never ran and the page reported an error. Both (and the new Bucket Exposure Checker, which had the same mistake for a few hours) now call the page they are on. A browser test now exercises each of them end to end against the real endpoint, and a static test refuses any tool page that addresses its endpoint through the old path, so this cannot come back with the next tool.
  • NEW Cloud Ramen, third bowl: the Container Manifest Linter. Paste a Dockerfile or a Kubernetes manifest (several documents separated by --- are fine) into the Container Manifest Linter and get only the security findings, graded A–F, each with a fix you can paste back. Dockerfiles: no USER (or USER root), unpinned base images (:latest or no tag — a digest counts as pinned, a build stage does not count as an image), secrets in ARG/ENV names, ADD from a URL or for plain files, curl | sh, package lists left in the layer, chmod 777, sudo, EXPOSE 22, no HEALTHCHECK. Manifests — Pods, Deployments, StatefulSets, DaemonSets, Jobs, CronJobs, init containers included: privileged, host network/PID/IPC, no runAsNonRoot, the service-account token mounted by default, no resource limits, hostPath (escalated when it is /, /etc or the Docker socket), allowPrivilegeEscalation, secret-looking values in plain env, dangerous capabilities, writable root filesystem, floating image tags. Pod-level securityContext is inherited the way Kubernetes does it, so a hardened pod comes out clean. Style and best-practice checks are deliberately left to hadolint and kube-score. The 24 rules are a versioned data file; the YAML reader is the same small parser the IAM analyzer uses; nothing leaves the browser. That completes the Cloud Ramen category’s first three tools.
  • NEW Cloud Ramen, second bowl: the Bucket Exposure Checker. Give the Bucket Exposure Checker a bucket name, an s3:// or gs:// URI, any of the S3 / Cloud Storage / Azure Blob URL forms, or a hostname you found during recon, and it tells you — without credentials, from this server, your IP never forwarded — one of five things: Not Found, Exists — Private, Exists — Publicly Listable, Exists — Publicly Readable, or Possible Takeover Target when the name nobody owns is still being pointed at. It follows S3’s region redirect once, probes index.html and robots.txt, and shows the provider error code behind each request because that is the actual recon signal: a NoSuchKey where an AccessDenied should be means anonymous ListBucket is on; a BlobNotFound instead of ResourceNotFound means the Azure container allows anonymous blob reads. Each verdict comes with the fix for that cloud (Block Public Access, public access prevention, “Allow Blob anonymous access: Disabled”) and a link to the official page. This one is deliberately gated: an authorized-use confirmation before the button works, ten checks a minute, one name per request, and the name is used for the check and the rate limit only.
  • NEW New category, Cloud Ramen, and its first bowl: the IAM Policy Analyzer. Paste an AWS IAM policy, an Azure RBAC role definition or role assignment, or a GCP IAM policy (JSON, or the YAML gcloud … get-iam-policy prints — the provider is detected from the shape) and the IAM Policy Analyzer grades it A–F with each finding in plain English and a fix: * on *, the privilege-escalation actions (CreateAccessKey, AttachUserPolicy, PassRole, CreatePolicyVersion…) granted broadly, s3:*-style service wildcards, NotAction / NotResource in an Allow, writes on data stores without a Condition, Principal: "*", key creation without MFA; Owner or Contributor at subscription scope and Actions: ["*"] custom roles on Azure; allUsers, roles/owner, roles/editor and service-account impersonation roles on GCP. For AWS it also drafts a least-privilege starting point — wildcards replaced by a known read set for the services the statement touches, placeholders where only you know the answer, every Deny kept — clearly marked advisory. Export as Markdown or JSON for the report. The 22 rules are a versioned data file, not code, so the list can grow with the changelog. And because a policy reveals your account structure: the page has no endpoint at all, a browser test asserts zero requests during analysis, and nothing is written to browser storage.
  • FIX IR Flow: layout fixes after launch. The step rail now shows the playbook in a stable order, grouped once per phase (it used to reorder itself as you went and repeat phase headings); on a phone the current step comes first and the rail folds into a “Steps 4/17” bar under it instead of forcing a scroll past all seventeen; tool steps no longer show “Open standalone tool” twice; the disclaimer is one bold sentence, not a paragraph; the panels no longer stretch to the rail’s height; and the title lost its “IR Flow:” prefix so it fits on one line.
  • IMPROVE Phishing Investigation is now a playbook on the IR Flow engine. The four-step workflow launched on 16 September has moved to IR Flow: Phishing Investigation — the old address redirects, and any case you had kept in your browser is converted the first time you open the new page (it appears under “Resume a saved case” with (migrated) in its name). What changed for the better: the URL and the raw headers each go through an indicator-extraction step that types what it finds (URL, domain, IP, e-mail, hash) instead of a regex per textarea; the headers step keeps a 2 KB excerpt that exports as a STIX note as before; a decision step asks what Authentication-Results said and branches to the right guidance for a DMARC pass (look-alike domain, compromised partner mailbox, abused service) or a fail; the defanging step is pre-filled with the case’s own indicators — the only pre-fill in the engine, and it is declared in the playbook, not silent; and the ATT&CK mapping (T1566 and its sub-techniques) is a step rather than a link. Same exports as before (CSV, STIX 2.1 with the same stable ids) plus the after-action note. There is now one implementation of “a guided case with tools as steps” on the site, driven by two JSON files. Also: the IR Flow page shows a playbook switcher, and the Domain Security Review workflow — unchanged — now carries the browser test for the local-saving layer.
  • NEW Training Labs: practise with the real tools, no account, no score. A small hands-on sandbox under the Awareness hub: five labs from Mild to Extra Spicy, each an invented scenario — a proxy log with three outside IPs hidden in it, four ways of writing a malicious URL of which one is safely defanged, a process tree to name the ATT&CK technique of, three log excerpts in different time units and zones to order, and a full ransomware chain to map to five techniques — with the relevant tool embedded on the page (IOC Defanger, ATT&CK Search, Timestamp Converter) and your answer checked in the browser. Wrong answers get a count (“2 of 3 found”), never the answer; hints appear one at a time; there is no attempt limit. Completion is remembered only if you turn on “Remember my progress” (the usual one-time prompt; a small flag in your browser, listed under Your local data) — otherwise it lasts for the tab. Everything is synthetic: documentation address ranges, example domains, invented names; a lint refuses anything else before deploy. Each lab points at the exam areas it touches for the study side.
  • NEW New workflow: IR Flow — a guided, skippable ransomware playbook. IR Flow: Ransomware Response walks a suspected ransomware incident in the order NIST SP 800-61 recommends — confirm and contain, preserve evidence, analyse, eradicate, recover, report, learn — as a decision tree rather than a checklist: branch on whether encryption is still running, on domain-level spread, on whether clean backups exist, on which reporting regime applies (DORA, NIS2, GDPR, each with its clock). Three of the site’s tools run inside the steps — IOC Defanger, Timestamp Converter and MITRE ATT&CK Search — and the case keeps only what each step is meant to capture (the defanged list, the technique id, the normalised times), never a tool’s whole state. Any step that is not marked required can be marked N/A; jumping back to an earlier step never discards what later steps captured. The export is an after-action report in Markdown — a timeline of decisions and findings in the order they happened, the indicators (defanged), the techniques, your notes — plus the indicators as CSV and as a STIX 2.1 bundle with the same stable ids as the other workflows, with an attack-pattern object per technique. As everywhere here: in memory unless you tick “Keep this case in my browser”, and a visible “not being saved” line when you do not. Under the hood it is a generic engine driven by a JSON playbook; the ransomware one is the first. Also fixed: the Phishing Investigation workflow added a bogus “domain” such as 0.113.66 whenever an IP address was pasted — the tail of the IP matched the domain pattern; refused now.
  • NEW Glossary: thirteen more entries and three new categories. Techniques & Tradecraft (LOLBin, Red / Blue / Purple Team, C2, Cyber Kill Chain, Privilege Escalation), Cryptography & Hashing (bcrypt, PGP, Cryptographic Hash Function, and Salt as the first short entry — a card on the index until it earns a hands-on section) and Network & Infrastructure (WHOIS / RDAP, Subdomain Takeover, SRI, DNS Record Types). Same rule as before: every full page ends with a worked example on a live tool of this site, checked against what the tool actually does.
  • NEW New section: the Security Glossary. Eighteen plain-language entries for the words behind the tools — MITRE ATT&CK, ISO 27001, DORA, NIS2, GDPR, PCI DSS, SPF, DKIM, DMARC, CIDR, CSP, IOC, IOA, TTP, STIX/TAXII, Sigma, CVSS and EPSS. The house rule: an entry does not get its own page until it ends with a Try it yourself section that walks through a real problem on a live tool of this site, with synthetic data — a definition alone stays a card on the index. Regulation entries show when they were last reviewed and link the primary source. Every page carries schema.org DefinedTerm markup, and the site search now shows a matching glossary entry above the tool results, so “dmarc” gives you the explanation and the analyser together. Content is data (one PHP file per term) checked by a lint before deploy: required fields, a category from a fixed list, every related term and tool resolving, and no page without its hands-on section.
  • FIX Timestamp Converter: three timezone bugs, and IOC Defanger no longer hangs on a big paste. In the Timestamp Converter, “Date → Timestamp” with a named zone (Europe/Paris, Asia/Tokyo…) quietly treated the date as UTC — it now honours the zone, daylight-saving included (12:00 in Paris in July is 10:00Z, in January 11:00Z). The batch tab’s reverse conversion had an “Input Timezone” select that was never read; a date without its own zone is now interpreted in the zone you picked, while lines carrying Z or an offset are taken as written. And the ISO output’s offset is always ±HH:MM — Firefox used to print +0 where Chrome printed +00:00. In the IOC Defanger, counting e-mail addresses went quadratic on a long paste with no @ in it (40 KB of base64 took two seconds, a megabyte would have taken a quarter of an hour); it is linear now and a megabyte takes a few milliseconds. The MITRE ATT&CK Search listed T1071 twice; once now. Under the hood, the logic of these three tools moved out of their pages into small shared modules (ioc-defanger-core.js, mitre-attack-core.js, timestamp-core.js) so the same code can run inside a workflow step or a training lab — the pages themselves behave as before, and a browser test now exercises each of them end to end.
  • IMPROVE Local saving: small “flag” stores, listed with everything else. The opt-in local-saving layer (storage.js) so far only knew one shape: a full case record in IndexedDB. Some things a tool wants to remember are far smaller than that — a map of “which lab did I complete, and when” — and belong in localStorage instead. The layer now has a second, registered kind of store for exactly that (one cr.flags.* entry per tool, capped at 64 KB, same consent rule: off until you say yes, reads always allowed), and Your local data lists both kinds in one table from a single enumeration — each row tagged cases or flags, with its own count, size, last update and Clear — so a tool that adds a store of either kind shows up there with no extra wiring. Nothing uses the new kind yet; it is the groundwork for the training labs. Same rules as before: your browser only, unencrypted, never sent to us.
  • IMPROVE Compliance Reference Database: the CSF 2.0 snapshot can now be kept and carried too. The Function-level self-assessment (six tiers) used to live in the browser session only and vanished with the tab. It now sits on the same opt-in local-saving layer and encrypted export/import as the DORA, NIS2 and ISO 27001 trackers: a case name, “Keep my progress in this browser” behind the one-time prompt, timestamps per function, the radar and gap table re-rendered on reload, and a passphrase-protected file with the per-function review on reimport. That makes four GRC tools on one shared adapter.
  • IMPROVE Encrypted export/import and opt-in local saving now on all three GRC trackers. The NIS2 Self-Assessment and the ISO 27001 SoA Builder join the DORA checker: a case name, “Keep my progress in this browser” behind the one-time consent prompt (they used to write to localStorage silently on every keystroke — that is gone, and what was there is picked up once and kept in memory until you say yes), per-item timestamps, a resume list, and the same passphrase-protected export file with the item-by-item review on reimport — the ISO review labels rows by Annex A control, the NIS2 one by article. A file exported from one tracker is refused by another rather than mis-merged. Under the hood the three tools now share one small adapter, so the next checklist gets all of this with a dozen lines.
  • NEW Encrypted export and reimport of compliance progress. The DORA Compliance Checker now keeps a per-question status and notes/evidence field, saves through the same opt-in local layer as the workflows, and can export the whole case as one passphrase-protected file (AES-256-GCM, key stretched with PBKDF2-SHA256 at 600,000 iterations, made and opened entirely in your browser — never uploaded). Reimporting on the same or another machine does not overwrite blindly: items are compared one by one and the review screen shows what the file updated, what is newer here, and what changed on both sides — conflicts are shown side by side and must be decided per item before anything is applied. The file name is a plain date so nothing you typed leaks through directory listings or attachment names; a wrong passphrase and a damaged file give the same message; files from a newer format version are refused with a clear note. The crypto primitives were pulled out of Secret Menu into one shared crypto-common.js so both features run the same short, auditable code path. And yes: if you lose the passphrase, nobody — including us — can open the file.
  • NEW Local saving that actually works, with a switch you can see. Workflows have offered “Keep this case in my browser” since they launched, but the toggle wrote a blob that nothing ever read back — a reload lost the case anyway. There is now one shared persistence layer (storage.js, IndexedDB, one store per tool) behind every tool that wants to survive a reload: Phishing Investigation and Domain Security Review use it today. It is off by default; the first time a tool wants to save, an inline prompt asks (“Nothing leaves your device”) and remembers your answer. After that: auto-save two seconds after the last change with a visible “Saved locally” line, the same case reopened on reload, a “Resume a saved case” list, and a nudge to export once a case grows. Failures are loud, not silent — a full browser quota says so in plain words, and private windows where storage does not work say so up front. A new Your local data page (footer) shows what is stored, per store with size and last update, lets you clear each one, and offers “Forget everything”; turning saving off asks whether to keep or delete what exists. Everything is stored unencrypted in your browser only and never sent to us; the privacy notice now spells out every key.
  • NEW New tool: Secret Menu — encrypted link sharing. Paste a password, API token or one-time code and get a link that decrypts only in the recipient’s browser. The secret is sealed with AES-256-GCM through the Web Crypto API (no crypto library, one short readable script) and everything lives in the part of the URL after #, which browsers never send to any server — so we never see the plaintext, the ciphertext or the key. Two modes: a self-contained link that holds everything (simplest, but whoever sees the link can read the secret, permanently) and a split-secret link where the link carries only ciphertext and a random 256-bit key — or, as an advanced option, a PBKDF2-stretched passphrase (600,000 iterations, current OWASP guidance) — travels through a different channel. The recipient sees a “Reveal” gate rather than the plaintext on load, gets a one-click clear from the address bar, and every decrypt failure shows the same generic message. Text only, 2,000 characters; no burn-after-read, because that would require storing an encrypted blob on our side. Same zero-knowledge link pattern as PrivateBin.
  • FIX Five tools were labelled “100% client-side” but send your input to our server. SSL Certificate Checker (the hostname — browsers cannot perform a raw TLS handshake), Link Extractor (the URL), IP Geolocation (the IP, proxied to ipapi.co), PGP Key Lookup (the query, proxied to the keyservers) and the bcrypt mode of the Password Security Suite (the password, hashed in memory with PHP) now carry the server-assisted badge, each page says exactly what leaves the browser, and the privacy notice table lists all 14 server-assisted tools with the service each one talks to. Nothing about how the tools work changed; the label was wrong. A new test fails the build if a page flagged client-side ever posts to the server.
  • SITE Dark scheme for the whole site. Since yesterday only the homepage followed your system’s dark setting; every tool, GRC engine, hub and section page now does too. Under the hood more than 90 pages had hard-coded light colours (white input boxes, pastel status badges, neon-green “active” tints left over from an old theme) that were swapped for the palette tokens, so a page cannot drift out of either scheme again. A new browser audit renders all 166 pages in both schemes and fails on any text below WCAG AA contrast or any light box on a dark page — both runs are clean. Light mode also gained slightly darker accent and status colours: red, orange and green text on tinted badges was at 4.0–4.5:1 and now clears 4.5:1 everywhere.
  • NEW New tool: Page Content Audit. A layer-1 look at any web page: word count, title and meta-description lengths, heading hierarchy (H1 count, skipped levels), language, text/HTML ratio; links split into internal / external / nofollow / mailto / tel / documents with the top external domains and social profiles recognised by platform (LinkedIn, X, GitHub, YouTube, Mastodon, Bluesky, TikTok, Discord, Telegram…); images without alt and their total weight, scripts and stylesheets by origin, favicon; dominant colours and fonts, viewport. The differentiator is hidden-text detection: the page is rendered in a script-less sandbox inside your browser and every text node is checked through the real CSS cascade — same colour as its background, zero font size, display:none / visibility:hidden / opacity:0 (including inherited), off-screen positioning, near-invisible contrast — while legitimate screen-reader-only patterns are labelled as such. URL mode has our server fetch the HTML, stylesheets and image sizes (one page, no crawling, your IP never forwarded); paste mode is 100 % client-side. Ends with pre-filled jumps to the infrastructure tools (SSL, DNS Mapper, WHOIS, headers) and the Domain Security Review.
  • IMPROVE No more pop-up alerts. 43 tools used the browser’s blocking alert() for validation and status messages (“Please paste HTTP headers”, “No IOCs to export”, “Copied”…) — 122 places in all — which freezes the page until you click OK and cannot be read by a screen reader as a live message. They now show a small notice in the bottom corner that dismisses itself (or with ×), keeps working while you continue, and is announced as an alert or a status depending on its content. One shared function, one stylesheet rule; covered by the unit and browser tests.
  • NEW New workflow: Domain Security Review. One domain in, six of the site’s checkers run in one pass — DNS Record Lookup, Email Security Checker (SPF / DKIM / DMARC), SSL Checker, HTTP Security Headers Grader, CAA & HSTS Checker, and the Posture Scanner for DNSSEC / MTA-STS / security.txt — and are scored together (email 30, TLS 25, headers 25, DNS 10, CAA/HSTS 10; A ≥ 90 … F). Every finding is one line with a pass / warn / fail mark and a link that opens the standalone tool with the domain pre-filled. You get a Markdown report to paste into a ticket, and the collected artifacts (IPs, name servers, mail hosts, certificate names) go into the same CyberCase as the Phishing Investigation workflow for CSV / STIX 2.1 export. Server-assisted (the existing endpoints, your IP never forwarded, per-tool rate limits apply); nothing runs until you press the button. The scoring is covered by unit tests against real responses, and the live run is part of the browser test.
  • FIX Two tools were throwing at load: URL Parser’s builder tab and the Incident Report Generator’s report-type list. A new browser sweep — every one of the 151 pages opened in headless Firefox, failing on any uncaught JavaScript error, console.error or CSP block, with the first “Try an example” button clicked where there is one — found both on the live site. In the URL Parser the builder’s buildURL was referenced before it was assigned, so the error aborted the rest of the script: no initial parameter row, dead listeners. In the Incident Report Generator the escaper came from a script that loads later, so the report-type dropdown stayed empty. Both fixed; the other 149 pages are clean, and the sweep is now part of the test suite.
  • SITE Tools hub re-skinned to match the new homepage. The tools listing now uses the same cards as the homepage: name, a one-line description (the rows used to show only the name), a FREE or EXTERNAL label and the client-side / server-assisted badge, three per row on desktop, one on phones. Category headers, filter pills, the search box, the mobile category sheet and the empty state all moved onto the site’s design tokens; the sticky search bar sits under the sticky header. Search, category filters, ?cat=/?q= links and the facet chips behave exactly as before and are now covered by the browser test. Section pages (GRC, Awareness, Certifications, About, Recommended, Privacy, Changelog, Tools) also gained a proper <h1> — the old site header used its logo as the page heading, so once it was replaced those pages had none.
  • SITE Every internal tool link now goes straight to the canonical address. 69 links inside tool pages, the GRC hub, the NIS2 engine, the AI glossary, the “Related tools” boxes, the hub cards and the tools listing still pointed at the old /tools/name.php form, so each click was a redirect before the page loaded (and a form post to such a link would have lost its body). They all use /en/tools/name now, generated from one helper, and a test rejects any legacy link that sneaks back in. Also: the test runner no longer stops silently when a suite fails.
  • FIX Tool-to-tool “Send →”, recent tools and the client-side badge were switched off on every canonical URL. Our first real-browser test run (headless Firefox, now part of the test suite) showed it: the scripts behind the handoff flow, the “Try next” strip, the recents row and the badge next to a tool’s title were only loaded for the old /tools/name.php addresses — which redirect to /en/tools/name, where the page-type check and the tool manifest still expected the old form. Both now resolve the page through the router, and the manifest links point straight at the canonical URLs, so a “Try next” click no longer pays a redirect. Also: when the curated suggestions under a tool cannot receive what it produces (the Hash Generator suggested three tools that take no hash), the last slot now goes to one that can, so a “Send hash →” always exists. Small extras: the client-side badge on the tools hub no longer overlaps the FREE label, the mega-menu no longer closes when a mouse user clicks the button they just hovered, and the site now states its Swiss hosting.
  • SITE New homepage and navigation. The site reads as a tool catalog now: a sticky header with a “Tools” mega-menu (five categories, four featured tools each, computed “View all N” links into the filtered hub, plus chips for the remaining categories), a tighter hero with an “order ticket” of live numbers (tools on the menu, accounts required, share that runs in your browser, ads), a trust strip and five category sections with uniform tool cards — every card shows the same 8–12-word description, a FREE/NEW/SOON badge and a category accent. The footer is a five-column map (Menu, Resources, Developers, Company). Typography moves to Fraunces for headings and IBM Plex Sans for text; both are self-hosted, so the page still makes no third-party request and the CSP keeps font-src 'self'. The mega-menu trigger is a real button with aria-expanded; Escape closes it and returns focus, and below 860 px it folds into the hamburger drawer as a static block. The homepage follows a dark colour scheme when your system asks for one (tool pages stay light for now). Featured tools and counts live in one PHP source used by the header, the homepage and the footer, and a test rejects a featured tool that is retired, out of its category or over-described.
  • IMPROVE “Load an example” on multi-field builders. The example feature added earlier now also fills a whole form at once: the Email Auth Builder loads a realistic Google-Workspace sender setup (IPs, include, -all, DKIM selector, DMARC quarantine with a report address) and the HTTP Request Builder a POST with a JSON body, so the generated records and code appear immediately. Still one attribute on the form, no per-tool code.
  • SITE Phones: wide result tables no longer push the page sideways. Twenty tools render result tables (DNS records, Nmap hosts, IOC pivots, certificate chains, cookies…) that were wider than a phone screen and had no scroll container, so the whole page scrolled horizontally. On screens up to 700 px those tables now scroll inside their own box, with long values wrapping. Also: the compact btn-sm button style that 35 tools referenced was never defined, so their in-table buttons rendered full size; it exists now, at a size that still meets the WCAG 2.2 target-size minimum.
  • IMPROVE Export from four more checkers. The Email Security Checker, CAA & HSTS Checker, Subdomain Takeover Checker and User-Agent Parser had no way to keep their results. They now show the site’s standard export bar under the results — Copy, JSON (versioned, timestamped, with the input), CSV (RFC 4180), Markdown table and plain text — the same bar the other tools use, so a report from any checker pastes into a ticket the same way.
  • NEW “Try an example” on the lookup tools. Sixteen tools whose first screen was an empty field — SSL Checker, DNS Record Lookup, Email Security Checker, CAA & HSTS, Posture Scanner, CIDR, Cron Parser, IP Info, MAC Lookup, PGP Key Lookup, Link Extractor, Recon OSINT, SRI Generator, chmod, HMAC, Domain Availability — now show a small “Try an example” button that fills a realistic value and runs the tool, so you can see what it does in one click. It is one attribute on the input, rendered by the shared tool script, and disappears as soon as you type.
  • IMPROVE Accessibility: every form field now has a name a screen reader can announce. An audit of the 553 form controls across the tool pages found 208 without an accessible name — mostly a visible label sitting next to its field without the for attribute that links them, plus hidden file pickers and read-only outputs. Labels are now associated with their fields, and fields without a visible label carry an aria-label derived from their placeholder or purpose (WCAG 2.1 SC 1.3.1 / 4.1.2). A test keeps it that way, alongside the new contrast test. Keyboard focus styling was checked and left as is (it already uses :focus-visible).
  • IMPROVE Phishing Checker content analysis: links are scored inline, and fewer false alarms. Pasting an email body now scores every link in it with the same heuristics as the URL tab (a table with score and reason per link, a “Full analysis” button that runs the deep scan, and the links and hosts offered to the “Send →” handoff); a suspicious link raises the message score, since a clean-sounding text with a typosquatted link is still phishing. The keyword rules were also corrected: matches are now whole words (pin used to fire on “shipping” and selected on “unselected”), a keyword counts once even when it appears in two lists (“suspended” was scored twice), at most three hits per category count, and the “grammar” check — which fired on every multi-line email because line breaks count as double spaces, and on every URL — is informational only and ignores URLs and addresses. Display-text/link mismatch detection now also catches a bare domain as link text. Design: the palette gained a severity scale (--sev-low/medium/high/critical/good) that clears WCAG AA on both page and card backgrounds, and 21 tools that still used dark-theme colours (light green, yellow and pink text at 1.4–3:1 on the cream background: CVSS severities, risk labels, timeline badges, diff colours, encoder hints) now use it; a test keeps every hard-coded text colour above 4.5:1.
  • FIX Phishing Checker: two scoring corrections. An @ anywhere in a URL scored +25 as a “credential confusion” attack, which penalised every unsubscribe or contact link carrying an address in its query string; only an @ in front of the host (user@evil.example) is that trick, and only that is flagged now. Typosquatting detection compared everything before the top-level domain, so www.paypa1.com was measured as “www.paypa1” against “paypal” and slipped through at 50% similarity while paypa1.com was caught; the registrable label is compared now, and a brand’s own subdomains are never reported as typosquats of it. IPv6 literal hosts are recognised as IP addresses. 15 new tests cover these and the legitimate-site cases.
  • FIX Sigma Rule Builder: valid YAML for every input. Titles, descriptions, authors, references and false-positive notes were written into the YAML unquoted, so a description containing : or # produced a rule that would not parse (or lost half its text), and a detection value containing an apostrophe broke the single-quoted string. Scalars are now quoted exactly when YAML requires it and embedded quotes are doubled; a generated rule with all of those in it round-trips through a real YAML parser in the test suite. The YARA Rule Builder was reviewed for the same class and was already correct.
  • IMPROVE CyberCase export: the phishing-triage workflow’s STIX export now uses the same stable UUIDv5 indicator ids as the STIX Formatter and the API, and exports captured headers and notes as standard STIX note objects attached to the indicators instead of the non-standard x-email-header patterns that strict validators rejected. API: rate-limit headers. Every API response now carries X-RateLimit-Limit, X-RateLimit-Remaining and X-RateLimit-Reset, so a script can pace itself instead of discovering the limit through a 429 (which still comes with Retry-After). STIX Formatter: stable ids, identical to the API. The STIX Formatter gave every indicator a random id, so converting the same IOC twice — or once in the tool and once through /api/tools/stix — produced two objects your TIP could not dedupe. Indicators, vulnerabilities and the producer identity now get RFC 4122 UUIDv5 ids derived from their pattern in the same namespace the API uses: the same IOC always yields the same id, whichever door it comes through (a test checks the tool against the API’s values). Bundle ids stay random, as they should.
  • FIX Email Header Analyzer: forged authentication results no longer count. The analyzer read only the first Authentication-Results header and trusted it. Real messages carry several (one per hop), and a phisher can simply add one that says spf=pass dkim=pass dmarc=pass before sending — the tool would have reported a clean pass. It now reads all of them (including the ARC form), trusts only the one stamped by the receiving host (the by host of the last Received line, per RFC 8601), flags a header stamped by anyone else as unverified and does not credit its passes, and shows which host the results came from. Also: Received-SPF is used when no Authentication-Results exist, permerror/temperror are shown instead of “Not found”, and a Return-Path on another domain (how every mailing service sends bounces) is a low note rather than a penalty, and not raised at all once DMARC has passed. 30 test cases cover legitimate, forged, multi-hop and fallback messages.
  • FIX Two production bugs found by the new post-deploy checks. The DNS Record Lookup answered a 500 for its default query (all record types, SOA included): the SOA branch used str_replace() with a literal in its by-reference count argument, which PHP 8 treats as a fatal error — the tool only worked when SOA was unticked. Fixed, and the check script now requests the default set after every deploy. Second: the shared HTTP fetch helper capped response bodies (256 KB for the HTTP Headers Grader, 2 MiB for the Link Extractor) but, when a page exceeded the cap, threw away everything — headers included — while still reporting success; the Headers Grader graded github.com as having no security headers at all. The helper now keeps the headers and the first bytes of the body and flags the truncation; the SRI Generator refuses a truncated file outright (a partial hash would be wrong), DNS Mapper explains an over-size certificate-transparency answer, and the Link Extractor reports when it only saw the first 2 MiB. The post-deploy script now exercises every server-side handler once with a valid input, so a fatal error in a rarely used branch cannot sit unnoticed again.
  • NEW API: OpenAPI document. The Tools API now publishes an OpenAPI 3.0 description at /api/tools/openapi.json — import it into Postman or Insomnia, generate a client, or point an API monitor at it. It is produced from the same structured definition as the discovery document at /api/tools/, and a test fails if either ever lists an endpoint the router does not serve (or vice versa). Both documents carry an ETag and answer 304 Not Modified to If-None-Match, so polling them is free.
  • FIX Three more wrong answers fixed. The Phishing Checker deep scan always said “Hosting Provider: No” — nothing on the server ever set that flag. It now classifies the network owner (cloud, VPS and CDN operators, generic hosting vocabulary, ISP/residential vocabulary) and says “Unknown” when it genuinely cannot tell instead of guessing “No”. The Base Converter parsed numbers with parseInt, which silently loses precision above 253: a 64-bit value such as FFFFFFFFFFFFFFFF converted to a decimal 385 too high and a wrong binary — it now uses arbitrary-precision integers throughout (including the step-by-step explanation and the signed-width view, which also reports when a value does not fit the chosen width). And the tool-to-tool handoff: 22 of the 33 tools that accept a “Send →” value were missing from the manifest entry that decides whether the button is drawn, so nothing could be sent to them; the manifest is synced and a test now keeps it that way. The “Send →” flow itself (button appears when a result exists, values-only payload, single-use pre-fill on the next tool) is now exercised end to end in the test suite with the site’s real scripts.
  • NEW API: CVSS v4.0 scoring. /api/tools/cvss now accepts a full CVSS:4.0/… vector — Base only, Base+Threat, Base+Environmental or all three — and returns the score, severity band, score type (CVSS-B / BT / BE / BTE) and the MacroVector, computed with the FIRST reference algorithm. The MacroVector lookup, max-severity and max-composed tables are not copied into the server code: they are exported from the CVSS v4.0 Calculator into one JSON file that both the browser tool and the API read, and the test suite replays 400 randomly generated vectors (with threat and environmental metrics) scored by the tool’s own JavaScript through the PHP engine, plus a one-off comparison of all 104,976 base vectors that came out byte-identical. v3.1 and v3.0 vectors keep working on the same endpoint.
  • FIX Crypto tools verified against the RFC test vectors. The TOTP Generator now passes all twelve RFC 6238 vectors (SHA-1, SHA-256, SHA-512) in an automated test; one real bug found on the way: its Base32 decoder silently skipped characters outside the alphabet, so a secret typed with a 0 instead of an O (or 1/I, 8/B) produced a plausible but wrong code — it is now rejected with a hint. The HMAC Generator passes the RFC 4231 vectors; its verify field compared hex case-sensitively (an upper-case value pasted from another tool showed “Mismatch”) and silently dropped invalid characters from a hex key — both fixed. The AES-GCM Encrypt & Decrypt tool now stores the PBKDF2 iteration count inside the ciphertext (a small CR1 header), so decrypting with a different iteration setting no longer fails as if the password were wrong; ciphertexts made before today still decrypt. The Password Generator picked characters with random % n, a textbook modulo bias — negligible at these sizes, but a generator should be exact; it now uses rejection sampling, with a uniformity test.
  • IMPROVE MAC Lookup now uses the full IEEE registry. The MAC Address Lookup shipped a hand-picked table of 218 vendor prefixes, so almost every real address came back “Unknown Vendor”. It now loads the complete IEEE MA-L registry (about 40,000 assignments, rebuilt from the public CSV, served from this site — no third-party call) on the first lookup, keeps the small table as an instant fallback, tells you when an address is locally administered (randomised MACs carry no manufacturer), and dates the registry it answered from. Also fixed: the CVSS v4.0 Calculator rounded its final score with plain Math.round; the reference implementation adds a tiny epsilon first because the subtraction of decimal distances leaves artifacts like 8.5499999 — 522 of the 104,976 base vectors scored 0.1 below first.org (for example AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:L/VA:N/SC:H/SI:H/SA:H gave 8.5 instead of 8.6). Now identical, with a regression test. The JWT Decoder no longer fails on a non-numeric exp/nbf claim and accepts a pasted Bearer … header; the URL Parser accepts defanged (hxxp://x[.]y) and scheme-less input. The Regex Tester’s “ReDoS protection” only checked the clock between matches, which cannot interrupt catastrophic backtracking inside a single match — a pattern like (a+)+$ froze the tab. Matching now runs in a Web Worker that is terminated after two seconds with an explanation.
  • FIX Client-side hardening pass. The HTML-escaping helper shared by the tools (and 58 local copies of it) encoded & < > but not quotes, so any value placed inside an HTML attribute was cut at its first quote and could break out of the attribute. Concretely: the SRI Generator’s “copy tag” button copied a truncated snippet (the snippet also embedded this site’s own CSP nonce, which is meaningless on your page — removed), and a hand-edited share link for the Timezone Converter could inject markup or an invalid zone that broke the whole render (zones are now validated against the IANA list). Every escaping helper now encodes quotes too. Also: the Timestamp Converter accepted 123abc as 123, treated 16- and 19-digit values (microseconds, nanoseconds) as milliseconds and rejected pre-1970 dates — it now shares one unit rule with the API’s /timestamp; the Hash Generator’s identify mode and the API’s /hash-id disagreed on several lengths (no SHA-224, no Keccak-256) and are now checked against each other; DNS Mapper caches certificate-transparency results for an hour, caps them, and no longer loads unbounded responses; Security Posture Scanner and Subdomain Takeover Checker got the same record analyzers, time budgets and stricter matching as the other scanners (a CNAME to github.io.attacker.net is no longer attributed to GitHub Pages); Link Extractor resolved relative links from directory URLs against the parent directory and ignored <base href>. And the site now publishes a security.txt (RFC 9116).
  • SITE HTTPS is now enforced at the edge. While fixing the CAA & HSTS Checker (it read the HSTS header after following redirects and did not check the HTTP→HTTPS hop, so it could call a domain preload-eligible when hstspreload.org would not), we ran it against this site and it found that plain http://cyberramen.com/en/ answered with the full page over cleartext: the pages set a strong HSTS header, but browsers ignore HSTS on HTTP responses, and nothing redirected first-time visitors to HTTPS. Every plaintext request now gets a single 301 to the same URL on HTTPS (before the language redirect), www. redirects to the canonical host, and the redirects and static assets Apache serves itself now carry the same max-age=31536000; includeSubDomains; preload policy as the pages (they carried the hosting default before). The post-deploy check script asserts all of this from now on.
  • FIX Server-side tools: a reliability and hardening pass. SSL Checker: host-name matching followed shell-glob rules, so a *.example.com certificate “matched” a.b.example.com and matching was case-sensitive — replaced with RFC 6125 rules; EV/OV detection only knew two vendor OIDs (most EV/OV certificates were labelled DV and warned about) — now uses the CA/Browser Forum policy OIDs; the “trusted issuer” verdict was a name list — the chain is now actually validated against the public trust store, so an incomplete chain or a private root is reported (verified against the badssl.com test hosts); fingerprints lost their trailing colon. Email Security Checker: two SPF records (a permanent error that switches SPF off) or two DMARC records were not flagged; a bare all (which means +all, anyone may send) was reported as valid; mechanism checks matched substrings inside host names; the DKIM selector scan had no time budget, so a slow resolver produced an empty response instead of a result. HTTP Headers Grader: 'unsafe-inline' in style-src was graded as an XSS risk and a nonce + 'strict-dynamic' policy (the strongest form) was graded “warn”; HSTS max-age=0 (HSTS switched off) scored positively; a missing X-Frame-Options was a failure even with CSP frame-ancestors; repeated headers kept only the last value. WHOIS and Domain Availability: the built-in RDAP server list was consulted before the IANA registry, so registries that moved their endpoint (.dev, .app, .io, .tech) failed even though IANA had the new address — IANA first now, cached for a week; an RDAP 400 was reported as “available”; TLDs without RDAP (.lu, .be, .at, .co) now answer from DNS delegation with an honest “unknown” and a link to the registry, instead of an error; both tools now use the SSRF-safe fetch path. Password Generator: the server-side verify action accepted hashes with unbounded work factors (a bcrypt cost-31 hash would pin a worker for hours) — capped like the Hash Verifier. CVE Feeds: feeds are now cached for ten minutes with a stale fallback when a vendor is down. New API endpoints /spf and /dmarc analyse a record’s text with the same code the checker uses.
  • CONTENT Developer API guide (/en/api) — the API page grew from an endpoint list into a full how-to: quick start, GET vs POST, response and error conventions (every status code, Retry-After on 429), a reference card per endpoint with parameters and an example response, code in bash/curl, Python, JavaScript and PowerShell, and SOC recipes (report → IOCs → STIX bundle, safe-to-share ticket text, a certificate-expiry gate for CI, batch CVSS scoring). The example responses are not pasted text: the page runs the same functions the API runs, at render time, so the documentation cannot drift from the code.
  • NEW Developer API: six new endpoints, IPv6, and one set of tests for both the API and the tools. The free Tools API (no auth, no tracking, pure logic, CORS) gains /hash (MD5, SHA-1/256/384/512, SHA3, CRC32 of a text), /base64 (encode/decode, UTF-8 safe, URL-safe variant, binary returned as hex), /url-parse (components, query parameters with duplicates preserved, defanged form and triage flags such as credentials-in-URL, punycode host or executable path), /jwt-decode (header, payload and exp/nbf status — decode only, no signature check), /cert-decode (X.509 subject, issuer, SANs, validity, key and fingerprints from PEM or bare DER) and /stix (a STIX 2.1 bundle of indicators from a plain list of IOCs, with TLP 2.0 markings and stable UUIDv5 ids so re-running a playbook is idempotent). /cidr now also does IPv6. Reliability: the API handlers moved out of the router into a testable library, and a single file of input→output vectors is now run against both the PHP endpoints and the browser tools’ own JavaScript (CVSS Calculator, CIDR Calculator, IOC Defanger, JWT Decoder), so the two can no longer drift apart. That pass found and fixed: /ioc-extract kept sentence punctuation glued to URLs (http://x/y,), reported file names like setup.exe as domains, and — on a large adversarial input — could exhaust the regex engine and silently return “no indicators”; it now runs in bounded time and reports a warning if a scan is ever cut short. Defanging is idempotent (running it twice no longer yields evil[[.]]com) and both the API and the IOC Defanger accept the same aliases ([dot], (dot), [at], h**p…).
  • FIX CVSS Calculator (/tools/cvss-calculator) — temporal and environmental scores could be one tenth too high. The v3.1 specification defines Roundup with integer arithmetic precisely because floating point makes 5.0 × 0.92 come out as 4.6000000000000005; the calculator used a plain Math.ceil, so a base 5.0 with Report Confidence Unknown showed 4.7 where NVD says 4.6 (a base 2.5 with the same modifier showed 2.4 instead of 2.3). Base scores were never affected — verified by scoring all 2,592 base vectors both ways. The calculator now uses the specification’s Roundup and shares its test vectors with the API’s /cvss endpoint.
  • IMPROVE Tool-to-tool handoff: results can now be sent onwards, not just inputs. When a tool finds something — the sender domain and originating IPs in the Email Header Analyzer, the host and resolved IP in the Phishing Checker, digests in the Hash Generator, the host in the URL Parser, SAN names in the Certificate Decoder and SSL Checker, A/AAAA/MX/NS/CNAME targets in DNS Record Lookup, every link in the Link Extractor, dangling CNAME targets in the Subdomain Takeover Checker — the “Try next” strip now offers a Send → button that carries those values straight into WHOIS, DNS, IP info, IOC pivoting and the other tools that accept them. Previously the strip was drawn once at page load, before any result existed, so results-based suggestions never appeared. As before: values only, kept in the tab’s session storage, single-use, never sent anywhere.
  • FIX Buttons across the tools now respond again — site-wide fix. The site’s Content Security Policy (which blocks inline scripts to prevent cross-site scripting) also silently blocked inline onclick handlers, so a number of buttons did nothing when clicked: the collapsible sections, “Copy” and preview controls in the Phishing Checker, the wizard navigation in SOC Sizing (Next / Back / Calculate / Export), the “Copy” buttons for generated secrets in the Password Generator, and the copy/export controls in the URL Parser, SSL Checker, Link Extractor, Character Encoder, DNS Mapper, UUID Generator, Timezone Converter and several other tools. All of these are now wired up through a single CSP-compliant delegated event handler, with no weakening of the security policy. Also fixed: the changelog page was double-escaping its own entries, so every item showed raw <strong> tags as text instead of formatted content.
  • IMPROVE Phishing Checker (/tools/phishing-checker.php) — reliability pass after a full audit. Correctness fixes: a link already rated high risk (an IP address, an @-spoofed URL…) that also had a suspicious TLD was being silently downgraded to medium (a string comparison); the “form submits to an external domain” check compared against the first link on the page (often an external social icon) instead of the page’s real domain, causing both false positives and false negatives; and EV/OV certificates were never recognised (the code looked for the literal strings “EV/OV” instead of the certificate-policy OIDs), so almost everything was labelled “DV/free” and penalised. The score is more meaningful now: a free/domain-validated certificate and the hosting country are purely informational (no more geographic profiling by country list). Robustness: a server-side time budget that cleanly skips slow checks instead of returning a truncated 500, a 40-second client-side timeout (no more button spinning forever), geolocation with a fallback provider, page-content analysis through a real HTML parser (DOMDocument) rather than brittle regular expressions, correct word counting for non-Latin scripts, and the dead Google Cache link (discontinued in 2024) replaced with VirusTotal. Finally, the collapsible scan sections (DNS, HTTP headers, IP/hosting…), the “Copy” button and the preview loader had stopped responding to clicks: their inline onclick handlers were blocked by the site’s Content Security Policy. They now go through a single CSP-compliant delegated listener.
  • FIX JWT Decoder (/tools/jwt-decoder.php) — found while auditing the same bug class as the PGP fix below. Signing a token whose payload contained non-ASCII — a name like José, any CJK text, an emoji — either produced a corrupt token (accented Latin-1 letters were written as one byte instead of their two UTF-8 bytes, so the tool could not even read its own output back) or failed outright with String contains an invalid character. JWTs are UTF-8 by spec (RFC 7519) and real payloads carry these characters constantly. The Base64URL encoder was handing raw strings to btoa(), which only speaks Latin-1; the decoder was already UTF-8-correct, so the two were asymmetric. Encoding now goes through the same UTF-8 byte path the signature already used, and a new test round-trips ASCII, accented Latin, CJK and emoji payloads through the tool’s own encode/decode pair.
  • FIX PGP Key Lookup (/tools/pgp-key-lookup.php) — a successful lookup failed with String contains an invalid character, while a miss correctly said “no key found”. The keyserver, the proxy and the key itself were all fine: the browser-side armor decoder started reading one character too early, saw an empty first line, and concluded there were no armor headers to skip. keys.openpgp.org prefixes every key with Comment: lines (fingerprint and each verified user ID), so those lines were glued onto the base64 body and handed to atob(), which rejected them. Headerless armor happened to work, which is why the same decoder in the PGP Key Inspector had not been caught — it is fixed there too. The decoder now skips any Key: Value header, checks the body is base64 before decoding, and reports a readable error instead of the browser’s. Covered by a new test using the exact armor that failed. Thanks to the reader who sent a precise reproduction.
  • FIX The feeds were broken, and quietly. Both /feed.xml and /feed.json had been emitting a PHP warning ahead of the payload since they launched on 24 July — one line of HTML before the XML declaration, which is enough to make a feed unparseable for every reader that fetched it. The cause was a regular expression whose delimiter was # while the pattern itself contained a literal # (URL fragments), so it was read as ending early. Fixed, along with two link bugs it was hiding: an entry mentioning an asset path such as /assets/data/tools.json pointed at a page that does not exist, and single-segment pages were never linked at all. The reason a warning could reach you in the first place is the deeper fix: PHP was configured to print diagnostics into the page, which on a bad day means a server path and a stack of internals in the response body. Errors now go to a log file that is not reachable over HTTP, and never into what you receive. The feed test suite now asserts on what the feed prints, not just on what it returns — a warning in the body is a build failure from here on.
  • NEW New tool: Kaidoku — Cipher Decoder (/tools/kaidoku.php). Paste ciphertext, pick a cipher — or let Auto-detect work it out — then read what the plaintext was hiding. 75 ciphers and encodings in one grouped dropdown: Caesar / ROT-n, Vigenère, Beaufort, Playfair, Hill, Bifid, ADFGVX, rail fence and columnar transposition; Base64 / 32 / 58 / 45 / 85, hex, binary, URL, HTML entities, quoted-printable and punycode; Morse, tap code, NATO, Braille, semaphore and keyboard-shift; pigpen and other glyph ciphers drawn as inline SVG with a clickable symbol pad; and offline geohash, Plus Codes, Maidenhead and MGRS. Auto-detect chains up to three transformations deep (base64 → ROT13 → plaintext comes back as one row with its chain spelled out) and ranks candidates by how much the output reads like English or French. The differentiator is the content triage panel underneath: it flags URLs, defanged indicators, Reddit / YouTube / TikTok / X / Telegram / Mastodon handles, IPs, emails, coordinates, wallet addresses, hashes, JWTs and CTF flags found in the decoded text — every link inert and defanged until you explicitly confirm opening it, .onion never one-click, and cards / IBANs / wallets masked by default. 100% client-side, EN + FR interface. Hashes are identified, never claimed to be “decrypted”; what3words is recognised and linked out rather than silently queried, because resolving it offline is impossible; and where a glyph set is a CyberRamen drawing rather than the original plates, the symbol pad says so.
  • FIX Certifications Hub (/certifications/) — the page was rendering as unstyled raw HTML, and the cause turned out to be site-wide. A language-routing rule added during the multilingual rollout matched every nested path under /certifications/, /awareness/ and /grc/ — including the files living there, not just the pages — so around thirty stylesheets, scripts and data files were being 301-redirected into 404s. The hub was the visible casualty; the GRC risk register and several awareness widgets were also quietly missing their scripts and JSON. The rule now only rewrites paths that are not real files. Alongside it, scroll-reveal content no longer starts invisible waiting on a script to un-hide it — if an asset ever fails to load again, the content is simply there, instead of a blank space with nothing in the console to explain it.
  • IMPROVE Certifications Hub (/certifications/) — easier to move around. It is a long page — 41 certifications across eight sections — and everything you needed to navigate it sat at the very top, so once you scrolled you lost your place. The section nav now sticks to the top and marks the section you are in; on a phone it stays one swipeable row instead of wrapping to four and eating a sixth of the screen. An active filter now follows you down the page with a one-click Clear, so a filter can no longer be silently in effect while you read the deep dives far below the controls. Plus a back-to-top button, and the sticky table header and deep-dive bar now stack under the nav instead of hiding behind it.
  • SITE New page: Recommended Services (/en/recommended). A short, honest list of third-party services actually in use here — starting with Tuta Mail (end-to-end encrypted mail and calendar, hosted in Germany) and PentesterLab (hands-on web, API, and code-review exercises). Some links are referral links and are labelled as such; every entry also carries a plain link with no referral code, so you never have to use ours. Nothing is paid placement, there are no referral links inside the tools, and the site stays ad-free and analytics-free. The privacy notice now spells out exactly what does and does not leave your browser when you click one.
  • NEW New tool: Actionable CVEs Dashboard (/tools/actionable-cves.php). The morning-triage bowl — the CVEs newly added to the CISA KEV catalog (someone is exploiting these right now), enriched with FIRST EPSS scores, alongside the highest exploit-probability CVEs today. Ransomware-linked entries and overdue fix dates are flagged; filter by keyword, ransomware-only, or a 7 / 30 / 90-day window; export CSV or JSON. The page sends nothing upstream: it serves one pre-computed feed refreshed server-side from KEV + EPSS at most every few hours via SSRF-guarded fetches, your IP is never forwarded, and all filtering runs in your browser.
  • NEW Three new tools for email & domain security. DMARC Report Analyzer (/tools/dmarc-report-analyzer.php) turns the daily DMARC aggregate (RUA) XML your mailbox receives into a readable pass/fail-by-source view, flagging mail sent as your domain that failed both aligned SPF and DKIM — spoofing, or a legitimate sender you haven't authorized yet. 100% client-side; .gz reports are inflated in the browser, nothing is uploaded. Domain Security Posture Scanner (/tools/security-posture-scanner.php) grades one domain from A+ to F across security.txt, DMARC, SPF, MTA-STS, CAA, DNSSEC and HSTS in a single report. Subdomain Takeover Checker (/tools/subdomain-takeover-checker.php) finds dangling CNAMEs an attacker could claim, matching 20+ takeover-prone services and confirming with each service's unclaimed-page fingerprint. The latter two run their DNS and HTTP checks server-side through SSRF-guarded fetches; your IP is never forwarded.
  • NEW New: a free, no-signup Developer API (/api/) for the everyday pure-logic transforms, so you can wire CyberRamen into playbooks, Slack bots and CI without opening the browser. Curl-able JSON endpoints under /api/tools/: defang / refang, hash identification, CIDR math, timestamp conversion, IOC extraction, and CVSS v3.1 scoring. No auth, CORS-enabled, rate-limited, CC BY 4.0 — pure logic only, so nothing is stored or forwarded. Docs with copy-paste curl examples at /api/.
  • SITE Two ways to keep up and find things faster. Subscribe to our own feed — new tools and updates now publish as Atom (/feed.xml) and JSON Feed (/feed.json), auto-discovered by your reader, no email required. And a new site-wide search: a visible box on the homepage plus a dedicated /search page that works without JavaScript, is shareable and crawlable, and searches every tool by name, tag, or the job you're trying to do.
  • SITE Send an artifact straight to the next tool. Many tools now show a “Send →” button in the “Still hungry? Try next” strip — look up a domain in DNS Record Lookup and carry it into WHOIS, DNS Mapper or the new Posture Scanner in one click (a single-shot, in-browser handoff: values only, never stored). Also new: every tool page now carries a small trust badge beside its title — “100% client-side” or “server-assisted” (your IP is never forwarded) — driven by the same manifest flag as the footer note, so the privacy story now reads consistently on every page.
  • NEW New tool: Filigrane — Document Watermark (/tools/filigrane.php). Stamp a repeated, semi-transparent diagonal watermark across an ID card, payslip, bank statement, or PDF before sending it to a landlord, recruiter, or insurer — a deterrent against identity theft and a way to attribute a leaked copy. Accepts JPG / PNG / WEBP and PDF, single or batch, with grouped preset templates (identity, housing, employment, banking, insurance, admin), a live preview, adjustable opacity / angle / density / colour, an "always export as PDF" toggle, and download-all-as-zip. Auto tokens [DATE_AUTO] / [TIME_AUTO] resolve to the real send date at export. 100% client-side: the file is decoded in a <canvas> and downloaded back — no upload endpoint, no server storage, and the strict CSP (connect-src 'self') makes phoning a file home technically impossible. No cookies, no localStorage, no analytics on the page, and a one-click Panic Clear. PDF.js is vendored locally (no CDN), version-pinned and SRI-checked. Concept inspired by the French government's Filigrane Facile (filigrane.beta.gouv.fr / DossierFacile).
  • SITE Third security pass: completed the CSP nonce migration so external script tags load correctly under the strict policy, added rate-limiting to the remaining server-side tools, hardened a couple of feed parsers and one regex shape, and shipped a small PHP unit-test runner. The service worker no longer caches HTML pages. Pure-code — no user-facing tool behaviour changes.
  • SITE Second security hardening pass: nonce-based Content Security Policy (no unsafe-inline for scripts), additional protections on server-side fetches, response-size caps on upstream data feeds, and removal of unused code paths. Pure-code — no user-facing tool behaviour changes.
  • SITE Site-wide security hardening sweep: SSRF protections on all server-side fetches, IP-based rate limiting across the tool APIs, stricter Origin and CSRF checks on the anonymous benchmark submission, and CSPRNG-based UUIDs in the detection-rule builders. No user-facing tool behaviour changes.
  • NEW New interactive section on Reporting Fraud in Luxembourg (/awareness/reporting-fraud-luxembourg/#templates): four downloadable + copy-to-clipboard complaint-letter templates that generate both French and English versions side-by-side from the same form. Templates: (1) Plainte for the Police Grand-Ducale, (2) bank dispute / reimbursement request, (3) incident summary sheet (with auto-generated next-steps by incident type), (4) CNPD / GDPR complaint (Article 77). Live preview, FR/EN toggle, print-as-PDF, per-template clear button. All data stays in localStorage under cr_fraud_templates — nothing is transmitted. Also new: International Reporting Map (/awareness/reporting-fraud-international/) — country dropdown covering 30+ countries (every EU/EEA member plus UK, US, Canada, Australia, Switzerland, Norway) with verified links to the local cybercrime portal, consumer-fraud authority, and GDPR / data-protection regulator, plus cross-border resources (ECC-Net, Europol, OLAF, Interpol, EDPB). Last-selected country saved in cr_fraud_country. Both pages cross-link; the LU page gets a "Not in Luxembourg?" banner at the top.
  • CONTENT 10 new awareness pages, all consumer-facing and Luxembourg / EU-aware. The conversion engine: I've Been Hit (/awareness/ive-been-hit/) — calm, situation-by-situation recovery with the local reporting map. The LU / EU trio: Reporting Fraud in Luxembourg (decision tree across bank / plainte / SPAMBEE / CIRCL / CNPD / BEE SECURE / CSSF / cyberfraud.lu), EU Scam Patterns (fake SEPA refunds, fake CSSF / bank messages, parcel customs fees, cross-border crypto "advisors"), and Your GDPR Rights (the practical version — which article, what to write, escalating to the CNPD). New flagship monthly series: Scam of the Month (/awareness/scam-of-the-month/) opening with a preview teardown of the fake-CSSF / LuxTrust-tap pattern. Plus four standalone explainers — Quishing, Email Account Compromise, SIM Swapping, and Digital Legacy. All ten pages share one new stylesheet (/awareness/assets/article.css), a 🇱🇺 In Luxembourg callout component, and a soft non-salesy bridge to johlem.net at the bottom. Cards are now linked from the Security Awareness Hub.
  • FIX WHOIS Lookup (/tools/whois-lookup.php) — the domain status badges ("clientTransferProhibited" etc.) were rendering in a near-invisible bright yellow (#fc0) on a faint yellow tint that washed out completely on the cream background. The "active" badge was also using the brand red instead of green. Both now use the theme tokens — --color-warning orange for locked/prohibited badges and --color-success green for active — with a matching border, bumped to weight 600 for legibility. Same fix applied to the DNSSEC "signed" indicator.
  • IMPROVE Nmap XML Report Parser (/tools/nmap-xml-parser.php) — added a "Load sample" button next to Parse / Clear. One click fills the textarea with a realistic fake -sV -sC -O scan (a small 10.0.5.0/24 with a Linux web/db box, a Windows Server 2019 domain controller, a Raspberry Pi, and one host down) so new visitors can see what the host cards, severity hints, NSE script blocks and Markdown / CSV exports look like without running nmap themselves. Sample XML is embedded in the page; nothing fetched or uploaded.
  • SITE Site-wide status colour audit. Swept every tool and GRC page for places where success / warning / error states used the wrong colour — most often the brand red --color-accent being reused as a generic "highlight" for success states, or hardcoded muted hex values (#1e6b30, #9c2a1e, #9a5b13, plus stray Bootstrap / Tailwind palettes like #dc3545 / #28a745 / #ef4444) drifting away from the theme. Roughly 45 files now use the canonical tokens --color-success (#2e7d32), --color-error (#b71c1c) and --color-warning (#e65100). Notable fixes: Port Lookup security badges, UUID Validator, Config Validator, Rewrite Tester, Password Generator (the "Strong" label was rendering red), HTTP Status Codes (2xx success now green, 5xx server error now red), Phishing Checker HTML report. Tools / GRC pages that used a deliberate 4+ tier severity scale (CVSS calculators, incident timeline, NIST CSF function colours) were left alone — those are scales, not binary status indicators.
  • IMPROVE SSL Certificate Checker (/tools/ssl-checker.php) — fixed the trust-status colour coding. The "Excellent / Highly Trusted" label, the score number itself, and the ✓ positive indicators ("Domain matches certificate", "Issued by trusted CA", "Strong key (2048 bits)", "Extended Validation") were all rendering in the brand red because the CSS reused --color-accent for the success state. They now use the existing theme tokens --color-success (green) and --color-error (red) consistently across the trust card, score circle, quick-info border, certificate details, SAN match badges, and the downloadable Text / HTML reports.
  • FIX CIDR Calculator (/tools/cidr-calculator.php) — fixed three bugs in Range → CIDR mode that produced wrong results (and could hang the page) for any range with the high bit set, i.e. any IP ≥ 128.0.0.0. Signed-vs-unsigned 32-bit arithmetic was breaking the aligned-block search, the shrink loop, and the next-start advance. Verified with a 100-assertion offline test suite covering all three modes, /0 – /32 prefixes, classful boundaries, RFC 3021 /31 handling, private/loopback detection, and range coverage round-trips.
  • IMPROVE CIDR Calculator (/tools/cidr-calculator.php) — added an "Export to .txt" button on the results panel. Downloads a plain-text report of the calculated network, address details, range, dotted-binary representation, and quick reference. Filename pattern: cidr-<network>_<prefix>.txt. 100% client-side — nothing is sent to the server.
  • NEW New workflow: Phishing Investigation (/tools/workflows/phishing-triage.php). The first end-to-end chained recipe on the site — Phishing Checker → Email Header Analyzer → IOC Defanger → IOC Pivoting wired together around a shared in-memory case context. Each step still links out to its standalone tool (graceful degradation). The case is in-memory by default; an explicit toggle opts in to localStorage. Final export is CSV or STIX 2.1, mirroring the IOC Pivoting bundle shape. "Send to IOC Defanger" demonstrates a true handoff: the next tool pre-fills its input from the case via single-shot sessionStorage.
  • SITE Discovery upgrade — phase 4. New homepage "Back to your bowl" row remembers the last 8 tools you opened so you can jump straight back. Stored locally in your browser — tool NAMES ONLY, never inputs, never results. The same recents list seeds the Ctrl-K palette's empty state. One-click clear; opt-out toggle planned for the privacy page.
  • SITE Discovery upgrade — phase 3. Press Ctrl-K / Cmd-K anywhere on the site to open a centred command palette that fuzzy-searches every tool by title, blurb, and tag (keyboard-navigable, focus-trapped, no dependencies). The /tools/ listing gets a faceted chip bar (client-side only, exports CSV / STIX, intent tags) with AND logic, live count, and shareable URL state. New homepage block "What's on your plate?" lets you find tools by the artifact in hand — type a description or tap a chip (URL / Email / IP / Domain / Hash / CVE / Log / Cert) and the manifest answers with the matching tools. Editorial / graph-driven, no analytics.
  • SITE Discovery upgrade — phase 2. Every tool page now ends with a "Still hungry? Try next" strip of 1–3 complementary tools. Curated picks come first (each tool entry in the manifest lists hand-chosen `related` slugs), then a produces→consumes graph fallback fills any remaining slots — so a tool that produces a domain naturally suggests tools that consume a domain. No tracking; no "most used"; purely editorial / graph-driven.
  • SITE Discovery upgrade — phase 1. Site-wide tool manifest (/assets/data/tools.json, 126 tools, each with consumes / produces / related / jobs metadata) now powers a new homepage "New on the menu" strip showing the 4 most recently added tools, plus per-tool privacy badges (◖ 100% client-side / ◗ server-assisted) on the /tools/ listing. Editorial only — no analytics, no tracking, no usage telemetry.
  • NEW New tool: PGP / GPG Key Lookup (/tools/pgp-key-lookup.php). Find a public OpenPGP key by email, fingerprint, or 16-hex long key ID. keys.openpgp.org is the primary source (verified-email keyserver) with keyserver.ubuntu.com as automatic fallback — both are proxied server-side so the client IP is never forwarded upstream. The browser parses the returned key locally and lists every user ID with name, email and comment broken out separately, all aliases, every subkey with capabilities, plus a chronological timeline of creation, self-signatures, expiration and revocations.
  • NEW 18 new tools added to the Tools Hub (107 → 125). Spicy Specials: Windows Event ID Lookup, Sysmon Config Builder, Log Parser Pattern Builder. Bento Box: EPSS Score Lookup, SSVC Decision Tree, DORA Register of Information Builder, NIS2 Self-Assessment, BIA / RTO-RPO Calculator, ISO 27001:2022 SoA Builder. Ramen Bowls: Email Auth (SPF/DKIM/DMARC) Record Builder. Pentester Platter: LOLBin / GTFOBins Browser, Reverse Shell Generator, Hashcat / John Rule & Mask Builder. Crypto Gyoza: CSR Generator & Decoder, HMAC Generator, SRI Hash Generator. Side Dishes: Cookie Security Analyzer. Robo Ramen: NIST AI RMF Checker. All client-side except EPSS Lookup (FIRST EPSS proxied, IP not forwarded) and SRI Generator URL mode.
  • IMPROVE RSS feeds (/tools/cve-feeds.php) — added nine new feeds across a new CERT & Government category and the Threat Intel / Vulnerabilities sections. New: CERT-EU Security Advisories, CERT-EU Threat Intelligence, NCSC UK All Feeds, CERT.be Belgium, CERT Polska, NCSC-FI Daily Vulnerability Digest, CIS MS-ISAC Advisories, Palo Alto Unit 42, ZDI Upcoming Advisories, Full Disclosure (seclists.org). Removed Threatpost — publication shuttered by Kaspersky in September 2022. 37 active feeds total.
  • SITE GRC Hub v2 — major release. Seven new modules join the hub: DORA Engine, Cross-framework Crosswalk, Risk Register, Evidence Request List generator, Policy Templates library, Board Reporting Pack and Anonymous CSF Benchmarking. New trust layer at /grc/methodology/ documents how every dataset was built; read-only JSON API at /api/v1/ exposes the data under CC BY 4.0; /llms.txt added for AI crawlers. All vanilla, no CDN, no tracking.
  • NEW New tool: DORA Engine (/grc/dora-engine/). Five tabs covering Regulation (EU) 2022/2554: applicability and proportionality (Art. 2 / 4 / 16), Level 1 + RTS 2024/1774 self-assessment (49 items), Register of Information generator following the ESA ITS template (Implementing Reg (EU) 2024/2956) with LEI checksum and cross-table integrity, TLPT applicability, and major-incident classification helper with Art. 19/20 reporting-clock countdown per Delegated Reg 2024/1772.
  • NEW New tool: Cross-framework Control Crosswalk (/grc/crosswalk/). 623 edges connecting NIST CSF 2.0, SP 800-53 r5 Moderate, ISO 27001:2022 Annex A, DORA L1 + RTS 2024/1774, NIS2 Art. 21 + Implementing Reg 2024/2690, GDPR security obligations and CRA Annex I. Pivot, framework-pair and "implement once / comply many" coverage views with documented exact / strong / partial / related weights.
  • NEW New tool: Risk Register (/grc/risk-register/). ISO/IEC 27005-aligned, client-side, multi-engagement. 5×5 inherent vs. residual heatmaps with toggle, ENISA-derived threat catalogue, optional FAIR-lite triangular Monte Carlo (10 000 iterations in a Web Worker), CSV import with column-mapping wizard, Excel/CSV/Markdown/PDF exports.
  • NEW New tool: Evidence Request List Generator (/grc/evidence/). Pick the frameworks in scope (NIS2, DORA, GDPR, ISO 27001, CRA, NIST) and get a deduplicated ERL — artifacts shared across frameworks appear once with all references listed. Excel export ships with tracker columns (Status, Date received, Reviewer, Notes). Client-facing Markdown / PDF cover letter included.
  • NEW New tool: Policy Templates Library (/grc/policy-templates/). 12 SME-sized policy templates (Information Security, Incident Response, BCP/DR, Access Control, Cryptography, Third-Party Risk with the DORA Art. 30 clause checklist, Vulnerability & Patch, Logging & Monitoring, Acceptable Use, Backup, Awareness, Data Protection). YAML front-matter and per-clause trace IDs link directly into the Crosswalk. Customise-in-browser, Markdown / Word-friendly HTML / Excel traceability matrix exports.
  • NEW New tool: Board Reporting Pack Generator (/grc/board-pack/). One click from your saved GRC state (CSF assessment, DORA Engine, Risk Register, Regulatory Calendar) to a board-ready PDF. Executive summary auto-drafted with computed values then editable. Maturity radar, top-10 residual risks, regulatory exposure, upcoming deadlines, methodology appendix. Snapshot feature compares maturity over time.
  • NEW New tool: Anonymous CSF Benchmarking (/grc/benchmark/). Compare your CSF 2.0 maturity to anonymous aggregates by sector (NACE top-level), size band and region. Opt-in only — the literal JSON payload is shown to you before sending; nothing else leaves. Aggregates only render when n ≥ 20 (k-anonymity), falling back to parent slices otherwise. No IP, user-agent or sub-month timestamps stored.
  • NEW New tool: NIST CSF 2.0 Self-Assessment moved to its own URL (/grc/csf-assessment/). Rate all 22 CSF 2.0 Categories on a 0–4 maturity scale (T0–T4), radar chart, function means, gap report. Scores live in your browser and feed the Board Pack and Benchmark modules. The previous /tools/compliance-db.php#assess panel keeps a notice pointing here.
  • FIX Regulatory Calendar (/grc/regulatory-calendar/) — fixed the "No events match your filters" empty-table bug. The full table is now server-side rendered so it is visible without JavaScript, the default view automatically falls back to "All" when "Upcoming" is empty, and a live counter shows visible vs. total events.
  • IMPROVE Regulatory Calendar adds ICS calendar export (single event and full calendar — opens in Thunderbird, Outlook, Proton Calendar), JSON export alongside CSV, and a fresher dataset schema (id, date precision, jurisdiction, source label, confidence). Seed data covers DORA, NIS2, GDPR, CRA and ENISA milestones with EUR-Lex source links.
  • NEW New tool: AI/ML Threat Model Builder. 5-step wizard maps your system architecture (model type, data, capabilities, access, controls) to a curated catalog of 27+ threats. Cross-references STRIDE, MITRE ATLAS, and OWASP LLM Top 10 with calibrated risk levels and recommended control gaps. Markdown and JSON export.
  • NEW New tool: Prompt Injection Playground. Practice 8 prompt-injection scenarios (direct override, persona substitution, RAG exfiltration, indirect via fetched page, payload smuggling, DAN-style jailbreak, blind extraction, multi-turn bypass) against a deterministic JS engine. No API, no telemetry. Progress saved locally.
  • NEW New tool: LLM Red Teaming Checklist. 60 items across 6 phases (recon, prompt injection, output handling, excessive agency, data exposure, DoS) for practitioners running real LLM application assessments. Per-item status + notes, auto-save, Markdown engagement report.
  • NEW New tool: OWASP LLM Top 10 Checker. Self-assessment across all ten OWASP Top 10 for LLM Applications risks (v1.1 2024/2025): prompt injection, sensitive information disclosure, supply chain, data poisoning, insecure output, excessive agency, system-prompt leakage, vector/embedding weaknesses, misinformation, unbounded consumption. Gap report with CSV / JSON / Markdown export.
  • NEW New tool: CVSS v4.0 Calculator. Official FIRST scoring algorithm (lookup table + max-severity port) with Base, Threat, Environmental, and Supplemental metric groups. Real-time scoring, score-type detection (CVSS-B / BT / BE / BTE), vector string parsing, and URL parameter sharing. Sits alongside the existing CVSS v3.1 calculator.
  • IMPROVE MITRE ATLAS Search now includes a Report Builder: add techniques as you browse, view your selection, and export a Markdown report covering all selected techniques with description, detection, mitigation, and atlas.mitre.org links. Selection persists in localStorage.
  • NEW New tool: Interactive Google Dork Builder. Compose advanced search-engine queries with operators (site:, filetype:, inurl:, intitle:, intext:, ...), live preview, one-click Copy, and Launch buttons for Google / DuckDuckGo / Bing / Yandex / GitHub. Includes a preset gallery for OSINT and bug bounty.
  • IMPROVE Phishing Checker now shows a transparent point-by-point score breakdown for every URL pattern check (which fired, which did not, and how many points each contributed). Added a stronger disclaimer: heuristic only, no antivirus/malware scan, no threat-intelligence/blocklist lookup, valid SSL is not evidence of legitimacy.
  • NEW New tool: NIST CSF 2.0 Profile Builder. Score all 106 subcategories Current vs Target on a 0-4 scale, see gap analysis by Function and Category, export JSON / CSV / Markdown. Based on NIST CSWP 29.
  • NEW New tool: NIST CSF 2.0 Tier Self-Assessment. Pick your Implementation Tier (Partial / Risk Informed / Repeatable / Adaptive) across the Risk Governance and Risk Management dimensions from CSWP 29 §2.4.
  • IMPROVE Control Mapper now includes a Subcategory Browser tab covering all 106 NIST CSF 2.0 subcategories with full descriptions and inline ISO 27001 / DORA cross-walk chips.
  • IMPROVE Added unified Copy / JSON / CSV / TSV / Markdown / Text export bar across IP Info, DNS Record Lookup, WHOIS, JWT Decoder, Email Header Analyzer, Regex Tester, Timestamp Converter, and CVE Feeds.
  • FIX DNS Record Lookup CSV export now follows RFC 4180 (proper quoting & escaping for record names containing commas or quotes).
  • SITE Launched this changelog page so visitors can track ongoing improvements at a glance.
Got a suggestion or spotted something broken? Email hello@cyberramen.com — we read every message.