Good start indeed, it'd be nice to have a small open source tool to do these checks, maybe even with a simple web interface - anyone seen a simple security checklist / analyser that's well maintained with the latest standards?
Yeah that's what I use at present, if it's not an A+ it's not OK. Would be nice to have an open source version of this that could perform additional checks though.
Comments
Good start indeed, it'd be nice to have a small open source tool to do these checks, maybe even with a simple web interface - anyone seen a simple security checklist / analyser that's well maintained with the latest standards?
SSL labs is the gold standard:
https://www.ssllabs.com/ssltest/
But I don't see a way to automate a test for the integrity of (say) a password recovery flow or that one user cannot access another user's data.
Yeah that's what I use at present, if it's not an A+ it's not OK. Would be nice to have an open source version of this that could perform additional checks though.