Tools
Things that answer, not argue
Small tools for people who build and run platforms. Every one of them runs entirely in your browser: there is no upload, no account and no server that could keep what you paste, which is the only version worth using on infrastructure source.
Dockerfile security checker
Paste a Dockerfile and see what it exposes: unpinned base images, secrets baked into layers, containers running as root, remote scripts piped into a shell.
Every finding names the CIS or NIST control it fails and what an attacker gains from it.
Open the toolJWT decoder and security checker
Decode a token and see what it gives away: unsigned algorithms, missing expiry, absent audience, personal data and secrets sitting in a payload that is encoded rather than encrypted.
Checked against RFC 8725, the JWT best current practices. The token is never sent anywhere, which for a live credential is the only acceptable design.
Open the tool
The reasoning behind them is in the writing, and the systems are where the same controls were applied to something already in production.