Website security audit

This audit is honest about what a paste cannot show. There is no TLS handshake, so the Transport and TLS category never scores, and there is no page fetch, so third-party content never scores either. Those categories drop out and the remaining weights renormalize; the report says which did. Nothing behind authentication is checked, and no injection or access-control flaw can be found this way.