Website security regression checker

{
  "site": "https://status.example.co.uk",
  "generatedAt": "2026-10-01",
  "schemaVersion": "1.0",
  "findings": [
    {
      "id": "hsts-max-age",
      "category": "headers",
      "title": "HSTS one year",
      "severity": "critical",
      "status": "fail",
      "detail": "max-age is 30 days"
    }
  ]
}

Findings match on their stable id, so keep ids identical across audit runs; the human-readable title may change freely. A finding that disappears from the current audit is reported absent, not fixed: nothing in its category completed, and treating silence as success is how a broken scanner reads as a clean site. A definite verdict that becomes Unknown is grouped with regressions, because an answer you had is an answer you lost. When the two exports name different sites the compare still runs but says so, since tracking one site over time is this tool's job and comparing two sites is a different one. The compare itself is plain JSON matching in this tab: no uploads, no logging, and no history beyond what you paste.