HTTP Security Remediation Kit

Turn submitted HTTP headers and optional local HTML metadata into sanitized security findings, reviewable header candidates, assertions, and a remediation report.

Web developers reviewing caller-exported HTTP evidence offline without giving Utilito a target to contact.

Build-time verified sample

This static sample is separate from the live result below. Status: blocked; sanitized findings: 5.

Submitted headers, optional HTML metadata, expectations, and policy JSON

{
  "request_headers": "Accept: text/html",
  "response_headers": "HTTP/2 200\nContent-Type: text/html; charset=utf-8\nCache-Control: private, no-store\nStrict-Transport-Security: max-age=31536000; includeSubDomains\nX-Content-Type-Options: nosniff\nContent-Security-Policy: default-src 'self'; object-src 'none'; frame-ancestors 'none'\nReferrer-Policy: strict-origin-when-cross-origin\nPermissions-Policy: camera=(), microphone=(), geolocation=()\nSet-Cookie: session=[REDACTED]; Secure; HttpOnly; SameSite=Lax",
  "html_metadata": {
    "html": "<!doctype html><html lang=\"en\"><head><title>Safe sample page</title><meta name=\"description\" content=\"Safe description\"><meta name=\"viewport\" content=\"width=device-width\"></head><body><main><h1>Safe page</h1></main></body></html>"
  },
  "deployment_profile": "application",
  "expected_behavior": {
    "cookie": "require_secure_httponly_samesite",
    "cors": "same_origin",
    "csp": "restrictive_web",
    "cache": "private_no_store",
    "hsts": "required",
    "framing": "deny",
    "referrer": "strict_origin_when_cross_origin",
    "permissions": "deny_sensitive",
    "content_type": "html_utf8"
  },
  "policy": {
    "cookie": "required",
    "cors": "required",
    "csp": "required",
    "cache": "required",
    "hsts": "required",
    "framing": "required",
    "referrer": "required",
    "permissions": "required",
    "content_type": "required"
  },
  "report_format": "markdown"
}

Remove authorization, credentials, tokens, Cookie values, and secret-shaped content. Use [REDACTED] for Set-Cookie values.

Runnable browser-local sample input is ready.

Live result

Not generated. Build a new browser-local remediation packet.

Download remediation packet

Offline boundary

There is no target URL field, no fetch, no DNS, no TLS inspection, no crawl, and no endpoint scan. This is not a penetration test or security certification.

Scoped evidence

Cookie, CORS, CSP, cache, HSTS, framing, referrer, permissions, and content type stay separate. Findings expose safe header names and ordinals, never submitted values.

Manual remediation

Corrected candidates require manual review. They are not deployed configuration and not a compliance guarantee. Assertions are inert and never execute submitted content.

Limits and review notes

Only caller-submitted header lines and optional browser-local HTML metadata are inspected. There is no target URL field, fetch, DNS, TLS, crawl, endpoint scan, or penetration test.
Authorization material, credentials, secret-shaped content, request Cookie values, and non-redacted Set-Cookie values fail closed before findings, reports, assertions, or artifacts are created.
Findings expose only stable codes, severities, domains, safe header names, and ordinals. Cookie, CORS, CSP, cache, HSTS, framing, referrer, permissions, and content-type policy remain separately scoped.
Corrected header candidates are illustrative manual-review examples. They are not deployed configuration, security certification, or compliance guarantees. Generated assertions inspect caller-provided header names only and never execute submitted content.

Free runnable capability

Build and download one bounded browser-local HTTP remediation packet with no signup.

Builder capability

The existing Builder Pilot can coordinate higher bounded review volume; it does not add fetching, scanning, deployment, compliance certification, credentials, storage, or monitoring.

See the existing Builder Pilot

Privacy boundary

Browser generation runs locally. API and MCP are response-only; credentials and cookie values fail closed before findings or artifacts, and no target, fetch, DNS, TLS, crawl, scan, storage, telemetry, or model is used.