Serverless Posture Audit — Edge Function + Serverless Best-Practice Scanner

Mode

Paste your handler (Netlify Function, Cloudflare Worker, Vercel handler, Deno / Lambda / DO Function, Fly/Render/Railway Node service)

Runs 100% in your browser. Nothing is uploaded. Lints ~25 posture rules across platform-agnostic and platform-specific patterns.

Function endpoint URL

Passively reads response headers: platform fingerprint, CORS config, cache-control, bot-protection presence, double-CDN, retry-after handling.

What this checks

Platform-agnostic posture (25 rules)

Origin / Referer allowlist — blocks direct curl and cloned sites embedding your endpoint
Rate limiting — per-IP or per-token; critical for probe / search / HIBP-style endpoints
CORS wildcard — * + Allow-Credentials:true is a critical misconfiguration
Secret in log / response body / query string — console.log(process.env.*) leaks
SSRF — user-supplied URL → fetch() with no scheme / host allowlist
Outbound-fetch timeout — no AbortSignal.timeout() = hung container $$$
Stack-trace leak — returning err.stack / e.message in the response body
Input size cap — no length check on body / query params = DoS vector
eval / new Function / vm — dynamic code execution
Hardcoded secrets — regex match for AWS / Bearer / API-key shapes
Path traversal — unvalidated user input reaching readFile / fs.*
Missing Retry-After on 429 — clients don’t know when to back off
Missing Cache-Control on private endpoint — CDN may cache user-scoped data
HMAC on mutating POST — signed requests for high-cost endpoints
Redirect-follow with no scheme check — redirect to file:// or internal IPs
localStorage / sessionStorage — don’t exist in Workers / edge runtimes
Unbounded loops — while(true) without break / budget
Missing content-type — browsers sniff and mis-render
Error handler returns raw Error — exposes internals
Missing Content-Security-Policy on HTML responses
Debug / verbose logging — leaks IP / auth / keys
Unprotected admin paths — /admin, /debug, /internal without auth check
Insecure random — Math.random() for tokens / IDs
Missing request-method allowlist — handler accepts any verb
Empty body on DELETE / PUT without auth

Live-probe signals (passive, consent-gated)

Platform fingerprint — reads response headers to identify host
Double-CDN detection — both cf-ray AND x-nf-request-id / x-vercel-id = cache coherence + IP-trust risk
CORS allow-origin + allow-credentials matrix
Cache-Control on JSON / API responses — public on user-scoped = cross-user cache bleed
Bot-protection presence — Cloudflare Challenge, Turnstile, hCaptcha markers
Retry-After header on 429 / 503
Server / X-Powered-By exposure — version leaks
Stack-trace leak in live error body

Not in scope: burst / crafted-Origin / malformed-body probing. Run those from your own test rig against your own endpoint.