Capabilities

Every check this instance actually runs.

Ember Aegis lists its checks by name. Each one is passive unless a separately authorized active mode is enabled, and each result carries its source, method, timestamp, severity, confidence, and coverage.

The check inventory

Built from the live check registry at import time, so this page cannot claim a check the scanner does not run.

25 checks across 3 families, each one implemented in this instance.

Digital posture

TLS / certificateNegotiated protocol, certificate chain, validity, and key strength.
Security headersPresence, syntax, and enforcement gaps in published response headers.
Cookies & CSPSecure, HttpOnly, SameSite flags and Content-Security-Policy directives.
Subresource IntegrityCross-origin script and style tags missing an integrity hash.
DNS / DNSSECDelegation, DNSSEC signing, and records that resolve to nothing.
Email auth (SPF/DKIM/DMARC)Published sender-authentication policy syntax and alignment.
CORS policyOrigin reflection, credential exposure, and wildcard sharing.
Mixed contentCleartext subresources referenced from a secure document.
Cross-Origin-Opener-PolicyEffective-origin isolation of the browsing context.
security.txtRFC 9116 disclosure file presence and field syntax.
Vulnerable JS librariesDeclared library versions matched against advisory ranges.
Tech fingerprintTechnology disclosed by headers and served markup.

Device and network privacy

This-host identityInterfaces and addresses belonging to this machine only.
Claimed CIDR membershipWhether this host sits inside the range you authorized.
Default gatewayThe route this host would use, read from the local table.
DNS nameserversResolvers this host is configured to trust.
This-host listen bindsPorts this machine is listening on, with their scope.

Physical privacy

Systematic visual sweepGuided authorized inspection step. A phone is not TSCM equipment, so confidence stays capped no matter the result.
Check common hiding spotsGuided authorized inspection step. A phone is not TSCM equipment, so confidence stays capped no matter the result.
Flashlight / lens-reflection checkGuided authorized inspection step. A phone is not TSCM equipment, so confidence stays capped no matter the result.
Mirror and suspicious-object checksGuided authorized inspection step. A phone is not TSCM equipment, so confidence stays capped no matter the result.
Wi-Fi / Bluetooth device check (where allowed)Guided authorized inspection step. A phone is not TSCM equipment, so confidence stays capped no matter the result.
Infrared night pass (high-risk)Guided authorized inspection step. A phone is not TSCM equipment, so confidence stays capped no matter the result.
RF-detector reading entry (optional)Guided authorized inspection step. A phone is not TSCM equipment, so confidence stays capped no matter the result.
Professional TSCM handoff (high-stakes)Guided authorized inspection step. A phone is not TSCM equipment, so confidence stays capped no matter the result.

What a finding carries

A finding is a measurement with its provenance attached, never a verdict.

Source: The exact response, record, or document the finding came from.
Method: How it was observed, in one sentence a reviewer can check.
Timestamp: When the observation happened, not when it was rendered.
Severity: Impact if the observation is real. Independent of confidence.
Confidence: Evidence strength. A weak signal cannot inflate severity.
Coverage: What was not reached. A timeout is a gap, never a clean result.

How to read this

Authorized-only · evidence-based · point-in-time. Aegis cannot guarantee the absence of weaknesses or hidden devices. On this machine, live external HTTP/TLS may be network-blocked and shown as an honest coverage gap. Severity and confidence are kept separate. Finished assessments persist in the encrypted store while durable storage is bound. A theme choice may persist in this browser. Export remains available for a copy you can take with you.