Yongchivo Tools
LiveA hub of free cybersecurity micro-tools at tools.yongchivo.com, in English and Spanish (mirrored under /es/), built on Astro and Tailwind on Cloudflare Workers.
Most of the tools run entirely in your browser, so nothing you type leaves your device. Two are the honest exception: the Security Headers Checker has to request the site you're checking, and the Breach Checker queries the XposedOrNot breach database. In both cases nothing is logged or stored — the data only exists in memory for that one request.
Security work behind it
- SSRF protection in the Security Headers Checker: private IP ranges, localhost, the cloud metadata address, non-HTTP schemes, embedded credentials and non-standard ports are blocked — and every redirect hop is re-validated.
- A real secret-management incident: an API key ended up saved as the name of a Cloudflare secret instead of its value. It was caught, rotated immediately and redone properly.
- The site graded itself: the first run of the headers checker against tools.yongchivo.com came back F. Fixed the same day with a _headers file — it now scores A.