Web Delivery Audit

Configuration-driven audits for the public delivery layer of websites and web applications. Check DNS, TLS, redirects, response time, security headers, canonical hosts, and required public resources locally or in continuous delivery.

Release status: Initial public alpha. Treat network timings as environmental signals and evaluate them across repeated CI runs rather than as exact measurements.

Features

• IPv4, IPv6, and CNAME discovery
• Trusted-certificate, expiration, and negotiated TLS-version checks
• Explicit redirect-chain inspection
• HTTP status and response-time expectations
• Required security-header presence or exact-value checks
• Required public-resource checks
• JSON and Markdown reports
• GitHub job-summary support
• Containerized GitHub Action

Requirements

• Node.js 22.19 or newer

Install and run

npm install
npm run audit -- --config config.example.yaml

Validate configuration without network requests:

npm run audit -- --config config.example.yaml --validate

Reports are written to reports/web-delivery-report.json and reports/web-delivery-report.md. Failed expectations produce exit code 1; configuration or execution errors produce exit code 2.

Configuration

See config.example.yaml and the machine-readable schema/config.schema.json.

version: 1
targets:
  - name: Example
    url: https://example.com/
expectations:
  https_only: true
  canonical_host: example.com
  maximum_redirects: 1
tls:
  minimum_days_remaining: 21
headers:
  required:
    strict-transport-security: true
    x-content-type-options: nosniff
resources:
  - /robots.txt

Project boundary

This repository is a generic audit engine. It contains no private infrastructure addresses, credentials, client data, deployment topology, alert routing, or CodeVelo production policy.

License

MIT © 2026 CodeVelo.dev LLC.