zscanner · six scanners · no signup
Scan it before they rate it
The scanner suite behind the GLM Bonus Radar, opened up. Audit a URL's security posture (headers, CORS, exposed dotfiles, leaked secrets), measure how findable a page is by search engines and generative engines — now with the performance layer (TTFB, payload, render-blocking) — run a QA reliability audit, or review pasted code heuristically. New: the Anti AI-Slop Reviewer grades how generated your design and copy read. Every scanner accepts a website/IP or a GitHub repo — public ones anonymously, private ones with your token, which is used in memory for the scan only and never stored. Findings pass a verification layer (re-probes, 404 baselines, a second GitHub channel for critical secrets, stable-UID dedup) before they reach you, and every report ends with a strong copy-paste fix prompt for your dev agent. Rule sets adapted from securityheaders/OWASP, current GEO checklists, Semgrep/Bandit-style analysis, fable's sec-scan, Cloudflare's security-audit-skill, awesome-skills' code-review-skill, gstack's design-review, the Unslop-My-UI brief, Gesso's anti-slop guards and sloptrim's AI-writing patterns.
Every scan gets a saveable token. Paste a previous one here — the new report will show what you fixed, what is still open and what is new. Same scanner + same target compares; snapshots are kept 90 days.
email notifications · sent from glm@zhelp.space-z.ai
Local addresses (@zhelp.space-z.ai) are delivered to the portal mailbox instantly; external recipients are queued on the relay and fly out as soon as its credentials are set.
01
Security Audit
For a URL or a GitHub repo. Websites: transport, HSTS, CSP deep-lint, clickjacking, cookies, Permissions-Policy, CORS reflection, server-version disclosure, 404-baseline dotfile probes (.env, .git), secrets in served HTML, stack-trace leaks. Repos: committed .env/key files, secret-shaped lines in a risk-ranked file sample, dangerous pull_request_target workflows, dependency floors from package.json & requirements.txt — Cloudflare-doctrine severity: exposures are findings, gaps are hardening, suspicions are leads.
02
SEO · GEO · Performance
For a URL or a GitHub repo. Websites: on-page SEO (title, description, canonical, OG, headings, keyword density, internal links), the generative-engine layer (robots.txt AI-crawler policy for 14 bots, llms.txt, JSON-LD, authority, citation readiness, entity coverage) and performance (TTFB, HTML weight, images, lazy-loading, render-blocking scripts, compression). Repos: discoverability (description, topics, homepage), README clarity for humans and AI, freshness, licensing — with pillar breakdowns, linker-style.
03
QA Audit
For a URL or a GitHub repo. Websites: availability and response time, doctype/charset/lang/favicon hygiene, internal-link probing with a 404 baseline (soft-404 aware), insecure references, stack-trace leakage, deprecated tags. Repos: test suite presence, CI workflows (and whether they run tests), lint/format configs, tsconfig strictness, README/CONTRIBUTING/SECURITY/LICENSE hygiene — with an ok / needs-review / blocked verdict.
04
Code Reviewer
Paste up to 256 KB of JS/TS/Python, or scan a GitHub repo (public anonymously, private with your in-memory token): secrets (AWS/GitHub/Slack/Google/PEM/JWT), eval/pickle/shell sinks, SQL concatenation, jwt.decode, framework raw-HTML escape hatches, CORS wildcards, weak hashes, dependency floors from manifests — findings cite path:line from a risk-ranked file sample, with a verification pass and a strengths-first report per awesome-skills' review format.
05
Anti AI-Slop Reviewer
For a URL. Asks gstack's question — would a human designer at a respected studio ship this? — across 50+ deterministic detectors distilled from gstack's design-review blacklist, the Unslop-My-UI brief, Gesso's 73 anti-slop guards and sloptrim's AI-writing patterns: gradient-clipped headlines, the purple/indigo band, the 3-column icon-card grid, frosted-glass defaults, bounce easing, gray-on-white contrast failures, 'delve/tapestry/seamless' copy clusters, 'It's not just X — it's Y' cadence, template CTAs and stat rows. Reports a dual grade (deduction score + per-category A–F letter-drop), quotes evidence for every tell, lists what already works, and ends with an unslop rewrite plan your dev agent can execute.