How Talon Audit works
01 Running an audit
Sign in, then enter a URL you own or are explicitly authorised to test into the console on the home page — a scan cannot start until you're signed in. A headless Chromium instance at the edge renders the live page (JavaScript included), captures a full screenshot, and streams each instrument's progress to you in real time. A typical audit completes in about 90 seconds. Entering a URL is not authorisation for active testing — Talon only performs passive, low-impact analysis (see §10).
Your first analysis is free. Free accounts get 1 scan; Pro ($29/month) lifts that to recurring analyses. See pricing for full quota details.
02 Four analysis domains
Every finding is classified into exactly one domain.
- Exposure · externally observable security & privacy weaknesses: security headers, TLS & transport, third-party scripts, cookies & storage, mixed content.
- Integrity · whether the site works correctly: broken links, failed resources, unexpected HTTP responses.
- Experience · usability and performance: accessibility, rendered lab Core Web Vitals (LCP/CLS/FCP/TTFB, measured in one synthetic browser session), visual coherence.
- Conversion · whether visitors understand the offer and can act: value proposition, trust signals, CTA clarity, SEO.
03 Security instruments
Five passive Exposure instruments run on every audit today:
- Security headers · Content-Security-Policy (parsed for unsafe-inline, unsafe-eval, wildcard sources and missing object-src / base-uri / frame-ancestors), HSTS, X-Content-Type-Options, Referrer-Policy and clickjacking protection — recording the exact observed value and which response supplied it.
- TLS & transport · HTTP→HTTPS upgrade, HSTS lifetime and directives (includeSubDomains, preload), mixed content, and forms posting to insecure destinations. The served certificate’s issuer, protocol and expiry are observed from the live browser session, with expiry findings at 30/14/7 days. Certificate-chain completeness and cipher-suite coverage are not inspected and are reported as not observed.
- Third-party inventory · every external script, iframe, font and embedded service, classified as expected, privacy-relevant, security-relevant or requires review, with a flag for scripts loaded without Subresource Integrity.
- Cookies & browser storage · cookie flags (HttpOnly, Secure, SameSite) and storage key names captured during the render. Cookie and storage values are never stored; cookie names are shown so you can identify the affected cookie, and a session-style name is never asserted to be an authentication cookie.
- Regression detection · each re-audit is compared to the previous audit of the same domain by stable fingerprint (New / Resolved deltas).
04 Finding taxonomy
Every finding has a single classification (Exposure / Integrity / Experience / Conversion) and a type (Verified exposure, Technical failure, Operational risk, User friction, Improvement opportunity, Requires review). Severity is one of Critical, High, Medium, Low, Informational. Each finding also carries a stable fingerprint, an affected resource, a status and, across audits, a change status (New / Resolved / Regressed / Unchanged).
05 Evidence, provenance & confidence
Every finding shows the exact evidence it was derived from, plus a provenance label and a confidence level, so AI inference is never presented with the authority of deterministic evidence:
- Verified — deterministic test · e.g. a header that is present or absent in the response.
- Observed — rendered browser or network evidence · e.g. a cookie or resource seen during the render.
- Inferred — AI-assisted analysis · e.g. a messaging or design critique. Shown with lower confidence.
- Advisory — best-practice recommendation.
06 Talon Score
Scoring is fully published. Severity weights: critical = 16, high = 9, medium = 4, low = 1.5, informational = 0.3. Each domain's weighted penalty (P) maps to a 0–100 domain health via a saturating curve, health = 100 − 100 × P / (P + 25). The Talon Score is the weighted average of the four domain healths (Exposure 0.30, Integrity 0.25, Experience 0.25, Conversion 0.20). Grades: A ≥ 90, B ≥ 78, C ≥ 62, D ≥ 45, F below. A score is never proof that a site is secure. Reports created under the previous single-score model are marked Legacy scoring model and are never silently reinterpreted.
07 Remediation prompts
Every finding ships with a remediation instruction written as a self-contained prompt for an AI coding tool such as Claude Code, Cursor or Copilot: it names the issue, the evidence and the required change. Generated prompts never contain secrets, cookies, tokens or private report URLs.
08 Verification scans Beta
Regression comparison between audits is live — re-audit a domain and Talon reports which findings are new, resolved, regressed or changed by stable fingerprint. Targeted verification is in beta: on a saved report, "Verify fix" re-runs only the instrument behind a deterministic finding and reports Verified resolved or Still present (recorded with a timestamp; the original finding is never deleted). Browser-session findings (cookies, Web Vitals, certificates) and AI-inferred findings cannot be verified this way — use a full re-audit; an inferred finding that no longer appears is reported as an improvement, not a verified fix. Findings on saved reports also carry a workflow status: Open, In progress, Ready to verify, Resolved, Accepted risk, or False positive.
09 Private reports & data handling
Audits are private by default. There is no public registry, feed or archive of analysed sites, and no endpoint that lists or enumerates scans, exposes aggregate scan activity, or searches across other customers' reports. Account-owned reports require the owning signed-in session. Sensitive values are redacted before storage. The demo report on the home page is entirely fictional (northstar-demo.example) and is never generated from customer data. Full details: Data handling & security.
There is deliberately no public listing, similarity-search or aggregate-stats endpoint. Our crawler identifies as TalonBot/1.0 (+https://talonaudit.com).
10 Passive-analysis limits
Talon reads what a site already exposes to any visitor. It does not exploit vulnerabilities, brute-force paths or credentials, run destructive tests, attempt authentication bypasses, or perform denial-of-service or unauthorised active scanning. Outbound requests are constrained by SSRF protections (private, loopback, link-local and metadata addresses are blocked and every redirect is re-validated), strict timeouts and redirect limits. A failed instrument is reported honestly and never counted as a pass.
11 Domain verification & planned checks
Basic passive checks run against public pages without verification. Domain verification itself is live in beta: add a domain in your account panel and prove ownership with a DNS TXT record, a hosted verification file, or a meta tag (verification expires after 180 days). Deeper checks that will require a verified domain are planned and clearly labelled Beta/Planned wherever they appear: DNS & email-security posture, a conservative exposed-file scanner, client-side secret detection, technology and vulnerable-component inventory, and attack-surface / subdomain monitoring. They are not presented as shipped until they are.