One note per lab: what the check measures, how to read the numbers, and what to fix first. Written from engagements, not from vendor pages. Updated when the labs change.
The MDN HTTP Observatory grade is not a vulnerability scan. It reads the response headers of your front door and scores whether the browser is told to behave safely: HSTS forces HTTPS, Content-Security-Policy limits where scripts may load from, X-Frame-Options and the frame-ancestors directive stop clickjacking, and the referrer and cookie flags limit what leaks to third parties.
Spoofing your domain takes one line in a mail client unless DNS says otherwise. SPF lists who may send, DMARC tells receivers what to do with mail that fails, DKIM signs every message, MX proves the domain receives at all, DNSSEC signs the answers so they cannot be swapped in transit, and CAA restricts which certificate authorities may issue for the name.
The finder generates up to 140 variants of your name from the patterns attackers actually use: a dropped letter, a doubled one, two swapped, a keyboard neighbour, a hyphen, a homoglyph such as rn for m, a suffix like -login, and the same name under another top-level domain. It then resolves each one to see which exist.
The check hashes the password locally with SHA-1 and sends only the first five characters of that hash to Have I Been Pwned. The service returns every hash with that prefix, hundreds of unrelated ones, and the browser looks for a match. The password itself never leaves the page.
The X-ray reads the bytecode of a mainnet address directly from public nodes and extracts the function selectors, the proxy slots defined by ERC-1967 and older Zeppelin layouts, the owner and paused state, and the dangerous opcodes: SELFDESTRUCT, DELEGATECALL and CREATE2. Sourcify tells whether the published source matches what is deployed.
Documents, e-mails and web pages can carry instructions a human never sees: Unicode tag characters that render as nothing, zero-width joiners, bidirectional overrides that flip what the eye reads, and homoglyphs from other scripts. An LLM reads all of it. The scanner exposes those characters and then matches the normalised text against the OWASP LLM01 injection families, tool-poisoning markers and common secret formats.
When an agent connects to an MCP server, every tool description becomes text the model reads and obeys. A poisoned description can tell the model to read a private key before adding two numbers, to route all mail through one tool, or to keep quiet about it. The scanner checks names, descriptions and schemas for those markers, for sibling-tool references and for outbound URLs.
Thirty minutes to scope it. A fixed-price proposal within two business days.