Browser-native evidence for technical investigations.

Evidence, not verdicts

The fastest way to lose a technical reader is to overstate a finding. EPIC does the opposite. A missing Content-Security-Policy is described as reduced defense-in-depth, not "scripts run unchecked." A wildcard CORS with credentials notes that browsers reject that pairing. Every finding is labeled by strength:

• Observed: shown directly by browser evidence in the scan.
• Potential: a signal that needs confirmation against what you know about the app.
• Verified: shown by an authorized, repeatable check.

What the Security review covers

The Security review (OWASP) Playbook surfaces every OWASP Top 10 and API Top 10 signal on the page: CORS and credentials, security headers and CSP, SRI on third-party scripts, tokens in storage and JWT alg, exposed secrets and source maps, library versions with known CVEs, infrastructure leaks. It exports to Markdown for your tracker. For a whole app, App Crawl rolls the posture up across pages, and the control-evidence view maps signals to ISO, SOC 2 and FedRAMP for your matrix.

The honest boundary

This is browser-observable evidence for review. It is not a complete security assessment, a penetration test, or a compliance certification, and EPIC says so in the product. That boundary is what makes it useful in a professional report: you can cite it as what it is, and build the rest of the engagement on top.

Local-first, which your clients will ask about

EPIC runs in your browser. Your scans and findings stay on your device; the active probes are opt-in, use GET with no credentials, and change nothing. See exactly how on the trust page, which you can point a security-conscious client to.