37 Audits

Your website's AI Readiness + Security + Performance + Resilience monitor

[Wasim Shaikh @wasim117]

Really great insight audit for my website https://t.co/JmIoQttaiT

Via @tmoreira2020 @37audits

#37audits

[37 Audits @37audits]

Incredible how a demo call can be converted in a powerful feature. Thank you @globalquark for the insights shared.

[Thiago Moreira @tmoreira2020]

How many times did your @Liferay customer's license expire, and you were the last to know? 🔑

Not anymore. The 37 Audits License auditor flags the activation screen the moment it replaces the site, even when uptime monitors say all good.

https://t.co/RFgi7qZkqc

[37 Audits @37audits]

That is another reason why @37audits exist! More and more vibe code is out there with gaps/flaws that can be easily exploit.

[Rohit Ghumare @ghumare64]

Who's gonna tell vibe coders about...

1. SQL Injection
2. XSS
3. CSRF
4. CORS
5. SSRF
6. IDOR
7. Path Traversal
8. Mass Assignment
9. Clickjacking
10. Content Security Policy
11. Security Headers
12. Input Validation
13. Server-Side Authorization
14. Row-Level Security
15. Least Privilege
16. RBAC
17. Secrets Management
18. .env in .gitignore
19. API Key Rotation
20. Secret Scanning
21. Hashing vs Encryption
22. Password Salting
23. bcrypt & Argon2
24. JWT Expiry
25. Refresh Tokens
26. OAuth 2.0
27. OpenID Connect
28. Session Fixation
29. MFA
30. Brute Force Protection
31. Account Enumeration
32. Timing Attacks
33. File Upload Validation
34. Webhook Signature Verification
35. TLS Certificate Expiry
36. HSTS
37. Encryption at Rest
38. Dependency Vulnerabilities
39. Supply Chain Attacks
40. Threat Modeling
41. Indexes
42. EXPLAIN ANALYZE
43. N+1 Queries
44. Full Table Scans
45. Connection Pooling
46. Database Migrations
47. Down Migrations
48. Transactions
49. ACID
50. Isolation Levels
51. Deadlocks
52. Optimistic Locking
53. Pessimistic Locking
54. Normalization
55. Denormalization
56. Foreign Keys
57. Unique Constraints
58. Cascading Deletes
59. Soft Deletes
60. UUIDs vs Auto-Increment
61. Cursor-Based Pagination
62. Full-Text Search
63. Read Replicas
64. Replication Lag
65. Sharding
66. Partitioning
67. Hot Partitions
68. Postgres VACUUM
69. Materialized Views
70. Backups
71. Testing Your Restores
72. Point-in-Time Recovery
73. Change Data Capture
74. Outbox Pattern
75. ORM Lazy Loading
76. CAP Theorem
77. Eventual Consistency
78. Strong Consistency
79. Raft Consensus
80. Leader Election
81. Split Brain
82. Quorums
83. Clock Skew
84. Distributed Locks
85. Consistent Hashing
86. Bloom Filters
87. Two-Phase Commit
88. CQRS
89. Event Sourcing
90. Race Conditions
91. Backpressure
92. Load Shedding
93. Bulkheads
94. Jitter
95. Retry Storms
96. Cascading Failures
97. Thundering Herd
98. Cache Invalidation
99. Cache Hit Ratio
100. TTLs
101. Cache Warming
102. Write-Through vs Write-Back
103. Redis Eviction Policies
104. CDNs
105. Cache-Control Headers
106. ETags
107. Dead Letter Queues
108. Poison Messages
109. At-Least-Once Delivery
110. Exactly-Once Semantics
111. Message Ordering
112. Kafka Consumer Groups
113. Partition Keys
114. Background Jobs
115. Webhook Retries
116. DNS
117. DNS Propagation
118. HTTP Status Codes
119. HTTP Method Semantics
120. Keep-Alive
121. HTTP/2
122. WebSockets
123. Server-Sent Events
124. Long Polling
125. gRPC
126. Protocol Buffers
127. API Versioning
128. OpenAPI Specs
129. Backward Compatibility
130. Request Size Limits
131. Compression
132. Latency vs Throughput
133. Egress Fees
134. VPCs
135. Subnets
136. NAT Gateways
137. Firewalls
138. Security Groups
139. Service Mesh
140. Ingress Controllers
141. Health Checks
142. Liveness vs Readiness Probes
143. Graceful Shutdown
144. Connection Draining
145. Stateless Services
146. Failover
147. Multi-Region
148. Availability Zones
149. Single Points of Failure
150. Disaster Recovery
151. RTO & RPO
152. SLAs
153. SLOs
154. Error Budgets
155. Incident Response
156. On-Call
157. Runbooks
158. Postmortems
159. Chaos Engineering
160. Graceful Degradation
161. Autoscaling
162. Horizontal vs Vertical Scaling
163. Cold Starts
164. Capacity Planning
165. Load Testing
166. Memory Leaks
167. OOM Killer
168. Structured Logging
169. Log Levels
170. Log Rotation
171. Distributed Tracing
172. OpenTelemetry
173. Correlation IDs
174. Metrics Cardinality
175. p99 Latency
176. Alert Fatigue
177. Error Tracking
178. Profiling
179. Flame Graphs
180. Infrastructure as Code
181. Terraform State
182. GitOps
183. Blue-Green Deployments
184. Canary Releases
185. Rollbacks
186. Feature Flags
187. Environment Parity
188. Staging Environments
189. 12-Factor Apps
190. Multi-Stage Builds
191. Non-Root Containers
192. Image Scanning
193. Resource Requests & Limits
194. Pod Disruption Budgets
195. Semantic Versioning
196. Lockfiles
197. Reproducible Builds
198. Branch Protection

[Thiago Moreira @tmoreira2020]

I’m impressed by how handy @37audits is becoming.

Yesterday I deployed the new blog integration and published a post. It immediately broke the Large Resources auditor: one of the images was above the size threshold. 😅

37 Audits is a small site. Imagine a big one with dozens of publishers.

[Thiago Moreira @tmoreira2020]

Yesterday I deployed request signing for the @37audits bot, so Cloudflare and firewalls can verify its requests are legit.

The downside? It broke two auditors: Browser Console and Contact Form. 😅

Luckily, 37 Audits caught both issues.

Nothing like eating your own dog food.

[Thiago Moreira @tmoreira2020]

One of the hardest parts of keeping a @Liferay server running reliably in production today is protecting it from bots — both good and bad.

There are a few endpoints that can be abused, and the Search Portlet is one of the usual suspects.

Something as simple as requesting a delta=10000 can put unnecessary pressure on Elasticsearch and, eventually, on Liferay itself.

That’s why I built a @37audits auditor that checks whether a Liferay project is properly configured to protect against this kind of URL abuse.

https://t.co/ggp8BQHI7h

[Thiago Moreira @tmoreira2020]

Had a great surprise this morning: yesterday’s deploy broke my SEO. 😅

And yes, I mean great.

I built @37audits to catch exactly this kind of problem, so dogfooding my own tool — and having it catch a real issue I introduced myself — is a pretty good validation of the need.

Here’s what happened:

Yesterday, I updated the website copy to better explain our new monitoring feature. After finishing the copy, I committed, pushed, and called it a day.

This morning, I opened https://t.co/AEKTnqqZ4z and… it was broken. 😬

The nice part? 37 Audits had marked the deployment on the audit history. The audit immediately before the deploy was healthy; the one after it showed the SEO issue.

So it was SUPER easy to see exactly when the problem appeared and connect it to the deployment.

Nothing like your own deploy breaking your site to prove why you’re building the tool. 😂

[Thiago Moreira @tmoreira2020]

One of the most frustrating things about deploying a new version of a large system: A user finds a bug right after the release.

But the release didn’t touch that part of the code.

So… was the bug introduced by the new version, or was it already there? 🤔

Now, @37audits History marks deployments directly on the audit timeline, making it much easier to connect changes with issues.

[37 Audits @37audits]

😍

[Thiago Moreira @tmoreira2020]

Spent the last few days building a new view for the status of each auditor. It kinda of mirror the default UI/UX of regular status page.

[Thiago Moreira @tmoreira2020]

Just got my very first lead 😊

[Thiago Moreira @tmoreira2020]

Working today on improving the API coverage of @37audits so I can expose it later as a MCP server. Doing that while I'm replacing the windshield of my monster truck 😉

[Thiago Moreira @tmoreira2020]

Reactivating my X account this week. The goal is to post frequently showing my journey to make @37audits a profitable business in the next 4 months.

[Thiago Moreira @tmoreira2020]

MCP of @37audits is ready and live. Documentation can be found here https://t.co/3tW59z03ur

[37 Audits @37audits]

Hello auditors!