Browser tools

These tools run in your browser. Nothing you enter is uploaded or saved by the site. Use aliases, never credentials. Export your record before leaving this tab.

Version check LiteLLM evidence Key rotation Export handoff Offline scripts

Browser tools require JavaScript. The playbooks, offline kit and individual scripts remain free to download.

Check a supplied version

Answers “below this published fix floor?” It does not scan a server or declare it clean.

Your result will appear here.

Try PHP 8.3.35 to see the difference between a version match and proof of a running fix.

Record LiteLLM evidence

Do not start Python or pip in a potentially affected environment just to fill this in.

Start with what you actually know.

A current pin does not tell you what ran yesterday. The result will preserve that distinction.

Build a credential-rotation register

For Railway, TiDB Cloud or other incident work. Record aliases and providers, never keys or passwords.

Suspected active misuse: prioritize issuer-side revocation and containment with the authorized operator. The normal replacement sequence must not delay urgent revocation. TiDB procedure · Railway procedure

No credentials recorded. Add one alias to start.

Checkboxes record your work; the site cannot verify revocation or test your integration. Keep provider receipts privately.

Export the handoff

Add version/evidence results, finish the rotation rows, then download a Markdown record for your technical owner.

No asset checks saved yet. Use “Add to handoff” on a result.

Your local response record

Nothing persists after this tab reloads. Save the file privately; it contains the aliases and observations you entered.

Use the offline scripts

Inspect the downloaded source first. Run the Node tools on a trusted machine. For suspected compromised environments, analyze a read-only copy; do not run the affected application to collect evidence.

Inspect dependency declarations

Download inspect-dependency-files.mjs. Supply only selected text files; the tool does not search your machine. Inputs are capped at 2 MiB per file. Output uses input numbers and sanitized matches, not file contents.

node inspect-dependency-files.mjs --json -- requirements.txt uv.lock Dockerfile

The parser covers common declaration forms, not every TOML/YAML feature. REVIEW is a static match, never proof of installation or execution. UNKNOWN means the file or syntax could not be assessed. Exit 0 means processing completed; exit 2 includes rejected or unassessed inputs.

Inspect installed metadata without Python

Download inspect-litellm-metadata.sh. Pass a physical path to an offline copy’s site-packages directory. It checks immediate entries only and rejects symlink paths.

bash inspect-litellm-metadata.sh /physical/path/to/site-packages

Generic filenames need review. Missing markers do not clear historical exposure. Neither Python nor pip is invoked.

Compare a PHP version locally

Download check-php-version.mjs. This compares the string you supply; it does not discover your production runtime.

node check-php-version.mjs 8.3.35

For spreadsheet workflows, use the asset inventory, credential register and migration acceptance sheet.