Hey Product Hunt! 👋I’m Michael, Investigating a production request path today usually means opening three different terminal tabs to stitch together dig, openssl s_client, and curl -v commands—then trying to manually paste the output into an engineering ticket or compliance notes. It’s tedious, highly repetitive, and hard to reproduce consistently. I built RequestTrace to fix this manual workflow. It’s a 100% open-source DevSecOps CLI that takes any production domain and turns the externally visible request path (DNS ➔ TCP ➔ TLS ➔ HTTP ➔ Security Headers & Cookies) into an evidence-backed, remediation-ready security assessment. 🛠️ What makes RequestTrace unique:The Evidence Model: It refuses to just say HSTS: FAIL. Every single finding cites a stable, unique evidence ID linked directly to raw, sanitized network observations. - CI/CD Native: It features deterministic exit codes and a --fail-on policy flag, making it incredibly easy to break a pipeline if a deployment strips away a critical security header or misconfigures TLS. - Privacy-First: Sensitive values (like cookies, authorization tokens, and response bodies) are strictly redacted or never parsed into evidence at all before reaching a report. - Unified Reporting: It renders Markdown, HTML, PDF, and schema-versioned JSON from a single, canonical view model so your data stays perfectly consistent across tools. RequestTrace is entirely open-source (MIT licensed) and written in Python 3.10+. You can try it instantly via Docker without installing local dependencies:👉 GitHub: https://github.com/micheaol/requ... I’d love to get the community's feedback! What edge scanners or configuration rules should we prioritize next? I’ll be hanging out here all day to answer your technical questions. Thank you so much for the support! 🚀

RequestTrace

Automated HTTP/TLS audits.

Automated HTTP/TLS audits.