slopticweb app slop checkersign in / up

How much slop is in your app?

Paste a link and Sloptic will score the slop in your app across security, quality, accessibility and performance, then show you how to fix it. Lower is better.

Built with Lovable, Bolt or Cursor? See what AI-built apps miss.
Running a hackathon? Rank a whole event.

What is Sloptic?

Sloptic is a web app grader. It checks how much slop your web app has in four areas: security, quality, accessibility and performance. Slop is anything no app should ship with, like a leaked secret, a dead button, a control a screen reader can't use, or a page that takes forever to load. So Sloptic can grade any app you point it at, no matter what it does.

Each failure comes with how to fix it, a prompt for your AI assistant, and a link to the tool that goes deeper. Sloptic also compares your score against other apps it has graded.

Sloptic shows you your app from the seats you never sit in.

  1. 01

    Paste a link to your app. No setup needed.

  2. 02

    Sloptic opens it in a browser and checks what any visitor sees.

  3. 03

    You get a score, what failed, how to fix it, and a prompt to paste into your AI assistant.

What it checks

every check

Open an area to see what kinds of slop Sloptic checks for.

Insecure apps are a goldmine for attackers to steal your users' data or your own. To ensure security, Sloptic checks for missing defenses, bad access control, secrets leakage, and more, adhering to the OWASP Top 10 and ASVS.

See all 30 in this area.


Note that in anonymous mode, we only run the passive checks, i.e. checks that do not alter the site or send attacks. To run the active ones, log in and prove the site is yours.

What you get back

sample
https://your-app.vercel.apppassive mode
48.5slop score
cleaner than 36%of passively graded apps
security3/16/17
quality1/13/13
accessibility1/3/3Checked the way a low vision or screen reader user meets your app, not the way it looks to you. Why?
performance1/11/12Measured as a mid range phone on slow 4G, not your laptop. Why?

failed passed did not applyfailed / applied / available. 43 of 45 applied.

no content security policyNothing tells the browser which scripts may run, so an injected one would.+8
How to fix it

Send a Content-Security-Policy header that lists where your scripts, styles and frames may load from. Most hosts set headers in a config file, such as vercel.json.

Go deeper: HTTP Observatory checks an app's headers in detail.

For Cursor, Lovable, Bolt, or any AI assistant.
no x-content-type-optionsA browser may guess a file's type, and guess it into something executable.+1.8
no referrer-policyEvery outbound click can leak the page it came from, query string included.+0.7
http conformanceA response says one thing in its status line and another in its body.+10
accessibility violationsSome text is too faint to read and some controls have no name a screen reader can say.+20
largest contentful paintThe biggest thing on screen arrives late, so the page looks empty for a while.+8
strict transport securityThe app tells browsers to reach it over https and nothing else.0
no broken linksEvery link the page offers leads somewhere that answers.0

sloptic /ˈslɒp.tɪk/ noun

A coinage from slop, Merriam-Webster's word of the year for 2025 for the throwaway output that generative AI now produces in bulk, and optic, an instrument for bringing something into focus. The apparatus by which slop of the software kind, the app that ships functional but unhardened, is resolved into a single comparable score, serenely indifferent to whatever it was meant to be.