NetSweep is a personal security watchtower for iPhone and iPad. Pin the sites you care about — your bank, your email, your domain — and the app silently re-checks their TLS chain, security headers, DNS, and CVE exposure. Local alerts fire before anything breaks. Nothing leaves your device but a normal browser-style request to the hosts you pinned.
The internet runs on certificates that quietly age out. Headers get weakened. CVEs land. DNS gets repointed. NetSweep watches the surfaces you care about and surfaces only what changed — so you don't have to remember to check.
TLS chain, OCSP revocation, DNS records, HTTP→HTTPS redirect, six security headers, HSTS preload eligibility, Certificate Transparency log entries, and matching CVEs — one polished report per host.
iOS wakes NetSweep periodically to re-probe every pinned host. Cert renewed? Expiring soon? Fingerprint changed? Headers weakened? You get a local notification — no backend, no account.
Open the app and only the deltas surface: cert renewed, fingerprint rotation, expiring in 7 days, 3 new CVE matches. A morning brief for the digital infrastructure you trust.
Your device at the center, every pinned site orbiting around it — tinted by health, draggable, pinch to zoom. The constellation pulses softly and recolors when something needs your attention.
Tag your sites (Work, Personal, Family) and filter the meta-view. Stat tiles tap to drill in — see only the broken, only the expiring, only the watched.
Export your pinned sites as a tidy JSON file. Restore on a new device, share a starter list with a coworker, or just keep a backup. Tags ride along.
Every inspection runs the full battery and writes the result. The Watchtower repeats it on its own schedule and tells you only what changed.
Negotiated protocol version, full certificate chain, leaf expiry countdown, handshake time. Old TLS or weak chains flagged.
Asks the issuing CA whether the cert has been retracted. A revoked cert is a stronger signal than an expired one.
A / AAAA resolution with primary address tracking — a silent re-point gets surfaced as a "primary DNS address changed" alert.
Confirms plain-http traffic gets redirected to https. A missing redirect is a real-world security finding for non-HSTS sites.
HSTS, CSP, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy — scored 0–100 with a present-count badge.
Checks max-age, includeSubDomains, and the preload directive against the hstspreload.org criteria so you can apply with confidence.
Pulls recent CT log entries from the public crt.sh API. Surfaces unexpected issuers, sister certs, or unknown subdomains.
Auto-searches NIST's public NVD catalog by apex domain. Read-only links to the public records — never any exploit detail.
A simple, repeatable loop. Add a site, the app does the rest.
Type or share a URL into NetSweep. The Inspector runs the full battery and you get a polished report. Tap "Watch" to add it to the watchtower.
A background app refresh task re-runs every watched site every ~12 hours, capped to four concurrent probes so your battery doesn't notice.
The "What's New" panel surfaces every change at a glance. Local notifications fire 30 / 14 / 7 / 1 days before a cert expires.
No filler. Every tool serves the watchtower mission.
No accounts. No analytics. No ads. Your watchlist never leaves your device. Outbound requests are the same ones a normal browser makes to the hosts you pinned — plus three optional public lookups (public IP, NVD, crt.sh) that send your query, never your data.
No. NetSweep never scans any device on your LAN. It does not request the iOS Local Network permission and does not declare any Bonjour service types. It only inspects the public hosts you choose to pin.
No. NetSweep has no accounts and no servers. Your watchlist, every inspection result, and every detected change are stored in SwiftData on your device only.
NetSweep schedules local notifications on your device 30, 14, 7, and 1 days before a watched certificate stops being valid. They are computed from data already on your device and delivered by iOS's UserNotifications framework — no remote push service is involved. Tap the alert and the Inspector opens pre-loaded with the affected host.
Each inspection runs the full battery: TLS handshake (chain + protocol), OCSP revocation, DNS A/AAAA, HTTP-to-HTTPS redirect, six HTTP security headers (HSTS, CSP, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy), HSTS preload eligibility, Certificate Transparency log lookup, and a CVE search against NIST's NVD by apex domain.
Yes. There are no in-app purchases, no subscriptions, and no ads. NetSweep is a portfolio piece — built to be a useful, polished tool people actually keep on their phone.
NetSweep is a showcase of full-stack iOS craft: a custom SwiftUI spatial canvas with UIKit-backed gestures, a concurrent on-device security probe engine (TLS handshake capture, OCSP via SecTrust, raw NWConnection HTTP probe, CT log lookup, NVD search), SwiftData persistence with delta detection, BGAppRefreshTask background watching, App Intents for Siri integration, and Apple-grade accessibility from Dynamic Type to Reduce Motion.
Free. No accounts, no ads, no tracking. Pin a few sites and NetSweep takes it from there — you only hear from it when something changes.
Requires iOS 18 or later.