How Logicwind uses FlawPilot to audit ContactBook
ContactBook and FlawPilot are both built by Logicwind. ContactBook keeps teams' shared contacts in one place. FlawPilot is our free scanner for website security, performance, infrastructure, and SEO, and ContactBook was our first internal use case.
This post explains how we use FlawPilot on ContactBook: an outside-in scan of the public website, and a Code Scan of the application repository. It is an internal product story, not an independent customer review. We don't publish scores, findings, or repository details for our own product, and we haven't invented any numbers.
Why ContactBook gets audited
ContactBook is a cross-platform contact manager. It runs on the web, on iOS and Android, and as a Chrome extension, and teams share contacts the way they share files in Google Drive. People trust it with names, numbers, and email addresses, so the site and the app behind it need to be fast, findable, and safe.
Those checks rarely belong to one person. Marketing owns page titles and internal links. Developers own performance and code fixes. Whoever manages DNS and hosting owns certificates and edge settings. An audit is only useful if each finding reaches the right owner.
Two views of the same product
The outside-in view: a live-site scan. FlawPilot scans a public URL using only publicly accessible signals, with no login and no credentials. We use it on contactbook.app across four areas:
- Security: HTTP security headers, TLS/SSL configuration, CSP and CORS rules, and email authentication (SPF, DKIM, DMARC)
- Performance: Core Web Vitals (LCP, INP, CLS), page weight, render-blocking assets, and caching
- Infrastructure: CDN and WAF coverage, DNS record health, exposed services and ports, and subdomain hygiene
- SEO: titles, meta descriptions, headings, canonicals, robots and sitemap, structured data, and crawlability
The inside-out view: Code Scan. For an approved, scan-ready ContactBook repository, Code Scan runs four independent dimensions:
- Code security (SAST): injection, XSS, hardcoded credentials, weak cryptography, path traversal, and unsafe deserialization
- Exposed secrets: API keys, tokens, passwords, and private keys, checked across the full Git history and not just current files
- Vulnerable dependencies (SCA): known CVEs in direct and transitive packages, the version that fixes each one, and a downloadable CycloneDX SBOM
- Code quality: complexity, duplication, dead code, and lint violations, scored separately from security
The website and the application are different surfaces, so each needs its own scan. The live scan looks at what visitors and crawlers can see. Code Scan looks at what's in the repository.
Why we run both
A clean repository doesn't guarantee a safe deployment. A missing response header, a weak TLS setting, or a stale DNS record lives in production, not in the code. Only the live scan sees it.
A healthy live site can hide problems in the code. A public scan can't see a credential committed months ago or a vulnerable package deep in the dependency tree. Code Scan can, and because each dimension is scored on its own, a clean dependency result can't mask a hardcoded secret.
Deleting a secret isn't fixing it. If a real credential turns up in Git history, the response is to rotate it, check where it was used, and then clean up history. Removing the file isn't enough.
Our review loop
A scan only helps when someone owns the next step. This is the loop we follow:
- Run the relevant scan.
- Confirm the finding applies to ContactBook, since scanners can flag safe or unreachable code.
- Rank it by severity and effort, and assign it to marketing, development, or infrastructure.
- Fix and test it in the right environment.
- Rescan to confirm the finding has cleared, and record any accepted risk.
Sorting findings by owner turned out to matter as much as finding them. SEO and metadata items don't need to wait in a developer queue when marketing can fix them, and DNS or header changes shouldn't sit with someone who lacks access.
What FlawPilot doesn't replace
FlawPilot is a diagnostic and prioritization layer, not a full security program. It doesn't replace:
- Google Search Console and analytics
- Real-user performance monitoring
- Code review and automated tests
- Manual penetration testing for business logic and authenticated flows (FlawPilot offers manual pentests as a separate service)
- Developer judgment on every finding
Also, a live scan reads public signals only, and Code Scan runs when you start it. It isn't triggered automatically on every push.
Run the same audit on your site
The outside-in scan is free and takes a few minutes. Choose the areas you want, enter your URL, and get a prioritized fix list. No account, credentials, or source-code access is needed. A free account unlocks the full check set and keeps your scan history.
Run a free website audit with FlawPilot
To add repository checks, connect your GitHub, GitLab, or Bitbucket repo, assign a project and branch, and pick the Code Scan dimensions you want. Have a qualified team member verify serious findings before changing production.
Frequently asked questions
Are ContactBook and FlawPilot from the same company?
Yes. Both are built by Logicwind. This article describes how our team uses FlawPilot on ContactBook.
Does FlawPilot scan the website, the code, or both?
Both, as two separate scans. The live-site scan reads publicly visible signals. Code Scan analyzes a connected repository.
Is SAST the same as Code Scan?
No. SAST is one of four Code Scan dimensions, alongside exposed secrets, vulnerable dependencies, and code quality.
Does a clean scan prove a site is secure?
No. A scan reflects the checks run and the signals available at that moment. Authenticated flows, business logic, and private infrastructure need other kinds of testing.
Can marketing teams use the findings?
Yes. Titles, meta descriptions, canonicals, internal links, and some asset issues can often be fixed by marketing. Code, DNS, hosting, and security configuration should go to the technical owner.
Why rescan after a fix?
A rescan shows the scanner no longer detects the original issue. It doesn't replace functional testing, but it verifies the fix instead of assuming it.
Final thoughts
Auditing ContactBook with FlawPilot connects work that usually stays in separate lanes: SEO, performance, infrastructure, security, and code health. The value isn't a one-time score. It's a repeatable cycle of finding, assigning, fixing, and verifying, which matters because sites and codebases change with every release.
Want the same outside-in view of your site? Check your website with FlawPilot for free.
.png)
.svg)
.svg)
