A private, offline workbench for completing DISA STIG checklists.
STIG Craft is a workbench for completing DISA Security Technical Implementation Guide (STIG) checklists. It imports the results your scanners already produced, lets you answer the remaining checks once and apply the answer to every host it fits, and builds CKL, CKLB and eMASS-ready files, including a POA&M.
Everything you create or import stays on your device. STIG Craft runs in your browser as an installable app and works offline. It has no accounts, no analytics and no server that receives your data. The only things it downloads from stigcraft.com are the app itself and public STIG reference data. Your checklists, host names, findings and files are stored in your browser's storage on this computer, and you keep your own backups as STIG Craft Archive Packs.
You can verify this: the site's security policy blocks connections to any other address and blocks uploads to this one, and the app shows a live record of every network request it makes.
What the server can see: like any website, stigcraft.com's content delivery network sees that an IP address loaded the site and which public STIG files it downloaded. It never receives your checklists, hosts, findings, files or search text. Access logging is turned off.
connect-src 'self': the browser refuses connections to any other address.STIG Craft is being built. The app opens here when it is released.