It has a very basic security audit built in, hoping to expand it at some point. If you look at the docs it explains it more about what its actually doing but here's a shortlist:

- HTTPS and certificates - Security headers - Cookie flags - Mixed content - Exposed files - Email spoofing (SPF/DMARC) - security.txt