Auditor catalogue
Every auditor in openaudit's registry, generated when the site is built: 32 built in, 48 that wrap an external tool, and 11 agentic. 28 are opt-in and run only when you select them with --only.
- AgentAccessibility journeys (keyboard & screen reader)
agent.a11y-journeysWalks key user journeys keyboard-only and through the accessibility tree to find what automated checkers like axe cannot: focus management, dialogs, errors, live regions, reflow, zoom and motion. (agentic, uses Claude)Opt-in - AgentAuthentication & authorization review
agent.authzInventories every route and handler, then checks who can reach it and whose data it touches: missing auth, IDOR, tenant isolation, privilege escalation, sessions/JWT, password reset and rate limiting. (agentic, uses Claude)Opt-in - Agentdeepsec AI vulnerability scan
agent.deepsecVercel Labs deepsec: regex candidate scan followed by an AI agent review of the riskiest files (or of changed files with settings diff). Opt-in: run with --only agent.deepsec. Costs real money (default cap about $5, enforced between chunks) and the review agent gets a sandboxed shell in the target, so only run it on code you trust. State goes to a temp directory, not the target.Opt-indeepsec - AgentInfrastructure architecture review
agent.iac-architectureReviews infrastructure-as-code and container definitions as a system: blast radius, least privilege, network segmentation, backup/DR, secrets management and supply chain of images and CI actions. (agentic, uses Claude)Opt-in - AgentInjection & data-flow review
agent.injectionTraces untrusted input from sources to dangerous sinks (SQL/NoSQL, shell, outbound HTTP, HTML, filesystem, templates, deserializers) and reports only reachable, unsanitised paths. (agentic, uses Claude)Opt-in - AgentMobile app security review (MASVS)
agent.mobileOWASP MASVS-oriented review of mobile source or decompiled output: token storage, network security and pinning, deep links, WebViews and JS bridges, logging, platform permissions. (agentic, uses Claude)Opt-in - AgentPerformance review
agent.performanceFinds performance problems that need understanding of hot paths: N+1 queries, missing indexes, unbounded queries, blocking work, missing caching, heavy client bundles, leaks and render waterfalls. (agentic, uses Claude)Opt-in - AgentPrivacy & data-protection review
agent.privacyBuilds a personal-data inventory and traces its flows — storage, logging, third parties, consent, retention and deletion — against GDPR/CCPA expectations. (agentic, uses Claude)Opt-in - AgentSecrets & configuration review
agent.secrets-configReviews how secrets and configuration actually flow — logs, debug modes, env handling, client bundles, CI pipelines, container images and IAM — beyond what regex secret scanners catch. (agentic, uses Claude)Opt-in - AgentUX, content & SEO quality review
agent.ux-contentJudges what metrics cannot: content quality and search intent, Nielsen usability heuristics, broken or confusing journeys, unclear copy and mobile layout problems. (agentic, uses Claude)Opt-in - AgentWeb app security (authenticated flows)
agent.webapp-securityExercises a running app the user is authorised to test, with the provided test account(s): session handling, logout, CSRF, cookie flags, cross-account access, error leakage and login rate limiting. (agentic, uses Claude)Opt-in - Wrapped scannerProwler cloud security posture
cloud.prowlerRuns Prowler (v4+) against a live cloud account or cluster (target cloud:aws, cloud:azure, cloud:gcp, cloud:kubernetes) and reports its FAIL checks with compliance-framework tags (cis-…, soc2, …). Credentials come from your ambient environment (AWS_PROFILE/AWS_*, az login, GOOGLE_APPLICATION_CREDENTIALS, KUBECONFIG) and are never read or reported. Only read/list API calls are made, but a full scan can take many minutes and many API calls, so it is opt-in. Optional settings["cloud.prowler"]: profile (aws), regions (aws), checks, services, compliance (e.g. cis_2.0_aws), azureAuth (cli | sp-env | managed-identity), projectIds (gcp), context (kubernetes); each is validated against a strict pattern.Opt-inprowler - Built-inAccessibility (static)
code.accessibilityStatic WCAG checks over JSX/TSX, Vue, Svelte, HTML templates and CSS: alt text, labels, keyboard access, focus visibility, document language and zoom. - Built-inAPI definition and server configuration
code.apiChecks OpenAPI/Swagger files (missing or weak authentication, HTTP servers, secrets in query strings, unbounded lists, mass assignment) and heuristically flags risky GraphQL server settings and unthrottled Express login routes. Tagged with OWASP API Security Top 10 (2023) ids. - Wrapped scannerBandit Python SAST
code.banditRuns Bandit over Python sources (static analysis only, the code is never imported or executed). Skipped when the workspace has no .py files.bandit - Wrapped scannerBiome lint
code.biomeRuns `biome lint` when the project has a biome.json(c). Biome configuration is data (GritQL plugins are not JavaScript), the config is loaded explicitly from the target root, and the tool runs from a temp directory.biome - Wrapped scannerBrakeman Rails SAST
code.brakemanRuns Brakeman statically over a Ruby on Rails app (the app is never booted). Skipped unless the Gemfile mentions rails or config/application.rb exists.brakeman - Wrapped scannerbun audit
code.bun-auditRuns `bun audit --json` per lockfile (bun.lock). Runs on a temporary copy of the lockfile and package.json, so nothing is installed, no script runs and the project's .npmrc/bunfig/workspace config is never read. The registry is pinned to registry.npmjs.org; private registries are therefore not audited.bun - Wrapped scannercargo-audit (Rust advisories)
code.cargo-auditChecks Cargo.lock against the RustSec advisory database with cargo-audit. Reads the lockfile only; nothing is compiled or fetched from the project.cargo-audit - Wrapped scannerRust clippy lints
code.clippyRuns `cargo clippy` over Rust crates and workspaces. NOT safe on untrusted code: clippy compiles the crate, so it runs build.rs scripts, proc-macros and any .cargo/config.toml hooks of the target, which is why it is opt-in. Runs with --locked --offline (needs a committed Cargo.lock and already vendored or cached dependencies; nothing is downloaded) and a throwaway target dir. clippy::correctness findings are high, suspicious medium, perf and complexity low, style info; compile errors are reported with low confidence.Opt-incargo - Built-inVulnerable dependencies
code.dependenciesParses lockfiles and manifests (npm, bun, pnpm, yarn, pip, poetry, Go, Cargo, Bundler, Composer), checks every pinned version against OSV.dev, and flags wildcard and URL dependencies. - Wrapped scannerESLint
code.eslintRuns the project's own ESLint with its own flat config. WARNING: eslint.config.* is JavaScript that runs on load, together with every plugin it imports, so this executes code from the audited project. Opt-in only (--only code.eslint); use on code you trust.Opt-ineslint - Wrapped scannergitleaks secret scan
code.gitleaksRuns gitleaks over the working tree (no git history) to detect hardcoded secrets.gitleaks - Wrapped scannergolangci-lint
code.golangci-lintRuns golangci-lint with the project's own .golangci config over each Go module. NOT safe on untrusted code: the config can load Go plugins (.so files and module plugins) that run inside the linter, which is why it is opt-in. Like the other Go wrappers it disables cgo and toolchain downloads and never builds or runs the target. gosec findings are security, bug-class linters (govet, errcheck, staticcheck, ...) reliability, the rest maintainability.Opt-ingolangci-lint - Wrapped scannergosec Go SAST
code.gosecRuns gosec over each Go module (go.mod). gosec type-checks packages through the Go toolchain (`go list`), which may download missing modules but never compiles or runs the target's code. Skipped when there is no go.mod.gosec - Wrapped scannergovulncheck (Go vulnerabilities)
code.govulncheckRuns govulncheck over each Go module. Findings whose vulnerable function is actually called are high-confidence; imported-but-not-called ones are low-confidence and one severity lower. govulncheck loads packages with the Go toolchain (no code is executed, cgo is disabled, toolchain downloads are blocked), so it is opt-in.Opt-ingovulncheck - Wrapped scannergrype vulnerability scan
code.grypeScans the directory with Anchore grype (builds an SBOM with syft, matches against the grype database). Overlaps osv-scanner and trivy, so it is opt-in. Runs from a scratch directory so project-level grype config is ignored; the vulnerability database is downloaded on first use.Opt-ingrype - Built-inRepository hygiene
code.hygieneChecks for README, LICENSE, SECURITY.md, .gitignore coverage of secrets, lockfiles and CI configuration. - Wrapped scannerjscpd copy-paste detection
code.jscpdRuns jscpd to find copy-pasted blocks of 10+ lines across the codebase. Read-only: writes its report to a temp directory.jscpd - Wrapped scannerknip unused code scan
code.knipFinds unused files, exports and dependencies in JS/TS projects with knip. Runs the project's JS/TS config files and plugin configs, which executes target code: enable only for trusted code. Skipped without package.json or node_modules.Opt-inknip - Wrapped scannermobsfscan mobile SAST
code.mobsfscanRuns mobsfscan (OWASP MASVS-oriented Semgrep rules bundled with the tool, no registry download) over Android (Java/Kotlin, manifests) and iOS (Swift/Objective-C) source. Only runs when mobile source is detected. Honors the project's .mobsf ignore rules (YAML data).mobsfscan - Wrapped scannermypy type check
code.mypyRuns mypy over Python sources with the project's own mypy configuration. NOT safe on untrusted code: mypy.ini, setup.cfg and pyproject.toml can list `plugins` that mypy imports and executes, which is why it is opt-in. mypy uses a throwaway cache dir and never installs stub packages. Imports that cannot be resolved because the project's dependencies are not installed are reported with low confidence.Opt-inmypy - Wrapped scannernpm audit
code.npm-auditRuns `npm audit --json --package-lock-only` per lockfile (package-lock.json, npm-shrinkwrap.json). Runs on a temporary copy of the lockfile and package.json, so nothing is installed, no script runs and the project's .npmrc/bunfig/workspace config is never read. The registry is pinned to registry.npmjs.org; private registries are therefore not audited.npm - Wrapped scannerosv-scanner dependency scan
code.osv-scannerRuns Google's osv-scanner recursively over lockfiles and SBOMs to find known-vulnerable dependencies.osv-scanner - Wrapped scanneroxlint
code.oxlintRuns oxlint, a fast Rust linter for JavaScript and TypeScript. Uses a sanitized copy of the project's .oxlintrc.json (rules, categories, plugins only): `jsPlugins` are removed because they would load project JavaScript, and JS config files are never read.oxlint - Built-inPerformance (static)
code.performanceFlags large committed images/videos/fonts, legacy asset formats, heavy dependencies, whole-library imports, synchronous I/O in server handlers and leftover console logging. - Wrapped scannerpip-audit (Python vulnerabilities)
code.pip-auditAudits exactly pinned Python requirements (requirements*.txt, poetry.lock, Pipfile.lock) with pip-audit. Pins are rewritten into a temporary name==version file and audited with --no-deps --disable-pip, so nothing is resolved, downloaded or installed and no build script runs. Files that are not fully pinned are skipped.pip-audit - Wrapped scannerpnpm audit
code.pnpm-auditRuns `pnpm audit --json --config.ignore-pnpmfile=true --config.manage-package-manager-versions=false` per lockfile (pnpm-lock.yaml). Runs on a temporary copy of the lockfile and package.json, so nothing is installed, no script runs and the project's .npmrc/bunfig/workspace config is never read. The registry is pinned to registry.npmjs.org; private registries are therefore not audited.pnpm - Built-inPrivacy (code)
code.privacyInventories analytics, advertising, attribution, session-replay, fingerprinting and error-tracking SDKs from manifests, lockfiles and markup; flags personal data in log calls, session replay configured without masking, Google Fonts loaded from Google, and hard-coded tracking IDs. - Built-inCode quality
code.qualityMaintainability heuristics: oversized files, deep nesting, TODO/FIXME debt, TypeScript strictness flags and escape hatches (@ts-ignore, @ts-nocheck), CI that never type-checks or lints, missing tests and Node engines. - Wrapped scannerRuff Python lints
code.ruffRuns Ruff over Python sources. Ruff is a standalone Rust binary that parses code and reads pyproject.toml/ruff.toml as plain data; it never imports or executes the target and has no plugin mechanism. When the project has its own ruff configuration it is honoured; otherwise ruff runs with --isolated (no config discovered from parent directories) and the rule set E4,E7,E9,F,B,PLE,S (pycodestyle errors, pyflakes, bugbear, pylint errors, bandit-like security rules; S rules are skipped in tests/).ruff - Wrapped scannerScanCode licence scan
code.scancodeRuns ScanCode Toolkit to detect file-level licences and flags strong and weak copyleft code, and code that conflicts with the declared project licence. Slow on large trees: opt-in.Opt-inscancode - Wrapped scannerOpenSSF Scorecard
code.scorecardRuns OpenSSF Scorecard against the GitHub repository named by the workspace's origin remote and reports checks that scored 0-9, with severity from each check's documented risk scaled by score. Needs GITHUB_AUTH_TOKEN or GITHUB_TOKEN; it calls the GitHub API about the remote repository, not the local files.scorecard - Built-inSecrets in source
code.secretsDetects committed credentials (cloud keys, tokens, private keys, connection strings, high-entropy passwords) and tracked .env files. - Wrapped scannergitleaks git-history secret scan
code.secrets-historyScans the full git history (all refs, newest settings["code.secrets-history"].maxCommits, default 5000) with gitleaks for secrets that were committed and later removed. The repository is first copied into a bare mirror in a temp dir and scanned there with git config, hooks, attributes and textconv/fsmonitor drivers neutralised, so a hostile .git/config cannot execute code. Repositories whose git data reaches outside the target (an outside gitfile or commondir, alternates, symlinks in .git) are refused; replace refs, grafts and hidden refs cannot hide commits, and shallow or truncated history is reported as incomplete. The target's own .gitleaks.toml, .gitleaksignore and inline gitleaks:allow comments are deliberately ignored (a repository must not be able to allow-list its own leaks); gitleaks' built-in rules apply. Slow on large histories, so opt-in.Opt-ingitleaks - Built-inStatic security analysis
code.securityHeuristic SAST for JS/TS, Python, Go, PHP, Ruby, Java and C#: injection, XSS, weak crypto, disabled TLS/JWT verification, permissive CORS, insecure deserialization, open redirects and path traversal. - Wrapped scannerSemgrep SAST
code.semgrepRuns Semgrep with the community `auto` ruleset (downloads rules from the Semgrep registry).semgrep - Wrapped scannerShellCheck
code.shellcheckRuns ShellCheck over *.sh/*.bash/*.ksh files and extensionless files with a sh/bash shebang. ShellCheck only parses scripts; it never executes them. It runs with --norc so a repository's .shellcheckrc (source-path, external-sources, enable=...) cannot change what is read or checked, and from a temp directory with absolute file paths. Errors are medium, warnings low, info/style info; quoting hazards (SC2086, SC2046, SC2115, ...) are reported as security.shellcheck - Wrapped scannerSpectral API linting
code.spectralLints OpenAPI, Swagger and AsyncAPI documents with Spectral's built-in oas and asyncapi rulesets. Project .spectral.* rulesets are ignored because they can run custom JavaScript. Documents with remote or out-of-project $refs are not linted, since Spectral would fetch them.spectral - Wrapped scannerstaticcheck Go lints
code.staticcheckRuns staticcheck over each Go module (go.mod). staticcheck type-checks packages through the Go toolchain, which may download missing modules but never compiles to binaries, runs go:generate or executes the target's code (cgo is disabled and toolchain downloads are blocked). SA checks are medium (likely bugs), S simplifications low, ST style info.staticcheck - Built-inLanguage strictness config
code.strictnessChecks that Rust, Python, Go and shell projects configure their compilers, linters and type checkers strictly: Cargo [lints], unsafe_code and overflow-checks; a Python type checker (mypy strict, pyright mode) and linter; golangci-lint config and //nolint density; and `set -euo pipefail` in shell scripts. Reads configuration files only; nothing is executed. These are hygiene checks, so severities are info/low and the shell check is low-confidence. TypeScript strictness is covered elsewhere. - Wrapped scannersyft licence policy
code.syft-licensesBuilds an SBOM with syft and flags copyleft licences: strong (AGPL, GPL, SSPL, EUPL, OSL) as medium, weak (LGPL, MPL, EPL, CDDL) as low, and one aggregated info finding for packages with no licence. Set settings["code.syft-licenses"].sbomOut to also write the CycloneDX SBOM to that path. Policy relevance depends on how the project is distributed, so it is opt-in.Opt-insyft - Wrapped scannerTrivy filesystem scan
code.trivy-fsRuns `trivy fs` for vulnerable dependencies, secrets and IaC misconfigurations.trivy - Wrapped scannertrufflehog secret scan
code.trufflehogRuns trufflehog over the working tree for hardcoded secrets. Credentials are NOT verified by default (--no-verification), so nothing leaves the machine; set settings["code.trufflehog"].verify = true to let trufflehog send each found secret to its provider's API to confirm it is live (verified secrets are reported as critical).trufflehog - Wrapped scannerTypeScript type-check (tsc)
code.typecheckRuns the TypeScript compiler bundled with openaudit (never the target's own) with --noEmit on each project tsconfig.json and reports type errors. tsc does not execute project code; tsconfig `plugins` are only loaded by tsserver. Skipped when dependencies are not installed, because every import would fail.tsc - Built-inDocker Compose security
container.composeChecks compose files for privileged services, host namespaces, Docker socket mounts, dangerous capabilities, plaintext secrets, exposed database ports, mutable image tags and missing restart/healthcheck. - Built-inDockerfile security & best practices
container.dockerfileChecks Dockerfiles for mutable base images, root users, secrets in ENV/ARG, remote ADD, curl-pipe-sh, package-cache hygiene, missing HEALTHCHECK and unsafe COPY of the build context. - Wrapped scannerDockle
container.dockleRuns Dockle on an image (image:<ref>): CIS Docker Benchmark checks on image config and contents (root user, secrets in ENV or files, setuid files, ADD, latest tag). Dockle pulls the image from its registry when it is not available locally.Opt-indockle - Wrapped scannerHadolint
container.hadolintRuns hadolint on Dockerfiles: Dockerfile best practices plus ShellCheck on RUN instructions.hadolint - Wrapped scannerContainer image scan
container.imageScans an image (image:<ref>) for vulnerable packages and secrets with Trivy, and checks its config (user, ports, env secrets, age, size); falls back to `docker image inspect` without Trivy.trivy - Wrapped scanneractionlint
iac.actionlintRuns actionlint over GitHub Actions workflows: syntax, expression types, action inputs, script injection, credentials, and (when installed) ShellCheck and pyflakes on run scripts. Read-only; nothing is executed from the target.actionlint - Wrapped scannerCheckov
iac.checkovRuns Checkov's policy library over Terraform, Kubernetes, CloudFormation, Helm, Dockerfiles and CI configs.checkov - Built-inGitHub Actions workflows
iac.github-actionsChecks workflows for unpinned actions, over-broad token permissions, pwn requests, script injection, leaked secrets and unsafe runners. - Wrapped scannerKICS
iac.kicsRuns KICS over Terraform, Dockerfiles, Kubernetes, CloudFormation, Ansible, Bicep and Compose files. Secrets scanning is disabled (use the secret scanners); KICS 2.x scans entirely offline. Results go to a temporary directory, never the target.Opt-inkics - Wrapped scannerkube-linter
iac.kube-linterRuns kube-linter over plain Kubernetes manifests: privileged and root containers, host namespaces, missing resource limits and probes, mutable image tags, RBAC wildcards. Helm templates are skipped.kube-linter - Built-inKubernetes manifests
iac.kubernetesChecks workloads for privileged/root containers, host namespaces, hostPath, missing limits and probes, mutable images, plaintext secrets, exposed Services and RBAC wildcards. - Wrapped scannerKubescape
iac.kubescapeRuns Kubescape over plain Kubernetes manifests (NSA, MITRE and CIS style controls). Kubescape downloads its control library from GitHub on each run. The scan passes --keep-local, so results are never submitted to the Kubescape cloud backend, even when an account is configured on this machine.Opt-inkubescape - Built-inTerraform configuration
iac.terraformFlags public S3/GCS/Azure storage, open security groups, unencrypted storage, public databases, wildcard IAM, hardcoded credentials, disabled logging and committed state files. - Wrapped scannerzizmor
iac.zizmorRuns zizmor over GitHub Actions workflows and composite actions: template injection, dangerous triggers, excessive permissions, credential persistence, unpinned actions. Runs offline (static audits only); when GH_TOKEN or GITHUB_TOKEN is set it also runs zizmor's online audits, which query the GitHub API for the actions referenced.zizmor - Built-inMobile accessibility
mobile.accessibilityChecks Android layouts (compiled or source) for images without content descriptions, touch targets under 48dp, text sizes not in sp and unlabelled input fields, and iOS Info.plist for orientation and multitasking restrictions. iOS storyboards and nibs are compiled and not analysed. Findings are tagged with WCAG success criteria. - Built-inAndroid app configuration
mobile.androidChecks AndroidManifest.xml (text or binary, from source trees, APKs and AABs) and network security configs for debuggable builds, backups, cleartext traffic, exported components, sensitive permissions, outdated SDK levels, task hijacking and unverified deep links. - Built-inMobile dependencies
mobile.dependenciesIdentifies bundled Android libraries from META-INF version markers (androidx, Material, Play Services, Firebase, pom.properties) and checks their Maven coordinates against OSV.dev, and inventories iOS frameworks. Emits an info-level SBOM inventory. Works on built APK/AAB/IPA files only; use code.dependencies for source trees. - Built-iniOS app configuration
mobile.iosChecks Info.plist (source, Expo config or IPA, binary or XML) for App Transport Security exceptions, missing or empty permission purpose strings, file sharing and custom URL schemes, and entitlements/provisioning profiles for debuggable builds. - Built-inMobile app size and build quality
mobile.performanceChecks built APK/AAB/IPA files for oversized artifacts (APK > 100 MB high, > 50 MB medium; AAB 200/100 MB; IPA 500/200 MB), native libraries for many ABIs in one APK, large or uncompressed assets, unstripped native libraries (ELF .symtab/.debug_info) and DEX that looks neither shrunk nor renamed by R8 (heuristic). On iOS it flags large frameworks and executables. Source trees are not analysed. - Built-inMobile app secrets
mobile.secretsScans APK/AAB/IPA contents (dex, JS bundles, assets, plists, resources) and mobile config files for hardcoded API keys, tokens and private keys, Firebase database URLs and cleartext HTTP endpoints. - Built-inAccessibility (static)
web.accessibilityWCAG checks on the served HTML: alt text, form labels, link/button names, headings, language, title, zoom, duplicate ids, skip links, tables, frames and tabindex. Use --browser for a full axe-core run. - Built-inExposed API surface
web.api-exposureLooks for public OpenAPI/Swagger documents, Swagger UI, GraphQL introspection and OpenID discovery with a handful of GET requests, ignoring catch-all pages that answer 200 everywhere. - Built-inDNS and email security
web.dnsChecks the target's registrable domain for SPF, DMARC, CAA, MTA-STS and TLS-RPT records, no-mail lockdown, and dangling CNAMEs to takeover-prone services. Lookups use the system resolver. DNSSEC is not checked: Node's resolver cannot validate signatures, so any verdict would be a guess. - Built-inSensitive file exposure
web.exposureProbes a handful of well-known paths (/.git, /.env, server-status, phpinfo…), checks for public source maps, directory listings and verbose error pages, and for security.txt. - Built-inSecurity headers
web.headersChecks CSP, HSTS, framing, MIME sniffing, referrer and permissions policies, cross-origin isolation, version disclosure, CORS and cookie flags on the target URL. - Wrapped scannerLighthouse
web.lighthouseRuns Google Lighthouse (performance, accessibility, SEO, best practices) and reports failing audits.lighthouse - Wrapped scannerpa11y accessibility
web.pa11yRuns pa11y with the axe and HTML_CodeSniffer runners in headless Chrome and reports WCAG errors and warnings (notices are ignored). Loads the page once like a browser, so it is low-volume; authenticated pages are not supported because pa11y would send custom headers to every origin the page loads.pa11y - Built-inPerformance
web.performanceMeasures TTFB and HTML size, checks compression and caching of the document and sampled assets, render-blocking scripts, JS/CSS weight, image sizing, lazy-loading, formats and preconnects. - Built-inPrivacy
web.privacyDetects analytics/advertising trackers and session replay, cookies set before consent, third-party fonts and CDNs that leak visitor IPs, forms posting over HTTP, and a missing privacy-policy link. - Built-inAvailability and error handling
web.reliabilityLooks for long redirect chains and loops, apex/www inconsistency, 5xx responses on crawled pages, 503s without Retry-After, and 404 handling (soft 404s, default server error pages). HTTP→HTTPS redirects and slow responses are covered by web.tls and web.performance. - Built-inSEO
web.seoChecks titles, descriptions, canonicals, headings, viewport, social cards, robots directives, robots.txt, sitemap, JSON-LD, hreflang and broken internal links. - Wrapped scannertestssl.sh deep TLS scan
web.testsslRuns testssl.sh against an https target: protocols, cipher categories, server defaults and known TLS vulnerabilities (BEAST, LOGJAM, ROBOT, Heartbleed, ...). Opens hundreds of TLS handshakes to the target and takes minutes, so it is opt-in. Complements web.tls, whose expiry/trust/legacy-protocol checks it does not repeat. Custom headers are not used (no HTTP requests are made except a compression probe).Opt-intestssl.sh - Built-inTLS / HTTPS
web.tlsChecks HTTP→HTTPS redirects, certificate validity, expiry, hostname and trust, legacy TLS versions and mixed content. - Wrapped scannerOWASP ZAP active scan
web.zap-activeRuns the OWASP ZAP full scan (zap-full-scan.py: spider, then the ACTIVE scanner) from the pinned Docker image or a local install. The active scanner sends attack payloads (injection strings, fuzzing, forced browsing) and can create or alter data, so it only runs against a host listed in settings["web.zap-active"].allowHosts (exact host name) and that setting is only honoured from a trusted config (`--config <path>`), never from a config found inside the target. settings["web.zap-active"].maxMinutes (default 10) bounds the spider and the active scan. Localhost targets are reached through host.docker.internal. Authenticated scans are not supported. Never point it at production or at systems you do not own.Opt-indocker - Wrapped scannerOWASP ZAP baseline
web.zap-baselineRuns the OWASP ZAP baseline scan (zap-baseline.py: spider for about a minute, then passive rules only; no attacks and no active scan) from a local install or the pinned Docker image. Sends GET requests while spidering, more than the default URL auditors, so it is opt-in. Localhost targets are reached through host.docker.internal. Authenticated scans are not supported.Opt-indocker - Built-inBrowser audit (Playwright + axe-core)
webapp.browserRenders each crawled page in headless Chromium, runs axe-core, records console errors, uncaught exceptions, failed and mixed-content requests, measures LCP, CLS, TBT, page weight and JS heap, and passively checks what loads before consent (tracker requests, tracking cookies, third-party hosts, consent platforms).
No auditor matches these filters.
- Built-in
- Wrapped scanner
- Agent