🛡️ Web App Security Scanner
URL Passive Scan + Source Deep Scan · MVP V0.9.14
App Capability Declaration
按實際業務功能申報。Scanner 會同公開 code 偵測結果及 Permissions-Policy 交叉比對。
預設 Partial Scan：HTML 首 2 MB、每個 JavaScript 首 1.5 MB、最多 8 個 scripts。
Ready.
External Validation
Manual, independent checks performed by MDN HTTP Observatory and Qualys SSL Labs. Target hostname is sent to the selected external provider. External results do not replace or override local scanner findings.
Not run.
Source Deep Scan
ZIP 只喺目前 Browser 本機解壓及靜態分析。唔會 upload、執行、build、npm install 或啟動 source code。
最大 25 MB；每個文字檔最多分析 2 MB；最多處理 800 個 archive entries。
No ZIP selected.
Combined Security Review
URL Scan 同 Source Deep Scan 可獨立做，亦可以兩者合併記錄。
AI Summary 尚未生成。按 Generate AI Summary & Insights 後先會呼叫 Workers AI。
Follow-up Record
Scan Method & Coverage
V0.9.12 technical reference. The rule IDs below map directly to the URL checklist, Source Deep Scan findings, dependency/CVE assessment and AI evidence gate. This page does not change scan behaviour.
1. Transport & Security Headers
| Rule | What is checked | Evidence / Method | Status logic | Finding severity |
|---|---|---|---|---|
| TLS-001 | HTTPS enabled | Final fetched URL | HTTPS final URL → PASS. Non-HTTPS targets are rejected before scanning. | Gate |
| HDR-001 | Content-Security-Policy value quality | Parses CSP directives: default-src, script-src, wildcard sources, unsafe-eval, unsafe-inline without nonce/hash, object-src and base-uri. | Header absent → FAIL. Risky/weak directives → WARNING. No configured weakness found → PASS. | LOW / MEDIUM / HIGH by condition |
| HDR-002 | Strict-Transport-Security value | Parses max-age, includeSubDomains and records preload. | Absent → FAIL. max-age=0 / malformed / very short → WARNING. Under 1 year → review. Production baseline met → PASS. | LOW / MEDIUM |
| HDR-003 | X-Content-Type-Options | Exact response-header value. |
Exact nosniff → PASS. Absent or another value →
FAIL.
|
LOW |
| HDR-004 | Referrer-Policy | HTTP response header. | Present → PASS. Absent → FAIL. | LOW |
| HDR-005 | Permissions-Policy alignment | Current header + declared + statically detected camera/microphone/geolocation need. | Aligned/restricted → PASS. Missing directive, wildcard, blocked required capability or undeclared detected capability → WARNING / related Finding. | LOW to HIGH |
| HDR-006 | Clickjacking / framing protection |
CSP frame-ancestors or X-Frame-Options
DENY/SAMEORIGIN.
|
Either valid protection → PASS. Neither valid protection → FAIL. | MEDIUM |
2. Cookie Security
| Rule | What is checked | Evidence / Method | Status logic | Severity |
|---|---|---|---|---|
| CK-001 | Observed Set-Cookie security attributes | Set-Cookie response values. Checks Secure, SameSite, context-aware HttpOnly and SameSite=None + Secure. | No Set-Cookie on scanned response → NOT TESTED. Attribute concerns → WARNING. Observed cookies meeting rules → PASS. | LOW / MEDIUM |
3. Client Code Checks
| Rule | Indicator | Evidence source | Result logic | Severity |
|---|---|---|---|---|
| JS-001 | eval( |
Analysed inline/external JavaScript, URL, approximate line and context. | Accepted pattern → FAIL. No match within complete coverage → PASS. Incomplete coverage → PARTIAL. | HIGH |
| JS-002 | new Function( |
Public JavaScript | Same static-indicator logic; scanner-rule definitions are excluded where recognised. | HIGH |
| JS-003 | document.write( |
Public JavaScript | Match is a review Finding, not proof of exploitable injection. | MEDIUM |
| JS-004 | .innerHTML = |
Public JavaScript | Match indicates a DOM sink requiring source/data-flow review; not confirmed XSS by itself. | MEDIUM |
| JS-005 | Framework HTML sinks | dangerouslySetInnerHTML, Vue v-html, Svelte @html, Angular bypassSecurityTrustHtml. | Pattern → FAIL/review Finding. No match → PASS within coverage. | MEDIUM |
| JS-006 | Suspicious dynamic navigation sink | Dynamic values passed/assigned to location.href, location.assign, location.replace or window.open. | Pattern → review Finding. No match → PASS within coverage. | MEDIUM |
4. Secret / Credential Indicators
| Rule | Indicator | Evidence | PASS / FAIL | Severity |
|---|---|---|---|---|
| SEC-001 | AWS access-key-like pattern | Public JavaScript | No match → PASS; match → FAIL and human credential validation. | CRITICAL |
| SEC-002 | Generic API key / secret / token assignment | Public JavaScript | No match → PASS; match → FAIL/review. | HIGH |
| SEC-003 | GitHub token pattern | Public JavaScript | No match → PASS; provider-shaped token → FAIL/review. | CRITICAL |
| SEC-004 | Google API key pattern | Public JavaScript | No match → PASS; pattern → FAIL/review. | HIGH |
| SEC-005 | Stripe secret-key pattern | Public JavaScript | No match → PASS; pattern → FAIL/review. | CRITICAL |
| SEC-006 | Slack webhook pattern | Public JavaScript | No match → PASS; pattern → FAIL/review. | HIGH |
| SEC-007 | Private-key PEM block | Public JavaScript/text available through URL scan | No match → PASS; private-key marker → FAIL. | CRITICAL |
5. Network & Dependency Coverage
| Rule | Check | Method | Status logic |
|---|---|---|---|
| NET-001 | Mixed HTTP content | HTTP URLs in HTML src/href/action positions; common W3C namespace URLs excluded. | Match → FAIL. No match → PASS/PARTIAL according to coverage. |
| SCA-001 | Public dependency vulnerability visibility | URL scan cannot prove full direct/transitive dependency inventory. | URL-only dependency coverage remains PARTIAL when complete inventory is unavailable. |
| DEP-001 | Complete dependency tree | Requires exact dependency evidence from source manifests / lockfiles. | Passive URL scan → NOT TESTED. |
6. URL Scan Coverage
| Rule / Area | Partial Scan | Full Scan | Evidence / status |
|---|---|---|---|
| HTML response | First 2 MB | Up to 20 MB | htmlBytesRead + htmlTruncated |
| External JavaScript | 1.5 MB/file | 8 MB/file | Per-script bytes, truncated/error state |
| External script count | Maximum 8 | Maximum 20 | Discovered versus processed |
| COV-001 | HTML analysed | Complete → PASS; truncated → PARTIAL. | |
| COV-002 | External scripts analysed | All selected scripts processed → PASS; missing/truncated/error → PARTIAL. | |
7. Passive URL Scope Status
| Rule | Area | Why NOT TESTED in URL Scan |
|---|---|---|
| SOURCE-001 | Backend source | Passive public URL scan cannot inspect non-public server source. Source Deep Scan is a separate workflow. |
| AUTH-001 | Authentication / authorization | Passive URL scan does not log in, exercise session flows or test role boundaries. |
| DB-001 | Database security | Passive URL scan has no direct evidence of database permissions, runtime queries or server database configuration. |
| DEP-001 | Complete dependency tree | Public page resources do not prove the complete installed server/client dependency graph. |
8. Source Deep Scan Rules
ZIP scanning is browser-local. Uploaded application source is not executed, built, installed or started.
| Rule | Check / Evidence | Interpretation | Severity |
|---|---|---|---|
| SRC-JS-INNERHTML | .innerHTML assignment; exact ZIP path, line and context. | DOM sink review indicator, not confirmed XSS. | MEDIUM |
| SRC-JS-EVAL | eval() | Dynamic execution indicator; scanner-rule definitions can be excluded. | HIGH |
| SRC-JS-FUNCTION | new Function() | Dynamic code-construction indicator. | HIGH |
| SRC-JS-WRITE | document.write() | HTML injection/rewrite review indicator. | MEDIUM |
| SRC-JS-FRAMEWORK-HTML | React/Vue/Svelte/Angular HTML sinks | Requires input/sanitization review. | MEDIUM |
| SRC-JS-DYNAMIC-NAV | Dynamic browser navigation sinks | Review source, allowed schemes and redirect destination validation. | MEDIUM |
| SRC-SECRET-AWS | AWS key-shaped value | Credential validation / rotation review. | CRITICAL |
| SRC-SECRET-GENERIC | Generic key/secret/token assignment | May be false positive; inspect redacted context. | HIGH |
| SRC-SECRET-GITHUB | GitHub token signature | Provider-specific credential indicator. | CRITICAL |
| SRC-SECRET-GOOGLE | Google API key signature | Provider-specific credential indicator. | HIGH |
| SRC-SECRET-STRIPE | Stripe secret-key signature | Payment credential indicator. | CRITICAL |
| SRC-SECRET-SLACK | Slack webhook signature | Webhook credential indicator. | HIGH |
| SRC-SECRET-PRIVATE-KEY | Private-key block marker | Private key exposure indicator. | CRITICAL |
| SRC-SQL-CONCAT | Recognisable SELECT/INSERT/UPDATE/DELETE statement plus dynamic concatenation/interpolation. | Static SQL-injection review signal only; no exploitation is attempted. | MEDIUM |
| SRC-MISC-SENSITIVE-FILE | ZIP path inventory for .env, .git, keys/certs, SQL/database, backup and credential-like files. | Path indicator; finding requires review of file purpose/content. | MEDIUM/HIGH by path |
9. Source Scan Guardrails
| Area | Current behaviour |
|---|---|
| ZIP size | Maximum 25 MB |
| Archive entries | First 800 entries considered |
| Supported text file size | Maximum 2 MB per analysed text file |
| Supported text families | HTML, JavaScript/TypeScript variants, JSON, CSS, Python, PHP, Java, C#, Go, Ruby, Vue, Svelte, TOML, YAML, XML, env, TXT and lock-style files. |
| Execution | No uploaded JS/Python/PHP is executed. No npm install, build, package installation or application server startup. |
| Finding location | ZIP path + source line + short context; long token-like strings are redacted in context. |
10. Dependency / CVE / OSV
| Stage / Status | Method / meaning |
|---|---|
| Dependency evidence | Exact package/version from package-lock/package metadata or supported exact-version CDN evidence. Unknown/range-only versions are not treated as an exact installed version. |
| OSV lookup | Eligible package/version pairs are sent by the Worker to the OSV batch API. |
| VULNERABLE | OSV returned vulnerability record(s) for a submitted exact package/version; OSV IDs and CVE aliases become deterministic evidence. |
| NO KNOWN MATCH | OSV completed for the exact version and returned no matching record. This is not proof the package has no vulnerability. |
| NOT TESTED | No eligible exact package/version evidence was available. |
| UNKNOWN | OSV request/processing failed. UNKNOWN is never converted to PASS. |
11. External Validation Providers
| Provider | What is checked | Result / operation | Boundary |
|---|---|---|---|
| MDN HTTP Observatory | Independent website-level review of HTTP security headers and browser security configuration, including CSP, HSTS, framing, cookies and related HTTP protections. | Manual trigger. Returns external grade, score, tests passed/failed, individual test result, expectation, score modifier, provider timestamp and details link. Provider caching/rate controls may apply. | Does not replace local HDR/CK rules and does not test application SQL injection, source code or complete dependency vulnerabilities. |
| Local Worker TLS Rules | Worker-side TLS handshake checks for certificate trust/hostname, certificate expiry, negotiated TLS version, TLS 1.0/1.1 rejection, TLS 1.2/1.3 availability and negotiated cipher strength. | Manual trigger. Returns individual TLS-LOCAL-001 to TLS-LOCAL-008 results. | Narrower than SSL Labs: it does not enumerate every supported cipher suite, all certificate-chain issues or known TLS implementation vulnerabilities. |
| Qualys SSL Labs | External SSL/TLS server assessment: certificate/trust, supported protocol/cipher configuration and endpoint grades. |
Manual trigger and asynchronous polling. READY means complete;
DNS/IN_PROGRESS requires polling. Cached results may be used.
Worker secret SSLLABS_EMAIL must contain a
registered organization email for API v4.
|
External provider tests public TLS endpoints. Results do not override local TLS-001 or other scanner findings. |
| External result statuses | COMPLETED/READY = provider completed; DNS/IN_PROGRESS = poll again; NOT_CONFIGURED = required Worker secret missing; UNKNOWN/ERROR/rate-limit = no PASS conclusion. | ||
11. AI Review & Evidence Gate
| Area | Current behaviour |
|---|---|
| Input to combined AI | Finding metadata only: scope, ID, severity, title, potential impact and short evidence summary. Full Source ZIP is not supplied. |
| Output structure | Workers AI combined review uses JSON Schema structured output. |
| Allowed role | Summary, prioritisation, remediation direction and verification suggestions. |
| Finding evidence gate | Suggested Finding references must exist in scanner evidence before display. |
| CVE evidence gate | AI may only cite CVE IDs already present in accepted OSV evidence. |
| COMPLETED | AI output passed structured-output and evidence validation. |
| NOT REQUIRED | No evidence-backed Finding was available for combined AI review. |
| FAILED / REJECTED | AI/service/schema failure or evidence-gate rejection. |
12. Status Definitions
| Status | Meaning |
|---|---|
| PASS | The configured deterministic check completed within its analysed scope and met the configured pass condition. |
| FAIL | The deterministic failure condition was found. |
| WARNING | A value/policy or review condition was found that is not represented as a simple binary failure. |
| PARTIAL | The check ran but the available coverage was incomplete. |
| NOT TESTED | The required evidence or testing capability was unavailable. |