ES

SecAudit

Analyses the HTTP headers, SSL/TLS certificates, server configuration and public libraries of a website, and produces a report with a score, findings and recommendations. It only reads what the server exposes: no invasive tests.

The challenge

Find out in a minute whether a website has an insecure configuration (headers, certificate, exposed versions) without doing anything invasive to it.

Try the demo View the code
Type
Personal project
Status
Finished, updated in March 2026
Areas
Security, Backend, Frontend
Technologies
  • Python 3.12
  • httpx
  • Go
  • Gin
  • JWT
  • SQLite
  • React
  • TailwindCSS
  • Recharts
  • WeasyPrint
  • Docker Compose
  • pytest
  • GitHub Actions

Interactive demo

Screenshots

SecAudit dashboard with the audit form and the score trend
Dashboard: start an audit and see how the score evolves
List of vulnerabilities found with their severity
Findings grouped by severity
SecAudit PDF and HTML report generator
Downloadable reports in PDF and HTML

What it does

  • Security headers: HSTS, CSP, X-Frame-Options, CORS and cookie flags
  • SSL/TLS: weak protocols, insecure ciphers and expired or soon-to-expire certificates
  • Configuration: dangerous HTTP methods, directory listing and version disclosure
  • JS and CSS libraries with known CVEs, checked against OSV.dev
  • Go API with JWT authentication, audit history and comparison between two scans
  • PDF and HTML reports, and a sandbox with OWASP Juice Shop and DVWA to practise

What I learned

  • What each header protects against and how to configure it properly
  • Combining a Python scanner with a Go API
  • Weighting modules to give an understandable overall score
  • The legal and ethical limits of analysing other people's sites

The demo uses example sites with simulated responses and the scanner's own rules and penalties. The project also includes an experimental AI module that is simulated for now.

Technical decisions

Passive analysis only
It reads what the server already exposes in its responses. No fuzzing, no exploiting vulnerabilities.
Scanner in Python and API in Go with Gin
The Python scanner does the analysis. The Go API manages users with JWT and bcrypt, stores the history in SQLite and launches the scanner.
Score weighted by module
One overall score that is easy to understand, without hiding the detail of each module.
Dependencies checked against OSV.dev
Public vulnerability database for the JS and CSS libraries detected on the page.
Sandbox with OWASP Juice Shop and DVWA
Deliberately vulnerable apps to test the scanner locally, without touching other people's websites.
Tests with pytest and go test in GitHub Actions
Every commit runs the tests for both languages.

How it's built

Click each piece to see what it does.

React dashboard

Starts an audit, shows the history and compares two scans of the same site. Translated into Spanish, English and Basque.