cymriccc/sec-scan

How cymriccc/sec-scan works

sec-scan is a CLI web-application security auditor. Its main workflow accepts one URL or a file of targets, runs HTTP header, TLS, CORS, technology-disclosure, sensitive-path, and cookie checks, then evaluates posture and emits terminal or exported reports; batch scans use a worker pool. The README also documents interactive HTML, Markdown, JSON, and risk-threshold gating. Edges follow the entrypoint and batch-worker calls shown in excerpts; scanner modules not excerpted are included as documented capabilities, with their internal implementation links omitted where unverified.

Main entry points: main.go CLI workflow · concurrent.go Batch workers · risk.go Risk assessment · html.go HTML dashboard

Components 15

CLI workflow

CLI workflow cmd/sec-scan/main.go
Batch workers internal/scanner/concurrent.go

Target audits

Header audit internal/scanner/headers.go
TLS audit internal/scanner/tls.go
CORS audit internal/scanner/cors.go
Tech disclosure internal/scanner/info.go
Endpoint probes internal/scanner/probes.go
Cookie audit internal/scanner/cookies.go

Assessment

Risk assessment internal/scanner/risk.go
Header remediation internal/scanner/remediation.go

Reports

Terminal renderer internal/scanner/printer.go
JSON export internal/report/output.go
HTML dashboard internal/report/html.go
Markdown report internal/report/md.go

Other components

Operator

Connections 21

Operator → CLI workflow: invokes README.md
CLI workflow → Batch workers: dispatches batch cmd/sec-scan/main.go
CLI workflow → Header audit: runs audit cmd/sec-scan/main.go
CLI workflow → TLS audit: runs audit cmd/sec-scan/main.go
CLI workflow → CORS audit: runs audit cmd/sec-scan/main.go
CLI workflow → Tech disclosure: runs audit cmd/sec-scan/main.go
CLI workflow → Endpoint probes: runs probes cmd/sec-scan/main.go
CLI workflow → Cookie audit: runs audit cmd/sec-scan/main.go
Batch workers → Header audit: runs audit internal/scanner/concurrent.go
Batch workers → TLS audit: runs audit internal/scanner/concurrent.go
Batch workers → CORS audit: runs audit internal/scanner/concurrent.go
Batch workers → Tech disclosure: runs audit internal/scanner/concurrent.go
Batch workers → Endpoint probes: runs probes internal/scanner/concurrent.go
Batch workers → Cookie audit: runs audit internal/scanner/concurrent.go
CLI workflow → Risk assessment: evaluates findings cmd/sec-scan/main.go
CLI workflow → Terminal renderer: prints results cmd/sec-scan/main.go
CLI workflow → JSON export: exports results cmd/sec-scan/main.go
CLI workflow → HTML dashboard: exports results cmd/sec-scan/main.go
CLI workflow → Markdown report: exports results cmd/sec-scan/main.go
HTML dashboard → Risk assessment: evaluates findings internal/report/html.go
Markdown report → Risk assessment: evaluates findings internal/report/md.go

Drawn by GitDiagram on November 13, 2026 from the repository's file tree, README and source files. Read as Markdown ·