How hemantraj-2005/pentest works
AutoPentest is a web application for submitting projects and running automated security assessments. Its main backend workflow accepts ZIP, Git, or live-URL submissions, then queues builds when needed and runs security checks whose findings are stored for later access. The sampled project router and scan orchestrator show those handoffs and the SAST, SCA, DAST, and AI-exploit stages. The repository also includes a Next.js interface, but its API wiring is not evidenced in the sampled references. Some subsystem paths are supported by the tree and index, not inspected source.
Main entry points: orchestrator_main.py Scan orchestrator · projects.py Project routes · database.py Database access · build_main.py Build worker
Components 30
Web interface
- Projects home
client/app/page.tsx - Project details
client/app/project/[id]/page.tsx
API and submissions
- FastAPI app
server/app/api/main.py - Project routes
server/app/api/routers/projects.py - Security run routes
server/app/api/routers/security_runs.py - User resolution
server/app/api/routers/auth_deps.py - ZIP ingestion
server/app/ingestion/zip_handler.py - Git ingestion
server/app/ingestion/git_handler.py - URL ingestion
server/app/ingestion/url_handler.py - Run quota
server/app/api/services/quota.py - File storage service
server/app/api/services/storage.py
Build and isolation
- Build worker
server/app/build_worker/build_main.py - Stack detection
server/app/stack_detector/detector.py - Dockerfile builder
server/app/build_worker/builders/dockerfile_builder.py - Buildpacks builder
server/app/build_worker/builders/buildpacks_builder.py - Sandbox manager
server/app/sandbox_manager/manager.py
Security assessment
- Scan orchestrator
server/app/scan_orchestrator/orchestrator_main.py - SAST Semgrep
server/app/scan_orchestrator/stages/sast_semgrep.py - SCA Trivy
server/app/scan_orchestrator/stages/sca_trivy.py - DAST ZAP
server/app/scan_orchestrator/stages/dast_zap.py - AI exploit Strix
server/app/scan_orchestrator/stages/ai_exploit_strix.py - Risk aggregation
server/app/scan_orchestrator/aggregator.py
Persistence and queues
- Queue client
server/app/api/services/queue_client.py - Database access
server/app/api/database.py - Domain records
server/app/api/models/models.py - Report access
server/app/api/services/report_access.py
Other components
- Project user
- Redis queues
- PostgreSQL
- Docker runtime
Connections 34
- Project user → Projects home: opens
- Project user → Project details: views
- FastAPI app → Database access: initializes
server/app/api/main.py - FastAPI app → Project routes: mounts routes
server/app/api/main.py - FastAPI app → Security run routes: mounts routes
server/app/api/main.py - Project routes → User resolution: requires user
server/app/api/routers/projects.py - Security run routes → User resolution: requires user
server/app/api/routers/security_runs.py - Project routes → Run quota: checks quota
server/app/api/routers/projects.py - Project routes → ZIP ingestion: handles ZIP
server/app/api/routers/projects.py - Project routes → Git ingestion: handles Git
server/app/api/routers/projects.py - Project routes → URL ingestion: handles URL
server/app/api/routers/projects.py - ZIP ingestion → File storage service: saves upload
server/app/ingestion/zip_handler.py - Project routes → Queue client: enqueues jobs
server/app/api/routers/projects.py - Queue client → Redis queues: writes jobs
server/app/api/services/queue_client.py - Database access → Domain records: initializes schema
server/app/api/database.py - Database access → PostgreSQL: connects
server/app/api/database.py - File storage service → File storage service: reads and writes files
server/app/api/services/storage.py - Build worker → Queue client: consumes queue
server/app/build_worker/build_main.py - Build worker → Stack detection: detects stack
server/app/build_worker/build_main.py - Build worker → Dockerfile builder: builds image
server/app/build_worker/build_main.py - Build worker → Buildpacks builder: builds image
server/app/build_worker/build_main.py - Buildpacks builder → Dockerfile builder: delegates build
server/app/build_worker/builders/buildpacks_builder.py - Build worker → Database access: updates records
server/app/build_worker/build_main.py - Scan orchestrator → Queue client: consumes scan jobs
server/app/scan_orchestrator/orchestrator_main.py - Scan orchestrator → Database access: loads and saves runs
server/app/scan_orchestrator/orchestrator_main.py - Scan orchestrator → SAST Semgrep: runs SAST
server/app/scan_orchestrator/orchestrator_main.py - Scan orchestrator → SCA Trivy: runs SCA
server/app/scan_orchestrator/orchestrator_main.py - Scan orchestrator → DAST ZAP: runs DAST
server/app/scan_orchestrator/orchestrator_main.py - Scan orchestrator → AI exploit Strix: runs AI exploit
server/app/scan_orchestrator/orchestrator_main.py - Scan orchestrator → Sandbox manager: deploys target
server/app/scan_orchestrator/orchestrator_main.py - Sandbox manager → Docker runtime: manages containers
server/app/sandbox_manager/manager.py - Scan orchestrator → Risk aggregation: computes risk
server/app/scan_orchestrator/orchestrator_main.py - Security run routes → Report access: checks report access
server/app/api/routers/security_runs.py - Report access → Database access: reads run data