# hemantraj-2005/pentest architecture

> Architecture diagram of the GitHub repository hemantraj-2005/pentest, generated by GitDiagram from its file tree, README and a sample of source files (last updated 2026-11-11). It is an AI-made overview: check details against the source.

- Interactive diagram: https://gitdiagram.com/hemantraj-2005/pentest
- Repository: https://github.com/hemantraj-2005/pentest

## Overview

AutoPentest is a web application for submitting projects and running automated security assessments. Its main backend workflow accepts ZIP, Git, or live-URL submissions, then queues builds when needed and runs security checks whose findings are stored for later access. The sampled project router and scan orchestrator show those handoffs and the SAST, SCA, DAST, and AI-exploit stages. The repository also includes a Next.js interface, but its API wiring is not evidenced in the sampled references. Some subsystem paths are supported by the tree and index, not inspected source.

Main entry points: [`server/app/scan_orchestrator/orchestrator_main.py`](https://github.com/hemantraj-2005/pentest/blob/main/server/app/scan_orchestrator/orchestrator_main.py) (Scan orchestrator), [`server/app/api/routers/projects.py`](https://github.com/hemantraj-2005/pentest/blob/main/server/app/api/routers/projects.py) (Project routes), [`server/app/api/database.py`](https://github.com/hemantraj-2005/pentest/blob/main/server/app/api/database.py) (Database access), [`server/app/build_worker/build_main.py`](https://github.com/hemantraj-2005/pentest/blob/main/server/app/build_worker/build_main.py) (Build worker)

## Diagram (Mermaid)

```mermaid
flowchart TD

subgraph group_ui["Web interface"]
  node_home["Projects home<br/>[page.tsx]"]
  node_project_ui["Project details<br/>[page.tsx]"]
end

subgraph group_api["API and submissions"]
  node_api_app["FastAPI app<br/>[main.py]"]
  node_project_routes["Project routes<br/>[projects.py]"]
  node_run_routes["Security run routes<br/>[security_runs.py]"]
  node_auth["User resolution<br/>[auth_deps.py]"]
  node_zip["ZIP ingestion<br/>[zip_handler.py]"]
  node_git["Git ingestion<br/>[git_handler.py]"]
  node_url["URL ingestion<br/>[url_handler.py]"]
  node_quota["Run quota<br/>[quota.py]"]
  node_storage_service["File storage service<br/>[storage.py]"]
end

subgraph group_build["Build and isolation"]
  node_build_worker["Build worker<br/>[build_main.py]"]
  node_detector["Stack detection<br/>[detector.py]"]
  node_docker_builder["Dockerfile builder"]
  node_buildpacks["Buildpacks builder"]
  node_sandbox["Sandbox manager<br/>[manager.py]"]
end

subgraph group_scan["Security assessment"]
  node_orchestrator["Scan orchestrator"]
  node_sast["SAST Semgrep<br/>[sast_semgrep.py]"]
  node_sca["SCA Trivy<br/>[sca_trivy.py]"]
  node_dast["DAST ZAP<br/>[dast_zap.py]"]
  node_strix["AI exploit Strix"]
  node_aggregator["Risk aggregation<br/>[aggregator.py]"]
end

subgraph group_state["Persistence and queues"]
  node_queue_client["Queue client<br/>[queue_client.py]"]
  node_database[("Database access<br/>[database.py]")]
  node_models["Domain records<br/>[models.py]"]
  node_report_access["Report access<br/>[report_access.py]"]
end

node_user(("Project user"))
node_redis["Redis queues"]
node_postgres[("PostgreSQL")]
node_docker["Docker runtime"]

node_user -->|"opens"| node_home
node_user -->|"views"| node_project_ui
node_api_app -->|"initializes"| node_database
node_api_app -->|"mounts routes"| node_project_routes
node_api_app -->|"mounts routes"| node_run_routes
node_project_routes -->|"requires user"| node_auth
node_run_routes -->|"requires user"| node_auth
node_project_routes -->|"checks quota"| node_quota
node_project_routes -->|"handles ZIP"| node_zip
node_project_routes -->|"handles Git"| node_git
node_project_routes -->|"handles URL"| node_url
node_zip -->|"saves upload"| node_storage_service
node_project_routes -->|"enqueues jobs"| node_queue_client
node_queue_client -->|"writes jobs"| node_redis
node_database -->|"initializes schema"| node_models
node_database -->|"connects"| node_postgres
node_storage_service -->|"reads and writes files"| node_storage_service
node_build_worker -->|"consumes queue"| node_queue_client
node_build_worker -->|"detects stack"| node_detector
node_build_worker -->|"builds image"| node_docker_builder
node_build_worker -->|"builds image"| node_buildpacks
node_buildpacks -->|"delegates build"| node_docker_builder
node_build_worker -->|"updates records"| node_database
node_orchestrator -->|"consumes scan jobs"| node_queue_client
node_orchestrator -->|"loads and saves runs"| node_database
node_orchestrator -->|"runs SAST"| node_sast
node_orchestrator -->|"runs SCA"| node_sca
node_orchestrator -->|"runs DAST"| node_dast
node_orchestrator -->|"runs AI exploit"| node_strix
node_orchestrator -->|"deploys target"| node_sandbox
node_sandbox -->|"manages containers"| node_docker
node_orchestrator -->|"computes risk"| node_aggregator
node_run_routes -->|"checks report access"| node_report_access
node_report_access -.->|"reads run data"| node_database

click node_home "https://github.com/hemantraj-2005/pentest/blob/main/client/app/page.tsx"
click node_project_ui "https://github.com/hemantraj-2005/pentest/blob/main/client/app/project/%5Bid%5D/page.tsx"
click node_api_app "https://github.com/hemantraj-2005/pentest/blob/main/server/app/api/main.py"
click node_project_routes "https://github.com/hemantraj-2005/pentest/blob/main/server/app/api/routers/projects.py"
click node_run_routes "https://github.com/hemantraj-2005/pentest/blob/main/server/app/api/routers/security_runs.py"
click node_auth "https://github.com/hemantraj-2005/pentest/blob/main/server/app/api/routers/auth_deps.py"
click node_zip "https://github.com/hemantraj-2005/pentest/blob/main/server/app/ingestion/zip_handler.py"
click node_git "https://github.com/hemantraj-2005/pentest/blob/main/server/app/ingestion/git_handler.py"
click node_url "https://github.com/hemantraj-2005/pentest/blob/main/server/app/ingestion/url_handler.py"
click node_quota "https://github.com/hemantraj-2005/pentest/blob/main/server/app/api/services/quota.py"
click node_storage_service "https://github.com/hemantraj-2005/pentest/blob/main/server/app/api/services/storage.py"
click node_build_worker "https://github.com/hemantraj-2005/pentest/blob/main/server/app/build_worker/build_main.py"
click node_detector "https://github.com/hemantraj-2005/pentest/blob/main/server/app/stack_detector/detector.py"
click node_docker_builder "https://github.com/hemantraj-2005/pentest/blob/main/server/app/build_worker/builders/dockerfile_builder.py"
click node_buildpacks "https://github.com/hemantraj-2005/pentest/blob/main/server/app/build_worker/builders/buildpacks_builder.py"
click node_sandbox "https://github.com/hemantraj-2005/pentest/blob/main/server/app/sandbox_manager/manager.py"
click node_orchestrator "https://github.com/hemantraj-2005/pentest/blob/main/server/app/scan_orchestrator/orchestrator_main.py"
click node_sast "https://github.com/hemantraj-2005/pentest/blob/main/server/app/scan_orchestrator/stages/sast_semgrep.py"
click node_sca "https://github.com/hemantraj-2005/pentest/blob/main/server/app/scan_orchestrator/stages/sca_trivy.py"
click node_dast "https://github.com/hemantraj-2005/pentest/blob/main/server/app/scan_orchestrator/stages/dast_zap.py"
click node_strix "https://github.com/hemantraj-2005/pentest/blob/main/server/app/scan_orchestrator/stages/ai_exploit_strix.py"
click node_aggregator "https://github.com/hemantraj-2005/pentest/blob/main/server/app/scan_orchestrator/aggregator.py"
click node_queue_client "https://github.com/hemantraj-2005/pentest/blob/main/server/app/api/services/queue_client.py"
click node_database "https://github.com/hemantraj-2005/pentest/blob/main/server/app/api/database.py"
click node_models "https://github.com/hemantraj-2005/pentest/blob/main/server/app/api/models/models.py"
click node_report_access "https://github.com/hemantraj-2005/pentest/blob/main/server/app/api/services/report_access.py"

classDef toneNeutral fill:#f8fafc,stroke:#334155,stroke-width:1.5px,color:#0f172a
classDef toneBlue fill:#dbeafe,stroke:#2563eb,stroke-width:1.5px,color:#172554
classDef toneAmber fill:#fef3c7,stroke:#d97706,stroke-width:1.5px,color:#78350f
classDef toneMint fill:#dcfce7,stroke:#16a34a,stroke-width:1.5px,color:#14532d
classDef toneRose fill:#ffe4e6,stroke:#e11d48,stroke-width:1.5px,color:#881337
classDef toneIndigo fill:#e0e7ff,stroke:#4f46e5,stroke-width:1.5px,color:#312e81
classDef toneTeal fill:#ccfbf1,stroke:#0f766e,stroke-width:1.5px,color:#134e4a
class node_home,node_project_ui,node_user toneBlue
class node_api_app,node_project_routes,node_run_routes,node_auth,node_zip,node_git,node_url,node_quota,node_storage_service,node_redis,node_postgres toneAmber
class node_build_worker,node_detector,node_docker_builder,node_buildpacks,node_sandbox toneMint
class node_orchestrator,node_sast,node_sca,node_dast,node_strix,node_aggregator toneRose
class node_queue_client,node_database,node_models,node_report_access,node_docker toneIndigo
```

## Components

### Web interface

- [Projects home](https://github.com/hemantraj-2005/pentest/blob/main/client/app/page.tsx): `client/app/page.tsx`
- [Project details](https://github.com/hemantraj-2005/pentest/blob/main/client/app/project/%5Bid%5D/page.tsx): `client/app/project/[id]/page.tsx`

### API and submissions

- [FastAPI app](https://github.com/hemantraj-2005/pentest/blob/main/server/app/api/main.py): `server/app/api/main.py`
- [Project routes](https://github.com/hemantraj-2005/pentest/blob/main/server/app/api/routers/projects.py): `server/app/api/routers/projects.py`
- [Security run routes](https://github.com/hemantraj-2005/pentest/blob/main/server/app/api/routers/security_runs.py): `server/app/api/routers/security_runs.py`
- [User resolution](https://github.com/hemantraj-2005/pentest/blob/main/server/app/api/routers/auth_deps.py): `server/app/api/routers/auth_deps.py`
- [ZIP ingestion](https://github.com/hemantraj-2005/pentest/blob/main/server/app/ingestion/zip_handler.py): `server/app/ingestion/zip_handler.py`
- [Git ingestion](https://github.com/hemantraj-2005/pentest/blob/main/server/app/ingestion/git_handler.py): `server/app/ingestion/git_handler.py`
- [URL ingestion](https://github.com/hemantraj-2005/pentest/blob/main/server/app/ingestion/url_handler.py): `server/app/ingestion/url_handler.py`
- [Run quota](https://github.com/hemantraj-2005/pentest/blob/main/server/app/api/services/quota.py): `server/app/api/services/quota.py`
- [File storage service](https://github.com/hemantraj-2005/pentest/blob/main/server/app/api/services/storage.py): `server/app/api/services/storage.py`

### Build and isolation

- [Build worker](https://github.com/hemantraj-2005/pentest/blob/main/server/app/build_worker/build_main.py): `server/app/build_worker/build_main.py`
- [Stack detection](https://github.com/hemantraj-2005/pentest/blob/main/server/app/stack_detector/detector.py): `server/app/stack_detector/detector.py`
- [Dockerfile builder](https://github.com/hemantraj-2005/pentest/blob/main/server/app/build_worker/builders/dockerfile_builder.py): `server/app/build_worker/builders/dockerfile_builder.py`
- [Buildpacks builder](https://github.com/hemantraj-2005/pentest/blob/main/server/app/build_worker/builders/buildpacks_builder.py): `server/app/build_worker/builders/buildpacks_builder.py`
- [Sandbox manager](https://github.com/hemantraj-2005/pentest/blob/main/server/app/sandbox_manager/manager.py): `server/app/sandbox_manager/manager.py`

### Security assessment

- [Scan orchestrator](https://github.com/hemantraj-2005/pentest/blob/main/server/app/scan_orchestrator/orchestrator_main.py): `server/app/scan_orchestrator/orchestrator_main.py`
- [SAST Semgrep](https://github.com/hemantraj-2005/pentest/blob/main/server/app/scan_orchestrator/stages/sast_semgrep.py): `server/app/scan_orchestrator/stages/sast_semgrep.py`
- [SCA Trivy](https://github.com/hemantraj-2005/pentest/blob/main/server/app/scan_orchestrator/stages/sca_trivy.py): `server/app/scan_orchestrator/stages/sca_trivy.py`
- [DAST ZAP](https://github.com/hemantraj-2005/pentest/blob/main/server/app/scan_orchestrator/stages/dast_zap.py): `server/app/scan_orchestrator/stages/dast_zap.py`
- [AI exploit Strix](https://github.com/hemantraj-2005/pentest/blob/main/server/app/scan_orchestrator/stages/ai_exploit_strix.py): `server/app/scan_orchestrator/stages/ai_exploit_strix.py`
- [Risk aggregation](https://github.com/hemantraj-2005/pentest/blob/main/server/app/scan_orchestrator/aggregator.py): `server/app/scan_orchestrator/aggregator.py`

### Persistence and queues

- [Queue client](https://github.com/hemantraj-2005/pentest/blob/main/server/app/api/services/queue_client.py): `server/app/api/services/queue_client.py`
- [Database access](https://github.com/hemantraj-2005/pentest/blob/main/server/app/api/database.py): `server/app/api/database.py`
- [Domain records](https://github.com/hemantraj-2005/pentest/blob/main/server/app/api/models/models.py): `server/app/api/models/models.py`
- [Report access](https://github.com/hemantraj-2005/pentest/blob/main/server/app/api/services/report_access.py): `server/app/api/services/report_access.py`

### Other components

- **Project user**
- **Redis queues**
- **PostgreSQL**
- **Docker runtime**

## Connections

- Project user → Projects home: opens
- Project user → Project details: views
- FastAPI app → Database access: initializes (evidence: `server/app/api/main.py`)
- FastAPI app → Project routes: mounts routes (evidence: `server/app/api/main.py`)
- FastAPI app → Security run routes: mounts routes (evidence: `server/app/api/main.py`)
- Project routes → User resolution: requires user (evidence: `server/app/api/routers/projects.py`)
- Security run routes → User resolution: requires user (evidence: `server/app/api/routers/security_runs.py`)
- Project routes → Run quota: checks quota (evidence: `server/app/api/routers/projects.py`)
- Project routes → ZIP ingestion: handles ZIP (evidence: `server/app/api/routers/projects.py`)
- Project routes → Git ingestion: handles Git (evidence: `server/app/api/routers/projects.py`)
- Project routes → URL ingestion: handles URL (evidence: `server/app/api/routers/projects.py`)
- ZIP ingestion → File storage service: saves upload (evidence: `server/app/ingestion/zip_handler.py`)
- Project routes → Queue client: enqueues jobs (evidence: `server/app/api/routers/projects.py`)
- Queue client → Redis queues: writes jobs (evidence: `server/app/api/services/queue_client.py`)
- Database access → Domain records: initializes schema (evidence: `server/app/api/database.py`)
- Database access → PostgreSQL: connects (evidence: `server/app/api/database.py`)
- File storage service → File storage service: reads and writes files (evidence: `server/app/api/services/storage.py`)
- Build worker → Queue client: consumes queue (evidence: `server/app/build_worker/build_main.py`)
- Build worker → Stack detection: detects stack (evidence: `server/app/build_worker/build_main.py`)
- Build worker → Dockerfile builder: builds image (evidence: `server/app/build_worker/build_main.py`)
- Build worker → Buildpacks builder: builds image (evidence: `server/app/build_worker/build_main.py`)
- Buildpacks builder → Dockerfile builder: delegates build (evidence: `server/app/build_worker/builders/buildpacks_builder.py`)
- Build worker → Database access: updates records (evidence: `server/app/build_worker/build_main.py`)
- Scan orchestrator → Queue client: consumes scan jobs (evidence: `server/app/scan_orchestrator/orchestrator_main.py`)
- Scan orchestrator → Database access: loads and saves runs (evidence: `server/app/scan_orchestrator/orchestrator_main.py`)
- Scan orchestrator → SAST Semgrep: runs SAST (evidence: `server/app/scan_orchestrator/orchestrator_main.py`)
- Scan orchestrator → SCA Trivy: runs SCA (evidence: `server/app/scan_orchestrator/orchestrator_main.py`)
- Scan orchestrator → DAST ZAP: runs DAST (evidence: `server/app/scan_orchestrator/orchestrator_main.py`)
- Scan orchestrator → AI exploit Strix: runs AI exploit (evidence: `server/app/scan_orchestrator/orchestrator_main.py`)
- Scan orchestrator → Sandbox manager: deploys target (evidence: `server/app/scan_orchestrator/orchestrator_main.py`)
- Sandbox manager → Docker runtime: manages containers (evidence: `server/app/sandbox_manager/manager.py`)
- Scan orchestrator → Risk aggregation: computes risk (evidence: `server/app/scan_orchestrator/orchestrator_main.py`)
- Security run routes → Report access: checks report access (evidence: `server/app/api/routers/security_runs.py`)
- Report access → Database access: reads run data