How paras7955/web-security-audit-platform works
ScopeHarbor is a local-first, guarded application-security audit workspace. Operators configure authorized targets or repository assets, choose an eligible profile, confirm authorization, launch scans, and review normalized findings, posture, comparisons, reports, and optional finding guidance. The README documents the browser/API/database and queued worker architecture, plus relay-isolated web scanning and bounded repository analysis. Some domain modules are unsampled; their presence and capabilities are documented, but uncertain internal call paths are left unconnected.
Main entry points: app/main.py FastAPI routes · worker/main.py Lease-fenced worker · service.py Finding triage · relay/main.py Guarded relay
Components 20
Operator workspace
- Workspace UI
frontend/src/components/AppShell.tsx
API and policy
- FastAPI routes
backend/app/main.py - Identity and profiles
backend/app/security/auth.py - Targets and policies
backend/app/api/targets.py - Repository assets
backend/app/api/repository_assets.py
Audit execution
- Lease-fenced worker
backend/worker/main.py - Scan lifecycle
backend/app/scans/lifecycle.py - Guarded web scanner
backend/app/scanner/crawler.py - Guarded relay
backend/relay/main.py - Disposable-demo ZAP
backend/app/zap/active.py - Repository analysis
backend/app/repo_scanner/adapters.py
Evidence and intelligence
- Finding triage
backend/app/findings/service.py - Risk intelligence
backend/app/risk.py - Reports
backend/app/reports/service.py - AI guidance
backend/app/ai/service.py
Shared foundations
- Audit state
backend/app/models.py - Scan contracts
backend/app/core/contracts.py - Sanitization
backend/app/security/sanitization.py
Other components
- Operator
- Authorized target
Connections 24
- Operator → Workspace UI: uses
README.md - Workspace UI → FastAPI routes: calls API
README.md - FastAPI routes → Identity and profiles: authenticates
backend/app/main.py - FastAPI routes → Audit state: reads and writes
README.md - FastAPI routes → Targets and policies: routes requests
backend/app/main.py - FastAPI routes → Repository assets: routes requests
backend/app/main.py - FastAPI routes → Lease-fenced worker: queues scans
README.md - Lease-fenced worker → Audit state: claims scans
README.md - Lease-fenced worker → Scan lifecycle: uses lifecycle
backend/worker/main.py - Lease-fenced worker → Guarded web scanner: executes scans
README.md - Lease-fenced worker → Repository analysis: runs analysis
README.md - Lease-fenced worker → Disposable-demo ZAP: runs eligible ZAP
README.md - Guarded web scanner → Guarded relay: fetches through
README.md - Guarded relay → Authorized target: validates and dials
README.md - Disposable-demo ZAP → Guarded relay: uses validated scope
README.md - Scan lifecycle → Finding triage: normalizes evidence
- Finding triage → Risk intelligence: informs posture
README.md - Finding triage → Reports: supplies evidence
README.md - Finding triage → AI guidance: requests guidance
README.md - FastAPI routes → Reports: serves reports
README.md - FastAPI routes → AI guidance: serves guidance
README.md - Scan contracts → Lease-fenced worker: defines scan states
backend/worker/main.py - Sanitization → Finding triage: sanitizes evidence
backend/app/findings/service.py - Sanitization → Reports: sanitizes output
backend/app/reports/service.py