Metadata-Version: 2.4
Name: secscan-ai
Version: 0.1.0
Summary: AI Security QA for web and mobile: correlates scanner output into real attack paths and one answer — Safe to Deploy, Deploy with Warnings, or Do Not Deploy.
Author: Remo Ungureanu
License: Copyright (c) 2026 Remo Ungureanu. All rights reserved.
        
        PROPRIETARY — ALL RIGHTS RESERVED
        
        This software and its source code are the property of the copyright holder.
        No license, express or implied, is granted to use, copy, modify, merge,
        publish, distribute, sublicense, or sell copies of this software, except
        with the prior written permission of the copyright holder.
        
          NOTE TO THE AUTHOR: this is the deliberately reversible choice. You can
          relax this later (MIT, Apache-2.0, BUSL, a commercial EULA) at any time.
          You cannot un-open-source something. Decide the business model first,
          then pick the permanent license. See RELEASING.md.
        
        THIRD-PARTY SOFTWARE
        
          This software invokes third-party security scanners as separate programs.
          It does not include, bundle, or distribute them. Each is installed by the
          user under that project's own license. See THIRD-PARTY-LICENSES.md.
        
        NO WARRANTY
        
          THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
          IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
          FITNESS FOR A PARTICULAR PURPOSE, AND NONINFRINGEMENT. IN NO EVENT SHALL
          THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES, OR OTHER
          LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT, OR OTHERWISE, ARISING
          FROM, OUT OF, OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER
          DEALINGS IN THE SOFTWARE.
        
        NOT A SECURITY CERTIFICATION
        
          This software reports findings from automated scanners and applies
          heuristics to them. A "Safe to Deploy" result means no configured check
          found an exploitable issue. It is NOT a security audit, a guarantee, a
          certification, or a substitute for professional review. Absence of findings
          is not evidence of security. The operator remains solely responsible for
          the security of any system they ship.
        
        AUTHORIZED USE ONLY
        
          This software actively probes the targets it is pointed at. You may only
          use it against systems you own or are explicitly authorized in writing to
          test. Unauthorized scanning may be unlawful in your jurisdiction. The
          operator is solely responsible for ensuring authorization.
        
Project-URL: Homepage, https://github.com/rungureanu/secscan
Project-URL: Documentation, https://github.com/rungureanu/secscan/blob/main/USAGE.md
Project-URL: Issues, https://github.com/rungureanu/secscan/issues
Keywords: security,sast,dast,appsec,vulnerability-scanner,wordpress,supabase,nextjs,firebase,laravel,ios,flutter,ai-generated-code,devsecops
Classifier: License :: Other/Proprietary License
Classifier: Development Status :: 4 - Beta
Classifier: Environment :: Console
Classifier: Intended Audience :: Developers
Classifier: Topic :: Security
Classifier: Topic :: Software Development :: Quality Assurance
Classifier: Operating System :: MacOS :: MacOS X
Classifier: Operating System :: POSIX :: Linux
Classifier: Programming Language :: Python :: 3
Classifier: Programming Language :: Python :: 3.9
Classifier: Programming Language :: Python :: 3.10
Classifier: Programming Language :: Python :: 3.11
Classifier: Programming Language :: Python :: 3.12
Classifier: Programming Language :: Python :: 3.13
Requires-Python: >=3.9
Description-Content-Type: text/markdown
License-File: LICENSE
Requires-Dist: jinja2>=3.0
Requires-Dist: requests>=2.25
Requires-Dist: pyyaml>=6.0
Provides-Extra: ai
Requires-Dist: anthropic>=0.40; extra == "ai"
Dynamic: license-file

# secscan

Two on-demand security scanners that wrap trusted open-source tools and produce
a single, shareable **HTML report** (plus a JSON sibling for automation):

- **`websec`** — website security (for sites you build and deliver to clients)
- **`iossec`** — iOS app security (source *and* compiled `.ipa`)

Each finding, whatever tool produced it, is normalized to one schema and one
severity scale (critical → info). If a scanner isn't installed, it's reported as
a **coverage gap** rather than silently skipped — a clean report only ever
reflects the checks that actually ran.

---

## Install

```bash
cd ~/Developer/secscan
./setup.sh          # fast tier: scanners via brew + pipx, then websec & iossec
./setup.sh --deep   # optional heavy tier: OWASP ZAP + MobSF server
websec --check-tools
iossec --check-tools
```

The fast tier needs neither Java nor Docker. The deep tier (`--deep`) adds OWASP
ZAP (dynamic web scanning, needs Java) and the full MobSF server (deep iOS
analysis, needs Docker). Both activate automatically once present and are skipped
otherwise.

**New to it? See [USAGE.md](USAGE.md) for a step-by-step guide.**

---

## websec — websites

```bash
# Live site: TLS/SSL, security headers, nuclei misconfig/exposure checks
websec url https://haircutsbymn.eu

# Source tree: exposed API keys, SAST, vulnerable dependencies
websec source ./client-site

# Both, into one report
websec all --url https://haircutsbymn.eu --source ./client-site --out report.html
```

| Check | Tool | Looks for |
|-------|------|-----------|
| Secrets / API keys | gitleaks | Hardcoded keys, tokens, credentials |
| SAST | semgrep | XSS, injection, OWASP Top 10 patterns |
| Dependencies | osv-scanner | Known-vulnerable npm/pip/etc. packages |
| TLS/SSL | testssl.sh | Weak protocols/ciphers, cert problems |
| Headers | built-in | Missing HSTS/CSP/X-Frame-Options/etc. |
| Misconfig/exposure | nuclei | Exposed files, known CVEs, leaked keys in responses |
| Supabase keys | built-in | `service_role` key leaked in client code (critical) |
| Web server *(optional)* | nikto | Server misconfigurations |
| Dynamic scan *(deep)* | OWASP ZAP | Runtime XSS/injection/etc. via spider + active scan |

**Supabase RLS probe:** `websec supabase https://xxxx.supabase.co --key <anon-key>`
tests whether your tables are readable by the public anon key (i.e. Row-Level
Security is off). Read-only. See [USAGE.md](USAGE.md).

> ⚠️ The URL scanners (nuclei, ZAP) and the Supabase probe reach out to the
> target. Only run them against properties you own or are contracted to deliver.

## iossec — iOS

```bash
# Source tree
iossec source ./MyApp

# Compiled app
iossec ipa ./build/MyApp.ipa

# Both
iossec all --ipa ./MyApp.ipa --source ./MyApp
```

| Check | Tool | Looks for |
|-------|------|-----------|
| Static analysis | mobsfscan | Insecure storage, weak crypto, ATS misuse, unsafe APIs |
| SAST | semgrep | Mobile-specific insecure patterns |
| Flutter/Dart | built-in rules | Insecure HTTP, disabled TLS validation, secrets in SharedPreferences, unsafe WebView, service_role keys |
| Secrets / API keys | gitleaks | Hardcoded keys in source **and** shipped bundle |
| Dependencies | osv-scanner | Vulnerable CocoaPods / SPM packages |
| Info.plist | built-in (`plistlib`) | ATS disabled, file sharing, URL schemes, permissions |
| Entitlements | codesign | Debuggable release build (`get-task-allow`) |
| Binary hardening | otool / lipo | PIE/ASLR, stack canary, ARC, encryption, architectures |
| Deep analysis *(deep)* | MobSF server | Full static analysis via MobSF REST API (Docker) |

---

## Output

`report.html` — self-contained (inline CSS), color-coded by severity,
collapsible findings, and a scanner-status strip showing what ran / was skipped.
`report.json` — same data, machine-readable, written alongside for run-to-run
diffing.

Exit code is `2` when any **critical or high** finding is present, so you can
gate a delivery on a clean scan.

## Scope

These are **static / on-demand** scanners. Runtime iOS analysis (Frida/objection,
jailbroken-device instrumentation) and authenticated deep web crawls (full ZAP)
are out of scope for the default build but can be added via the optional tiers.
