klyrek-headers

HTTP security header analysis. Takes a single httpx.Response (as returned by klyrek-http/klyrek-crawler) and produces klyrek_core.models.Finding objects for missing or misconfigured security controls: HSTS, CSP, clickjacking protection, cookie flags (Secure/HttpOnly/SameSite), CORS misconfiguration, and information-disclosure headers (Server, X-Powered-By).

This is the first Klyrek module whose output is a Finding rather than just an Endpoint — everything upstream (klyrek-crawler) maps the application; this is where the tool starts telling you something is actually wrong.

from klyrek_headers.analyzer import analyze

response = client.get("https://target.com/")
findings = analyze(response)

for finding in findings:
    print(finding.severity, finding.title)

Findings are informational hints for a human reviewer to confirm, not proof of exploitability — e.g. a missing X-Frame-Options header is flagged even though modern CSP frame-ancestors may cover it, and a wildcard CORS origin is flagged even when browsers would reject the exact combination sent, because both patterns indicate configuration worth a second look.