pysentra

Local-first web application security scanning for authorized assessments, with a live vulnerability dashboard.

Authorization required — Use pysentra only against systems you own or have explicit written permission to test. It rate-limits requests, avoids destructive checks, and requires an authorization confirmation before scanning. The bundled demo application is intentionally vulnerable and must never be deployed as a real service.

This project was initially prototyped for Smart India Hackathon problem statement 26163 (NTRO) and has been hardened into a production-grade security auditing tool.

Privacy

pysentra makes no external network calls other than to the target you specify. No telemetry, no analytics, no data leaves your machine. All scan reports, logs, and artifacts are stored locally in the pysentra-reports/ directory.

Install

pip install pysentra

For local development, use pip install -e ".[dev]".

Quickstart

Run the intentionally vulnerable demo target in one terminal:

cd demo-vulnerable-app
pip install -r requirements.txt
python app.py

Then scan it from the project root:

pysentra scan http://localhost:5000 --i-am-authorized --target-is-test-app

The scanner writes report.json and a printable report.html under pysentra-reports/<timestamp>/, starts a dashboard securely bound to 127.0.0.1:8765, and opens it unless --no-open is used.

Dashboard

The dashboard has severity cards, a findings chart when Chart.js is available, filters, expandable evidence, and JSON/HTML export links.

CLI Reference

Architecture

The scanner orchestrates seven scope-area modules and sends every request through a rate-limited, audited request wrapper:

1. Authentication & Session Management (auth_checks)
2. Authorization & Access Control (authz_checks)
3. Input Validation & Data Handling (input_checks)
4. API Security (api_checks)
5. Client-Side Security Controls (client_side_checks)
6. Secure Communication Mechanisms (tls_checks)
7. Data Storage & Privacy Protections (storage_privacy_checks)

Findings include a CVSS 3.1 base score, evidence, reproduction request, impact, and remediation. The audit log is embedded in both report formats.

Contributing

See CONTRIBUTING.md. Do not add checks that could be destructive, credential-brute-force targets, or bypass the authorization and rate-limit safeguards.