secscan-ai 0.1.0

AI Security QA for web and mobile: correlates scanner output into real attack paths and one answer — Safe to Deploy, Deploy with Warnings, or Do Not Deploy.

secscan

Two on-demand security scanners that wrap trusted open-source tools and produce a single, shareable HTML report (plus a JSON sibling for automation):

• websec — website security (for sites you build and deliver to clients)
• iossec — iOS app security (source and compiled .ipa)

Each finding, whatever tool produced it, is normalized to one schema and one severity scale (critical → info). If a scanner isn't installed, it's reported as a coverage gap rather than silently skipped — a clean report only ever reflects the checks that actually ran.

---

Install

cd ~/Developer/secscan
./setup.sh          # fast tier: scanners via brew + pipx, then websec & iossec
./setup.sh --deep   # optional heavy tier: OWASP ZAP + MobSF server
websec --check-tools
iossec --check-tools

The fast tier needs neither Java nor Docker. The deep tier (--deep) adds OWASP ZAP (dynamic web scanning, needs Java) and the full MobSF server (deep iOS analysis, needs Docker). Both activate automatically once present and are skipped otherwise.

New to it? See USAGE.md for a step-by-step guide.

---

websec — websites

# Live site: TLS/SSL, security headers, nuclei misconfig/exposure checks
websec url https://haircutsbymn.eu

# Source tree: exposed API keys, SAST, vulnerable dependencies
websec source ./client-site

# Both, into one report
websec all --url https://haircutsbymn.eu --source ./client-site --out report.html

Check	Tool	Looks for
Secrets / API keys	gitleaks	Hardcoded keys, tokens, credentials
SAST	semgrep	XSS, injection, OWASP Top 10 patterns
Dependencies	osv-scanner	Known-vulnerable npm/pip/etc. packages
TLS/SSL	testssl.sh	Weak protocols/ciphers, cert problems
Headers	built-in	Missing HSTS/CSP/X-Frame-Options/etc.
Misconfig/exposure	nuclei	Exposed files, known CVEs, leaked keys in responses
Supabase keys	built-in	service_role key leaked in client code (critical)
Web server (optional)	nikto	Server misconfigurations
Dynamic scan (deep)	OWASP ZAP	Runtime XSS/injection/etc. via spider + active scan

Supabase RLS probe: websec supabase https://xxxx.supabase.co --key <anon-key> tests whether your tables are readable by the public anon key (i.e. Row-Level Security is off). Read-only. See USAGE.md.

⚠️ The URL scanners (nuclei, ZAP) and the Supabase probe reach out to the target. Only run them against properties you own or are contracted to deliver.

iossec — iOS

# Source tree
iossec source ./MyApp

# Compiled app
iossec ipa ./build/MyApp.ipa

# Both
iossec all --ipa ./MyApp.ipa --source ./MyApp

Check	Tool	Looks for
Static analysis	mobsfscan	Insecure storage, weak crypto, ATS misuse, unsafe APIs
SAST	semgrep	Mobile-specific insecure patterns
Flutter/Dart	built-in rules	Insecure HTTP, disabled TLS validation, secrets in SharedPreferences, unsafe WebView, service_role keys
Secrets / API keys	gitleaks	Hardcoded keys in source and shipped bundle
Dependencies	osv-scanner	Vulnerable CocoaPods / SPM packages
Info.plist	built-in (plistlib)	ATS disabled, file sharing, URL schemes, permissions
Entitlements	codesign	Debuggable release build (get-task-allow)
Binary hardening	otool / lipo	PIE/ASLR, stack canary, ARC, encryption, architectures
Deep analysis (deep)	MobSF server	Full static analysis via MobSF REST API (Docker)

---

Output

report.html — self-contained (inline CSS), color-coded by severity, collapsible findings, and a scanner-status strip showing what ran / was skipped. report.json — same data, machine-readable, written alongside for run-to-run diffing.

Exit code is 2 when any critical or high finding is present, so you can gate a delivery on a clean scan.

Scope

These are static / on-demand scanners. Runtime iOS analysis (Frida/objection, jailbroken-device instrumentation) and authenticated deep web crawls (full ZAP) are out of scope for the default build but can be added via the optional tiers.