Guardian

AI-powered security review plugin for pentesting web applications. Automated vulnerability scanning and remediation with zero configuration.

Features:

• Multi-framework support: NestJS, Rust, Vite/VoidZero, Express, Fastify, Django, Flask, FastAPI, Go, Spring Boot
• DDoS resistance testing: HTTP flood, Slowloris, connection exhaustion
• Stress testing: Memory leaks, response time benchmarks, CPU monitoring
• OWASP Top 10 2021: 100% coverage

Quick Start

Installation

# From your project directory
npx @oalacea/guardian

First run installs the security toolkit (~800 MB Docker image, takes 2-3 minutes).

Production Mode

For external security testing:

npx @oalacea/guardian https://example.com

Usage

After installation, open your AI coding agent and paste:

Read .guardian/REVIEW.md and start the security review

The AI will:

1. Auto-detect your framework, target URL, and environment
2. Ask for confirmation
3. Scan for vulnerabilities
4. Fix issues directly in your code (dev mode)
5. Verify each fix
6. Provide a summary

This task can take several minutes depending on the complexity of your application and the number of vulnerabilities found.

What You Need

• Docker — Install
• AI coding agent — Claude Code, Cursor, Windsurf, Aider, Codex...

Included Tools

The Docker toolkit includes:

| Category | Tools | |----------|-------| | Recon | nmap, subfinder, whatweb, httpx | | Vuln Scanning | nuclei, nikto | | Discovery | ffuf | | SQL Injection | sqlmap | | XSS | dalfox | | JWT | jwt_tool | | Brute Force | hydra | | SSL/TLS | testssl.sh | | DDoS/Stress | vegeta, hey, ab (Apache Bench), slowhttptest | | GraphQL | graphqlmap | | Rust Security | cargo-audit, cargo-deny | | Wordlists | SecLists (Web-Content, DNS, Fuzzing, SQLi, Passwords, DDoS) |

What It Tests

Framework-Specific

• NestJS: Guard bypass, pipe injection, GraphQL introspection, WebSocket auth, throttler bypass
• Rust: Unsafe blocks, integer overflow, Serde RCE, actix/axum vulnerabilities, cargo-audit
• Vite/VoidZero: HMR injection, source map leaks, dependency pre-bundling, env var leakage
• Node.js: Prototype pollution, ReDoS, dependency confusion

General Vulnerabilities

• Injection: SQLi, NoSQL, SSTI, XXE, LDAP, Command injection
• Cross-Site: XSS (reflected, stored, DOM), CSRF, CORS misconfig
• Server-Side: SSRF, deserialization, path traversal, file upload
• Auth: Authentication bypass, privilege escalation, IDOR, JWT manipulation
• Logic: Mass assignment, business logic flaws, race conditions
• Infrastructure: Subdomain takeover, missing headers, info disclosure
• DoS: ReDoS, GraphQL deep nesting, HTTP flood, Slowloris, connection exhaustion
• DDoS: Rate limit bypass, connection pool exhaustion, slow attacks
• Stress: Memory leaks, response time benchmarks, CPU usage, error rates

OWASP Top 10 2021

• 100% coverage including insecure design, vulnerable components, and logging failures

Safety

• Always test against dev/staging first
• Never test production without written authorization
• Backup your code (use git)
• Production mode uses non-destructive tests only

Troubleshooting

Rebuild toolkit image

docker rm -f guardian-tools
docker rmi guardian-tools
npx @oalacea/guardian

Test tools manually

docker exec guardian-tools nmap --version
docker exec guardian-tools sqlmap --version

License

MIT — Use at your own risk. Only test systems you own or have explicit permission to test.

Credits

Inspired by nicefox-secu and AIDA.