har-security-scan

Scan a HAR file for common security issues and generate a clean, self-contained HTML report.

No external dependencies. Pure Node.js.

Install

npm install -g har-security-scan

Or run without installing:

npx har-security-scan capture.har

Usage

har-security-scan <input.har> [options]

Options:
  --output, -o <file>    Output file path (default: auto-generated)
  --fail-on <severity>   Exit code 1 if findings exist at this severity or above (high|medium|low)
  --help,   -h           Show this help

Basic scan

har-security-scan capture.har

Generates a report named <hostname>-<timestamp>-har-security-scan.html in the current directory.

Custom output path

har-security-scan capture.har --output report.html

CI gate

har-security-scan capture.har --fail-on high

Exits with code 1 if any High findings are present, making it suitable for CI pipelines.

What it checks

| Check | Severity | |---|---| | Sensitive parameter in URL (API key, token, password) | High | | Plain HTTP request (non-HTTPS) | High | | Verbose error response (stack trace, SQL error) | High | | JWT token in response body | High | | Personal data in URL (email, NRIC, phone) | High | | Mixed content (HTTP resources on HTTPS page) | Medium | | Cookie missing Secure flag | Medium | | Cookie missing HttpOnly flag | Medium | | Missing Content-Security-Policy header | Medium | | Missing Strict-Transport-Security header | Medium | | Missing X-Content-Type-Options header | Medium | | Missing X-Frame-Options header | Medium | | Cookie missing SameSite attribute | Low |

Each finding includes a description, evidence (exact URLs and values), and an inline remediation guide with code examples for Express.js, Nginx, Django, and Spring Boot.

How to export a HAR file

Chrome / Edge: DevTools (F12) > Network tab > right-click any request > Save all as HAR

Firefox: DevTools > Network tab > settings icon > Save all as HAR

Burp Suite: Proxy > HTTP history > select requests > right-click > Save as HAR

Report

The report is a single self-contained HTML file with no external dependencies. It includes:

• Summary with finding counts by severity
• Per-finding description, evidence list, and remediation guide
• Collapsible "More detail" with framework-specific code examples
• CI-friendly --fail-on exit code

See examples/sample-report.html for an example.

Examples

The examples/ directory contains:

• sample.har - a realistic HAR file that triggers all checks
• sample-report.html - the generated report from sample.har

Run it yourself:

har-security-scan examples/sample.har --output my-report.html

License

MIT. See LICENSE