nord-sec 🛡️

A high-speed, full-featured web security CLI — passive scanning, SCA, secret hunting, WAF fingerprinting, subdomain takeover, WebSocket auditing, cache poisoning detection, JS deobfuscation, misconfiguration scanning, access control testing, cryptographic failure detection, injection scanning, insecure design analysis, authentication failure detection, supply chain auditing, software integrity checks, robots.txt and sitemap.xml audits, MFA bypass auditing, brute-force protection testing, password reset flow auditing, hidden admin path discovery, NPM package auditing, live terminal progress tracking, technology fingerprinting, quick scan mode, safe mode, and interactive HTML reports.

nord-sec is a lightweight, pure JavaScript security CLI built on undici and cheerio. It covers the full spectrum from safe passive header inspection to software composition analysis, secret detection, WAF fingerprinting, deep subdomain takeover enumeration, WebSocket vulnerability scanning, web cache poisoning, JavaScript deobfuscation, security misconfiguration auditing, broken access control detection, cryptographic failure scanning, multi-vector injection testing, insecure design pattern analysis, authentication failure detection (MFA bypass, brute-force protection, password reset tampering), admin path discovery, NPM dependency auditing, supply chain auditing, software integrity checks, robots.txt and sitemap.xml audits, quick scan and safe mode profiles, and live batch progress tracking — all in a single zero-install tool.

✨ Feature Overview

| Module | Flag | Description | |---|---|---| | 🔍 Passive Security Scanner | (always on) | Evaluates core security headers (CSP, HSTS), server technology disclosures, and unsafe DOM sinks. | | 📦 Software Composition Analysis | --sca | Detects outdated and vulnerable frontend JS libraries (jQuery, React, Vue, Bootstrap, AngularJS). | | 🔑 Secret & API Key Hunter | --secrets | Scans HTML and JS bundles for exposed API keys, tokens, and credentials (AWS, Stripe, GitHub, Slack, etc.). | | 🛡️ WAF Fingerprinting | --waf | Probes targets with controlled vectors to identify Web Application Firewalls (Cloudflare, AWS WAF, Akamai, Imperva, etc.). | | 🌐 Subdomain Takeover (basic) | --subdomains | Resolves CNAME records and flags dangling DNS entries pointing to unclaimed cloud infrastructure. | | 🕳️ Deep Subdomain Takeover | --takeover | Enumerates 70+ subdomain candidates, walks full CNAME chains, checks NS/MX records, and fingerprints 16 cloud providers. | | 🔌 WebSocket Scanner | --websocket | Tests WebSocket endpoints for CSWSH and frame-level injection (SQLi, XSS, path traversal). | | 💉 Cache Poisoning Prober | --cache-poison | Injects 14 unkeyed headers to detect CDN poisoning and audits Cache-Control misconfigurations. | | 🔬 JS Deobfuscator | --ai-deobfuscate | Decodes hex/unicode-escaped JS bundles and surfaces hidden internal API routes and debug flags. | | ⚙️ Misconfiguration Scanner | --misconfig | Audits cookies, CORS policies, and defensive headers for dangerous misconfigurations. | | 🔓 Access Control Scanner | --access-control / --bac | Probes privileged endpoints, tests HTTP method tampering, and flags IDOR patterns (OWASP A01:2025). | | 🔐 Cryptographic Failures Scanner | --crypto | Audits TLS, certificate validity, key strength, HSTS, mixed content, and exposed key files (OWASP A02:2021). | | 🧪 Injection Scanner | --injection / --inject | Probes for SQLi, XSS, CMDi, SSTI, LDAP, XPath, CRLF, LFI, and DOM sinks (OWASP A05:2025). | | 🏗️ Insecure Design Scanner | --insecure-design / --design | Detects missing rate limiting, absent anti-CSRF tokens, and exposed API documentation (OWASP A04:2021). | | 🔑 Auth Failures Scanner | --auth / --auth-failures | Probes login endpoints, lockout controls, user enumeration, MFA bypass, session fixation, and JWT exposure (OWASP A07:2025). | | ⚡ Exceptional Conditions Scanner | --exceptional / --except | Tests boundary inputs, debug endpoints, malformed methods, oversized bodies, and error disclosure (OWASP A10:2025). | | 📋 Logging Failures Scanner | --logging / --log-failures | Audits for missing security event logging and alerting controls (OWASP A09:2025). | | 🔗 Supply Chain Scanner | --supply-chain / --ssc | Detects software supply chain risks in frontend dependencies (OWASP A03:2025). | | 🔏 Integrity Failures Scanner | --integrity / --a08 | Checks for missing Subresource Integrity (SRI) and unsafe deserialization patterns (OWASP A08:2025). | | 🛡️ MFA Bypass Audit | --mfa-bypass / --mfa-audit | Tests 2FA/MFA flows for OTP replay, weak codes, backup code brute-force, device trust bypass, and session fixation (OWASP A07:2025). | | 🔐 Brute-Force Protection Audit | --brute-force / --brute-force-audit | Tests login endpoints for rate limiting, account lockout, CAPTCHA challenges, IP blocking, and progressive delays (OWASP A07:2025). | | 🔄 Password Reset Tampering Audit | --password-reset / --password-reset-audit | Audits reset flows for token prediction, replay, username enumeration, host header injection, and rate limiting (OWASP A07:2025). | | 🚫 Hidden Admin Path Discovery | --admin-discovery / --admin-paths | Enumerates 170+ admin/management paths (WordPress, Django, Laravel, Grafana, Actuator, phpMyAdmin, etc.) with signature-based verification. | | 📦 NPM Package Audit | --npm-audit / --sca-npm | Runs npm audit --json locally to detect vulnerable dependencies in package.json with severity mapping and CVE/CWE extraction. | | ⚡ Quick Scan | --quick | Essential passive security checks under 10 seconds — tech fingerprint + header analysis only. | | 🛡️ Safe Mode | --safe | Conservative scan profile — skips all active/exploitative probing while keeping passive checks. | | Technology Fingerprinting | --tech-detect | Detects framework/CMS/plugin versions, hosting/cloud, CDN/WAF headers, auth providers, gateways/proxies, DB error strings, bundlers, SSGs, and frontend libraries. | | 🧭 Robots.txt Audit | --robots | Checks for missing robots files, crawl policy gaps, and sensitive paths disclosed in site crawl rules. | | 🗺️ Sitemap.xml Audit | --sitemap | Finds sitemap.xml and sitemap_index.xml, checks for empty/invalid XML, and flags sensitive URLs in the index. | | 📺 Live Terminal Progress Bar | (batch mode) | Shows per-URL status, findings count so far, elapsed time, and completion progress during CSV scans. | | 🕷️ Recursive Web Crawler | --crawl <depth> | Discovers internal links via BFS and scales scans across deep sub-routes. | | 🚀 Concurrency Pool | -t <threads> | High-performance async execution with configurable thread limits (max 10) for batch CSV scanning. | | 📊 HTML Reporting | (always on) | Generates comprehensive tabbed HTML reports with findings, severities, and remediation context. |

🚀 Quick Start

No installation needed — run instantly with npx:

# Single URL (minimal)
npx nord-sec -u https://example.com

# Positional shorthand
npx nord-sec https://example.com

# Full audit with every module enabled
npx nord-sec -u https://example.com \
  --sca --secrets --waf --subdomains --takeover \
  --websocket --cache-poison --ai-deobfuscate \
  --misconfig --bac --crypto --injection \
  --insecure-design --auth --exceptional \
  --logging --supply-chain --integrity \
  --mfa-bypass --brute-force --password-reset \
  --admin-discovery --npm-audit \
  --crawl 2 -r report.html

# Quick scan (under 10 seconds)
npx nord-sec -u https://example.com --quick

# Safe mode (passive only, skips aggressive tests)
npx nord-sec -u https://example.com --safe

# Batch scan from CSV
npx nord-sec --csv targets.csv -t 5 --report audit.html

🚀 Quick Scan & Safe Mode Examples

In multi-target runs, nord-sec shows a live spinner/progress display with:

• per-URL status
• number of findings collected so far
• elapsed time since scan start
• completion progress across the batch

This makes large CSV scans easier to monitor without changing the underlying scan workflow.

📄 CSV Format

When using --csv, nord-sec reads the first column. It automatically skips empty lines and any header row named url.

url
https://example.com
https://demo.guru99.com/telecom/index.html
https://httpbin.org

🛠️ Passive Scan — Always-On Findings

Every scan runs the passive scanner automatically, checking for:

| Finding ID | Name | Severity | |---|---|---| | MISSING_CSP | Missing Content-Security-Policy | 🔴 HIGH | | MISSING_HSTS | Missing HSTS Header | 🟡 MEDIUM | | TECH_BANNER_LEAK | Server Technology Disclosure | 🔵 LOW | | UNSAFE_DOM_SINK | Unsafe DOM Sink (innerHTML, document.write) | 🟡 MEDIUM | | (mixed content) | Insecure Form Submission over HTTP | 🔴 HIGH |

Passive-only guarantee: no exploit payloads are sent in passive mode. All checks are based solely on what the server voluntarily returns.

📦 Software Composition Analysis (--sca)

Detects outdated and vulnerable frontend JavaScript libraries by inspecting script filenames and source signatures.

Detected libraries: jQuery, React, Vue.js, Bootstrap, AngularJS

npx nord-sec -u https://example.com --sca

🔑 Secret & API Key Hunter (--secrets)

Scans HTML documents and inline/external JS bundles using regex signatures to surface exposed credentials.

Detected types: AWS Access Key IDs, Stripe Secret Keys, Google API Keys, GitHub Personal Access Tokens, Slack Tokens, RSA Private Keys, Twilio API Keys, Mailgun API Keys

npx nord-sec -u https://example.com --secrets

🛡️ WAF Fingerprinting (--waf)

Probes with controlled security vectors and analyses response headers, status codes, and body signatures to identify Web Application Firewalls.

Detected WAFs: Cloudflare, AWS WAF / CloudFront, Akamai, Imperva / Incapsula, F5 BIG-IP, ModSecurity, Sucuri

npx nord-sec -u https://example.com --waf

🌐 Subdomain Takeover (--subdomains)

Resolves CNAME records and flags dangling DNS entries pointing to unclaimed cloud infrastructure.

Checked providers: AWS S3, GitHub Pages, Heroku, Azure, Shopify, Fastly, Pantheon

npx nord-sec -u https://example.com --subdomains

🕳️ Deep Subdomain Takeover Scanner (--takeover)

Goes further than --subdomains with active enumeration across four phases:

1. Subdomain Enumeration — 70-entry wordlist + live NS and MX records from the root domain
2. CNAME Chain Walking — Resolves the full chain to its terminal target for every live host
3. NXDOMAIN Detection — Flags stale DNS records an attacker could re-register
4. Cloud Provider Fingerprinting — Matches CNAMEs against 16 providers and HTTP-probes for unclaimed error pages

Extended provider coverage: All --subdomains providers, plus Netlify, Vercel, Surge.sh, WP Engine, Ghost (Pro), HubSpot, Tumblr, Zendesk, Bitbucket, Cargo Collective, Strikingly, Webflow, Squarespace, Fly.io, and Render

| Finding | Severity | |---|---| | Confirmed Subdomain Takeover | 🔴 CRITICAL | | Dangling CNAME — Unreachable Cloud Endpoint | 🟡 MEDIUM | | NXDOMAIN Subdomain (stale DNS entry) | 🔵 LOW |

--takeover is a superset of --subdomains. Running both is valid but redundant.

npx nord-sec -u https://example.com --takeover

🔌 WebSocket Vulnerability Scanner (--websocket / -w)

Probes common WebSocket endpoints and runs two test classes:

1. CSWSH — Attempts a handshake with a forged Origin: https://evil-attacker.com header
2. Frame Injection — Sends SQLi, XSS, and path traversal payloads and inspects server responses for reflected payloads, database errors, or stack traces

Probed endpoints: /, /ws, /socket.io/?EIO=4&transport=websocket

npx nord-sec -u https://example.com --websocket
npx nord-sec -u https://example.com -w

💉 Cache Poisoning Prober (--cache-poison)

Injects 14 unkeyed HTTP request headers and checks for reflection in responses. Confirms live poisoned cache entries served to real users.

Headers tested:

| Category | Headers | |---|---| | Host override | X-Forwarded-Host, X-Host, X-Forwarded-Server, X-Original-Host, Forwarded | | Scheme / port | X-Forwarded-Scheme, X-Forwarded-Proto, X-Forwarded-Port | | IP spoofing | X-Forwarded-For, X-Real-IP, True-Client-IP | | Path override | X-Original-URL, X-Rewrite-URL, X-Override-URL, X-Forwarded-Prefix |

| Finding | Severity | |---|---| | Confirmed poisoned cache entry | 🔴 CRITICAL | | Unkeyed header reflected — cacheability unconfirmed | 🔴 HIGH | | Public response missing Vary: Cookie / Authorization | 🟡 MEDIUM | | Inconsistent Pragma vs Cache-Control | 🔵 LOW | | No cache directives present | 🔵 LOW |

npx nord-sec -u https://example.com --cache-poison

🔬 JS Deobfuscator & Semantic Analyzer (--ai-deobfuscate)

Fetches and decodes the top 5 external JS bundles, then performs semantic analysis to surface hidden information.

Deobfuscation pipeline: hex escapes (\x41 → A), unicode escapes (\u0041 → A), string concatenation collapse ("/ap" + "i/v1" → "/api/v1")

Semantic checks:

• Internal Route Discovery — API and admin URL patterns embedded in frontend routers or axios configs
• Debug & Admin Flag Detection — Active boolean assignments like debug: true, testMode: true, adminOverride: true

Performs static analysis only — no code is executed. The --ai-deobfuscate name reflects the intelligence of the analysis, not a dependency on an external AI API.

npx nord-sec -u https://example.com --ai-deobfuscate

⚙️ Misconfiguration Scanner (--misconfig)

Audits three categories of security misconfiguration:

• Cookie Security — Flags missing HttpOnly, Secure, and SameSite attributes
• Permissive CORS — Detects Access-Control-Allow-Origin: * combined with Access-Control-Allow-Credentials: true
• Defensive Headers — Flags missing X-Content-Type-Options, X-Frame-Options / CSP frame-ancestors, and Referrer-Policy

npx nord-sec -u https://example.com --misconfig

🔓 Access Control Scanner (--access-control / --bac)

Aligned with OWASP A01:2025 (Broken Access Control):

• Privileged Endpoint Exposure — Probes /admin, /administrator, /server-status, /api/v1/users, /config, /actuator/env, and more for unauthenticated 200 OK responses
• HTTP Method Tampering — Tests PUT and DELETE verbs to detect authorization bypass
• IDOR Detection — Scans query parameters for sequential numeric identifiers (?user_id=102, ?id=45)

npx nord-sec -u https://example.com --bac
npx nord-sec -u https://example.com --access-control

🔐 Cryptographic Failures Scanner (--crypto)

Aligned with OWASP A02:2021 (Cryptographic Failures):

| Finding ID | Name | Severity | |---|---|---| | CRYPTO_EXPOSED_PRIVATE_KEY | Exposed Private Key or Cryptographic Secret | 🔴 CRITICAL | | CRYPTO_DEPRECATED_TLS | Deprecated TLS Protocol Version (TLS 1.0/1.1) | 🔴 HIGH | | CRYPTO_EXPIRED_CERT | Expired SSL/TLS Certificate | 🔴 HIGH | | CRYPTO_WEAK_KEY_LENGTH | Weak Public Key Length (RSA < 2048-bit) | 🔴 HIGH | | CRYPTO_UNENCRYPTED_HTTP | Unencrypted Transport Protocol (HTTP) | 🔴 HIGH | | CRYPTO_INSECURE_FORM_ACTION | Insecure Form Submission Target | 🔴 HIGH | | CRYPTO_WEAK_SIG_ALG | Weak Certificate Signature Algorithm (MD5/SHA-1) | 🟡 MEDIUM | | CRYPTO_MISSING_HSTS | Missing HTTP Strict Transport Security | 🟡 MEDIUM | | CRYPTO_MIXED_CONTENT | Insecure Mixed Content Detected | 🟡 MEDIUM | | CRYPTO_SENSITIVE_DATA_IN_URL | Sensitive Cryptographic Token in URL Parameter | 🟡 MEDIUM | | CRYPTO_WEAK_HSTS | Weak HSTS Max-Age Policy (< 182 days) | 🔵 LOW |

Probed key file paths: /.env, /server.key, /private.key, /id_rsa

npx nord-sec -u https://example.com --crypto

🧪 Injection Scanner (--injection / --inject)

Aligned with OWASP A05:2025 (Injection). Tests URL parameters, POST form fields, and inline DOM sources.

Attack classes:

| Finding ID | Name | Severity | |---|---|---| | INJECT_SQLI_ERROR | SQL Injection — Error-Based | 🔴 CRITICAL | | INJECT_SQLI_POST | SQL Injection via POST Form | 🔴 CRITICAL | | INJECT_CMD | OS Command Injection | 🔴 CRITICAL | | INJECT_SSTI | Server-Side Template Injection | 🔴 CRITICAL | | INJECT_LFI | Local File Inclusion / Path Traversal | 🔴 CRITICAL | | INJECT_RXSS | Reflected XSS — URL Parameter | 🔴 HIGH | | INJECT_RXSS_POST | Reflected XSS via POST Form | 🔴 HIGH | | INJECT_LDAP | LDAP Injection | 🔴 HIGH | | INJECT_XPATH | XML / XPath Injection | 🔴 HIGH | | INJECT_CRLF | HTTP Header Injection / CRLF Splitting | 🔴 HIGH | | INJECT_DOM_ATTR_REFLECTION | URL Parameter Reflected in Event Handler | 🔴 HIGH | | INJECT_DOM_SINK | Dangerous DOM Sink Execution Pattern | 🔴 HIGH | | INJECT_PLAINTEXT_POST | Form Data Submitted Over Plaintext HTTP | 🔴 HIGH |

Coverage per class:

• SQLi — 10 payloads covering error-based, boolean-blind, time-blind, UNION, and stacked queries; detects MySQL, PostgreSQL, SQLite, MSSQL, Oracle, ODBC errors
• XSS — 6 payloads: bare tag, attribute-break, img onerror, javascript: protocol, SVG onload
• CMDi — 7 payloads using ;, |, backtick, subshell, and && patterns; detects id, echo markers, /etc/passwd
• SSTI — 6 payloads targeting Jinja2, Twig, Freemarker, EL/SpEL, ERB, EJS, Ruby, Pebble, Thymeleaf
• LDAP — 4 payloads with wildcard bypass and filter manipulation; detects LDAPException, ldap_bind
• XPath — 5 payloads with tautologies, comment injection, XXE DOCTYPE probes; detects XPathException, libxml
• CRLF — 3 payloads; confirms via injected X-Injected-Header appearing as a real response header
• LFI — 6 payloads covering Unix/Windows traversal, URL-encoded variants, double-slash bypass, PHP wrappers
• DOM Sink Analysis — Passive inspection for event-handler reflections and dangerous sink patterns

npx nord-sec -u "https://example.com/search?q=test" --injection
npx nord-sec -u "https://example.com/search?q=test" --inject

For best results, provide a URL with query parameters. POST forms are auto-discovered regardless.

🏗️ Insecure Design Scanner (--insecure-design / --design)

Aligned with OWASP A04:2021 (Insecure Design):

| Finding ID | Name | Severity | |---|---|---| | DESIGN_MISSING_CSRF_TOKEN | Form Missing Anti-CSRF Token | 🔴 HIGH | | DESIGN_MISSING_RATE_LIMIT_HEADERS | Missing Rate Limiting Controls | 🟡 MEDIUM | | DESIGN_EXPOSED_API_DOCS | Publicly Accessible API Specifications | 🔵 LOW |

Probed API documentation paths: /swagger-ui.html, /swagger-ui/index.html, /v2/api-docs, /v3/api-docs, /openapi.json, /api/docs, /graphiql

Anti-CSRF detection checks POST, PUT, DELETE, and PATCH forms for hidden fields matching csrf, token, xsrf, or _token.

npx nord-sec -u https://example.com --insecure-design
npx nord-sec -u https://example.com --design

🔑 Authentication Failures Scanner (--auth / --auth-failures)

Aligned with OWASP A07:2025 (Authentication Failures). Probes login endpoints for lockout controls, user enumeration, MFA bypass, session fixation, and exposed JWT tokens.

npx nord-sec -u https://example.com --auth
npx nord-sec -u https://example.com --auth-failures

⚡ Exceptional Conditions Scanner (--exceptional / --except)

Aligned with OWASP A10:2025 (Mishandling of Exceptional Conditions). Tests boundary inputs, debug endpoints, malformed HTTP methods, oversized bodies, and error disclosure.

Checks include:

• Boundary value inputs (empty strings, max-length integers, null bytes)
• Debug and diagnostic endpoint exposure
• Malformed Content-Type and method handling
• Oversized request body behaviour (500 responses, stack traces)
• Deep JSON nesting (200 levels) to probe async parser limits

| Finding | Severity | |---|---| | EXCEPT_DEEP_JSON_EXCEPTION | Unhandled Exception on Deep-Nested JSON Body | 🔴 HIGH | | EXCEPT_DEEP_JSON_500 | HTTP 500 on Deep-Nested JSON Body | 🟡 MEDIUM |

npx nord-sec -u https://example.com --exceptional
npx nord-sec -u https://example.com --except

📋 Logging Failures Scanner (--logging / --log-failures)

Aligned with OWASP A09:2025 (Security Logging & Alerting Failures). Audits for the absence of security event logging signals and alerting controls that would allow attacks to go undetected.

npx nord-sec -u https://example.com --logging
npx nord-sec -u https://example.com --log-failures

🔗 Supply Chain Scanner (--supply-chain / --ssc)

Aligned with OWASP A03:2025 (Software Supply Chain Failures). Detects risky frontend dependency patterns including use of unpinned CDN scripts, unverified third-party libraries, and packages with known supply chain compromise indicators.

npx nord-sec -u https://example.com --supply-chain
npx nord-sec -u https://example.com --ssc

🔏 Integrity Failures Scanner (--integrity / --a08)

Aligned with OWASP A08:2025 (Software & Data Integrity Failures). Checks for missing Subresource Integrity (SRI) attributes on external scripts and stylesheets, and scans for unsafe deserialization patterns in inline JavaScript.

npx nord-sec -u https://example.com --integrity
npx nord-sec -u https://example.com --a08

🛡️ MFA Bypass Audit (--mfa-bypass / --mfa-audit)

Aligned with OWASP A07:2025 (Authentication Failures). Audits Multi-Factor Authentication flows for common bypass vectors that rule-based scanners often miss.

What it checks:

| Finding ID | Name | Severity | |---|---|---| | MFA_OTP_REPLAY_ALLOWED | OTP/TOTP Replay Attack Possible | 🔴 CRITICAL | | MFA_OTP_REPLAY_AFTER_FAILURE | OTP Accepted After Initial Failure | 🔴 HIGH | | MFA_WEAK_OTP_ACCEPTED | Weak/Predictable OTP Accepted | 🔴 CRITICAL | | MFA_RATE_LIMIT_ACTIVE | Rate Limiting on 2FA Endpoint | 🔵 INFO | | MFA_NO_RATE_LIMIT | No Rate Limiting on 2FA Endpoint | 🔴 HIGH | | MFA_WEAK_BACKUP_CODE | Weak Backup/Recovery Code Accepted | 🔴 CRITICAL | | MFA_BACKUP_CODE_NO_RATE_LIMIT | No Rate Limiting on Backup Code Endpoint | 🔴 HIGH | | MFA_TRUST_DEVICE_BYPASS | "Trust Device" Accessible Without MFA | 🔴 HIGH | | MFA_TRUST_COOKIE_NO_HTTPONLY | Trusted Device Cookie Missing HttpOnly | 🟡 MEDIUM | | MFA_TRUST_COOKIE_NO_SECURE | Trusted Device Cookie Missing Secure | 🟡 MEDIUM | | MFA_TRUST_COOKIE_NO_SAMESITE | Trusted Device Cookie Missing SameSite | 🔵 LOW | | MFA_SESSION_FIXATION | Session ID Not Rotated After MFA | 🔴 HIGH | | MFA_SMS_RESEND_NO_RATE_LIMIT | SMS/Email OTP Resend Not Rate Limited | 🟡 MEDIUM | | MFA_SMS_OTP_OVER_HTTP | SMS/Email OTP Endpoint Over HTTP | 🔴 HIGH |

How it works:

1. Discovers login endpoints and associated 2FA/MFA verification endpoints (TOTP, SMS, email, push, backup codes)
2. Tests OTP replay by submitting the same code twice — a valid code must be single-use
3. Fuzzes 14 common weak codes (000000, 123456, qwerty, etc.) to check for weak OTP acceptance
4. Fires 10 rapid verification attempts to detect rate limiting on 2FA endpoints
5. Tests backup/recovery code endpoints with 10 common weak codes
6. Probes "trust this device" functionality for cookie security and bypass potential
7. Verifies session ID rotation after successful MFA challenge
8. Checks SMS/email OTP resend rate limiting and HTTPS enforcement

npx nord-sec -u https://example.com --mfa-bypass
npx nord-sec -u https://example.com --mfa-audit

🔐 Brute-Force Protection Audit (--brute-force / --brute-force-audit)

Aligned with OWASP A07:2025 (Authentication Failures). Comprehensively tests login endpoints for the presence (or absence) of brute-force mitigations.

What it checks:

| Finding ID | Name | Severity | |---|---|---| | BRUTE_RATE_LIMIT_ACTIVE | Rate Limiting Detected on Login Endpoint | 🔵 INFO | | BRUTE_NO_RATE_LIMIT | No Rate Limiting on Login Endpoint | 🔴 HIGH | | BRUTE_ACCOUNT_LOCKOUT_ACTIVE | Account Lockout / Brute-Force Protection Active | 🔵 INFO | | BRUTE_NO_ACCOUNT_LOCKOUT | No Account Lockout After Repeated Failed Logins | 🔴 HIGH | | BRUTE_CAPTCHA_CHALLENGE | CAPTCHA / Challenge Detected After Failed Attempts | 🔵 INFO | | BRUTE_NO_CAPTCHA | No CAPTCHA / Challenge After Repeated Failed Logins | 🟡 MEDIUM | | BRUTE_PROGRESSIVE_DELAY | Progressive Delay / Exponential Backoff Detected | 🔵 INFO | | BRUTE_NO_PROGRESSIVE_DELAY | No Progressive Delay / Exponential Backoff | 🔵 LOW | | BRUTE_IP_BLOCKING_ACTIVE | IP-Based Blocking / WAF Protection Detected | 🔵 INFO | | BRUTE_NO_IP_BLOCKING | No IP-Based Rate Limiting / Blocking Detected | 🟡 MEDIUM | | BRUTE_CAPTCHA_ON_LOGIN_PAGE | CAPTCHA Present on Login Page | 🔵 INFO | | BRUTE_REMEMBER_ME_DETECTED | "Remember Me" Functionality Detected | 🔵 LOW | | BRUTE_LOGIN_NO_CSRF | Login Form Missing CSRF Token | 🟡 MEDIUM | | BRUTE_USERNAME_ENUMERATION | Username Enumeration via Differential Responses | 🟡 MEDIUM |

How it works:

1. Discovers login endpoints via common path probing and form detection
2. Fires 8 rapid requests to detect HTTP 429 / rate-limit headers (Retry-After, X-RateLimit-*)
3. Attempts 10 consecutive failed logins with a known username to trigger account lockout (checks for 423/429 or lockout messages)
4. Attempts 8 failed logins to detect CAPTCHA challenges in responses and headers
5. Measures response times across 6 sequential failures to detect progressive delay (2x slowdown threshold)
6. Simulates 10 distinct client IPs via X-Forwarded-For to test IP-based blocking
7. Parses login page for CAPTCHA elements, "remember me" checkboxes, and CSRF tokens
8. Compares responses for valid vs. bogus usernames to detect enumeration via status/body/timing differences

npx nord-sec -u https://example.com --brute-force
npx nord-sec -u https://example.com --brute-force-audit

🔄 Password Reset Flow Tampering Audit (--password-reset / --password-reset-audit)

Aligned with OWASP A07:2025 (Authentication Failures). Audits password reset functionality for tampering vulnerabilities that could allow account takeover.

What it checks:

| Finding ID | Name | Severity | |---|---|---| | RESET_USER_ENUMERATION | Username Enumeration via Password Reset Flow | 🟡 MEDIUM | | RESET_TOKEN_PREDICTABLE | Predictable Reset Token Accepted | 🔴 CRITICAL | | RESET_TOKEN_REPLAY_ALLOWED | Reset Token Replay Accepted | 🔴 CRITICAL | | RESET_TOKEN_REPLAY_AFTER_FAILURE | Reset Token Accepted After Initial Failure | 🔴 HIGH | | RESET_HOST_HEADER_REFLECTED | Reset Flow Reflects Host Header | 🔵 LOW | | RESET_RATE_LIMIT_ACTIVE | Rate Limiting Active on Password Reset Endpoint | 🔵 INFO | | RESET_NO_RATE_LIMIT | No Rate Limiting on Password Reset Endpoint | 🔴 HIGH |

How it works:

1. Discovers password reset endpoints via 30+ common paths (/forgot-password, /api/auth/reset, etc.)
2. Compares responses for existing vs. non-existent users to detect enumeration (status code, body length, timing)
3. Tests 10 common weak tokens (123456, password, admin, etc.) against the reset endpoint
4. Submits the same token twice to test replay protection
5. Probes Host header injection by sending a malicious Host header and checking for reflection
6. Fires 10 rapid reset requests to verify rate limiting

npx nord-sec -u https://example.com --password-reset
npx nord-sec -u https://example.com --password-reset-audit

🚫 Hidden Admin Path Discovery (--admin-discovery / --admin-paths)

Discovers hidden administrative interfaces, management consoles, monitoring dashboards, and sensitive endpoints across 170+ common paths with signature-based verification to minimize false positives.

Covered categories:

| Category | Examples | |---|---| | CMS Admin | /wp-admin, /administrator, /umbraco, /typo3, /concrete5 | | E-commerce | /shop/admin, /magento/admin, /prestashop/admin, /opencart/admin | | Frameworks | /rails/admin, /django-admin, /admincp, /modcp | | Monitoring | /grafana, /kibana, /prometheus, /metrics, /actuator/* | | Database | /phpmyadmin, /adminer, /pma, /mysql | | API Docs | /swagger, /swagger-ui, /v3/api-docs, /graphiql, /graphql | | Debug | /debug, /_profiler, /__debugbar, /telescope, /horizon | | Config/Secrets | /.env, /.env.local, /config, /settings.php | | VCS/Backup | /.git, /.svn, /backup, /dumps | | Cloud/Container | /.well-known/security.txt, /healthz, /readyz |

Verification logic: Each discovered path is verified against 13 signature patterns (admin titles, login forms, framework keywords) to confirm it's a genuine admin/management interface rather than a generic 404 page.

Severity tiers:

• 🔴 CRITICAL — Exposed sensitive files (.env, .git/config, wp-config.php)
• 🔴 HIGH — Exposed monitoring (Grafana, Kibana, Prometheus), phpMyAdmin, Actuator endpoints
• 🟡 MEDIUM — Custom admin panels, API documentation, debug endpoints
• 🔵 LOW — Generic accessible paths without clear admin signatures
• 🔵 INFO — Protected paths returning 401/403 (confirms existence without access)

npx nord-sec -u https://example.com --admin-discovery
npx nord-sec -u https://example.com --admin-paths

📦 NPM Package Audit (--npm-audit / --sca-npm)

Runs npm audit --json locally against the project's package.json and package-lock.json, mapping the output to nord-sec's finding format with severity remapping and CVE/CWE enrichment.

What it reports:

| Finding ID | Name | Severity | |---|---|---| | NPM_AUDIT_<vulnId> | Vulnerable NPM Dependency: <package> | Mapped from npm severity | | NPM_AUDIT_SUMMARY | NPM Audit Summary | Based on highest severity found |

What it extracts:

• Package name and vulnerable version
• Vulnerability ID and title
• CVE identifiers (when available)
• CWE classification (when available)
• Advisory URL
• Total counts by severity (critical/high/moderate/low)
• Total dependencies scanned

Notes:

• Runs entirely locally — no external API calls
• Requires package.json and npm in PATH
• Severity mapping: critical→CRITICAL, high→HIGH, moderate→MEDIUM, low→LOW, info→INFO
• Non-fatal — if npm audit fails, the scan continues with a warning

npx nord-sec --npm-audit
npx nord-sec --sca-npm

⚡ Quick Scan (--quick)

A minimal, ultra-fast security assessment that completes in under 10 seconds by running only essential passive checks.

What it runs:

• Passive security header analysis (CSP, HSTS, server banners, unsafe DOM sinks)
• Technology fingerprint detection (framework, CMS, hosting, CDN, auth, etc.)

What it skips:

• All active fuzzing, injection probing, and exploit payloads
• Subdomain takeover, WAF fingerprinting, secret hunting
• SCA, JS deobfuscation, WebSocket scanning
• Cache poisoning, cache misconfiguration, access control probing
• All OWASP-specific scanners (crypto, injection, insecure design, auth, etc.)
• AI Triage and AI Remediation
• PDF report generation (HTML report only)

Output: Standard report.html with only Quick Scan findings.

# Single URL quick scan (~5-8 seconds)
npx nord-sec -u https://example.com --quick

# Batch CSV quick scan
npx nord-sec --csv targets.csv --quick

# Compare with full scan (much longer)
npx nord-sec -u https://example.com  # Takes minutes

🛡️ Safe Mode (--safe)

A conservative scan profile that runs all passive checks but skips all active/exploitative probing to avoid triggering WAFs, account lockouts, rate limits, or application instability.

What it skips:

• Active fuzzing (--active) — SQLi, XSS, CMDi, SSTI, LFI, LDAP, XPath, CRLF, path traversal
• All injection payloads and exploit vectors
• Any test that sends malicious-looking requests

What it still runs:

• Passive security header analysis
• Technology fingerprinting
• Cookie/CORS/misconfiguration audits
• SSL/TLS certificate checks
• Robots.txt and sitemap.xml audits
• All other passive modules

# Safe mode — only passive checks
npx nord-sec -u https://example.com --safe

# Combined with other safe flags
npx nord-sec -u https://example.com --safe --admin-discovery --npm-audit

# Normal (aggressive) mode
npx nord-sec -u https://example.com  # Includes active fuzzing

Reviews the root robots.txt policy for crawl hygiene and operational exposure.

Checks include:

• missing or empty robots.txt
• no-disallow policy indicators
• sensitive paths inadvertently exposed in crawl directives
• sitemap references embedded in the file

npx nord-sec -u https://example.com --robots

🗺️ Sitemap.xml Audit (--sitemap)

Looks for sitemap discovery points and validates the index for accidental exposure or incomplete coverage.

Checks include:

• missing sitemap.xml or sitemap_index.xml
• empty or malformed XML
• potentially sensitive URLs in the sitemap index
• sitemap discovery and content validation for crawl hygiene

npx nord-sec -u https://example.com --sitemap

🕸️ Web Crawler (--crawl <depth>)

Enables a Breadth-First Search crawler for same-origin link discovery.

| Depth | Behaviour | |---|---| | 0 (default) | Scans only the provided URL | | 1 | Scans the target URL and all same-origin links found on it | | 2+ | Recursively crawls up to the specified depth |

• Same-origin scoped — only follows links on the same host
• De-duplicated — strips fragment anchors, skips visited URLs
• Structured reporting — each crawled path gets its own tab in the HTML report

npx nord-sec -u https://example.com --crawl 2
npx nord-sec --csv targets.csv --crawl 1 --report audit.html

🤖 AI Severity Re-Ranker (--ai-triage)

Aligned with real-world attacker thinking, the AI Triage module sends all scanner findings to a large language model via OpenRouter and re-evaluates severity based on cross-finding exploitability — something rule-based scanners fundamentally cannot do.

A CORS misconfiguration and an exposed JWT in isolation might each score MEDIUM. An attacker who chains them — forging a cross-origin request using the leaked token to hit an authenticated API endpoint — has a CRITICAL exploit. AI Triage catches that. It also works in reverse, de-escalating findings that look alarming on paper but are neutralised by compensating controls detected elsewhere in the scan.

What it produces:

• AI Risk Score (0–100) — an overall exploitability score for the target, separate from the rule-based finding counts, weighted by how chainable the findings are
• Exploit Chains — named attack paths that describe exactly how two or more findings combine into a real attack scenario, with the involved finding IDs listed
• Per-finding re-triage — every finding gets an AI-assigned severity alongside the original scanner severity, with a one-sentence reason for any change
• Escalations & de-escalations — printed to the terminal in colour so you can see at a glance what the AI upgraded or downgraded and why

How it handles large scans:

Findings are automatically batched into groups of 30 before being sent to the model. A scan with 104 findings becomes 4 API calls that are merged into one unified result — so token limits never cause a silent failure. If a single batch fails (API error or malformed model output), that batch passes findings through unchanged and the rest of the scan completes normally.

# Minimum — set key in environment, use default model
export OPENROUTER_API_KEY=sk-or-...
npx nord-sec -u https://example.com --misconfig --secrets --crypto --ai-triage

# Pass key inline and choose a specific model
npx nord-sec -u https://example.com --injection --bac --crypto --ai-triage \
  --ai-key sk-or-... \
  --ai-model google/gemini-2.0-flash-001

# Batch scan with AI triage across all targets
npx nord-sec --csv targets.csv -t 3 --misconfig --crypto --ai-triage --ai-key sk-or-...

Default model: nvidia/nemotron-3-ultra-550b-a55b:free (no cost, no OpenRouter credits required)

Any model available on OpenRouter can be substituted via --ai-model. Paid models such as anthropic/claude-sonnet-4-5 or google/gemini-2.0-flash-001 produce more consistent JSON output and tighter chain reasoning on complex scans.

| Flag | Description | |---|---| | --ai-triage | Enable AI severity re-ranking after all other scanners complete | | --ai-key <key> | OpenRouter API key (alternative to OPENROUTER_API_KEY env var) | | --ai-model <model> | OpenRouter model string to use (default: nvidia/nemotron-3-ultra-550b-a55b:free) |

AI Triage runs after every other enabled scanner on a given URL, so it always sees the complete picture before calling the model. It is non-fatal — if all API calls fail, the scan report is preserved exactly as the rule-based scanners produced it.

📊 AI Triage in the HTML Report

When --ai-triage is enabled, the HTML report is automatically upgraded beyond the standard findings table. Each scanned URL gets a dedicated AI Triage Panel above its findings, and the findings table gains a new AI Severity column — all rendered without affecting the layout of scans that ran without --ai-triage.

AI Triage Panel

The panel appears at the top of each URL's tab, above the findings table, and contains three sections:

AI Risk Score A circular badge displaying the 0–100 exploitability score and overall risk label assigned by the model. The badge is colour-coded by label — red for CRITICAL, orange for HIGH, yellow for MEDIUM, cyan for LOW, and grey for INFO — so the overall risk posture is readable at a glance without reading any text.

Summary A plain-English paragraph written by the model describing the overall risk posture of the target — what the most significant issues are, whether findings chain together, and what the immediate priorities are.

Exploit Chains A list of named attack paths identified by the model. Each chain card shows:

• The chain's severity (colour-coded left border)
• A slug identifier for the chain (e.g. cors-csp-xss-exfil)
• The finding IDs involved
• A one-sentence description of how the findings combine into a real attack

Chains are only rendered when the model identified at least one. If no chainable findings were found, this section is omitted.

AI Severity Column

The findings table gains a second severity column — 🤖 AI Severity — placed immediately after the original rule-based Severity column. Each row in this column shows:

| State | Display | |---|---| | AI agrees with scanner | Badge at original severity + ↔ confirmed in grey | | AI escalated severity | Badge at higher severity + ↑ from <original> in red | | AI de-escalated severity | Badge at lower severity + ↓ from <original> in cyan |

Hovering over the arrow indicator shows the model's one-sentence reason for the change as a tooltip — for example: "Chains with missing CSP to enable cross-origin data exfiltration."

The AI Severity column only appears on tabs where --ai-triage was active. Tabs from scans that ran without the flag render the standard 4-column table exactly as before — no layout shift, no empty column.

Report Behaviour Without --ai-triage

If --ai-triage was not passed, the report is completely unchanged:

• No AI Triage Panel is rendered
• No AI Severity column appears
• The findings table uses the standard 4-column layout (Severity, OWASP ID, Finding, Details)
• The empty-findings row spans the correct number of columns automatically

This means a single report.html can contain a mix of tabs — some with AI triage data and some without — and each tab renders correctly for its own context.

Severity Colour Reference

Both the AI Risk Score circle and the AI Severity badges follow the same colour scheme:

| Label | Colour | |---|---| | CRITICAL | Red — #ef4444 border, dark red background | | HIGH | Orange — #f97316 border, dark orange background | | MEDIUM | Yellow — #f59e0b border, dark amber background | | LOW | Cyan — #38bdf8 border, dark sky background | | INFO | Grey — #64748b border, slate background |

Example Output

┌─────────────────────────────────────────────────────────────────┐
│  🤖 AI Triage Result                                            │
│                                                                 │
│   ╭──────╮   The target presents two chained MEDIUM findings    │
│   │  82  │   that together constitute a HIGH-severity           │
│   │ HIGH │   cross-origin data exfiltration risk.               │
│   ╰──────╯   Immediate remediation of CSP and CORS is advised.  │
│                                                                 │
│  ⛓ Exploit Chains (1)                                          │
│  ┃ HIGH  cors-csp-xss-exfil                                     │
│  ┃ Findings: MISSING_CSP, CORS_WILDCARD                         │
│  ┃ Absence of CSP combined with a wildcard CORS policy allows   │
│  ┃ an attacker-controlled page to inject scripts and exfiltrate │
│  ┃ authenticated responses cross-origin.                        │
└─────────────────────────────────────────────────────────────────┘

 Severity  🤖 AI Severity     OWASP ID       Finding               Details
 ────────  ─────────────────  ─────────────  ────────────────────  ───────────────
 HIGH      CRITICAL           MISSING_CSP    Missing CSP Header    No CSP present…
           ↑ from HIGH
 MEDIUM    HIGH               CORS_WILDCARD  Permissive CORS       Allow-Origin: *
           ↑ from MEDIUM
 MEDIUM    MEDIUM             MISSING_HSTS   Missing HSTS Header   HSTS absent…
           ↔ confirmed

Full Scan Command

# Run all scanners + AI triage and open the enriched report
npx nord-sec -u https://example.com \
  --misconfig --secrets --crypto --injection --bac \
  --mfa-bypass --brute-force --password-reset \
  --admin-discovery --npm-audit \
  --ai-triage --ai-key sk-or-... \
  -r report.html

🚀 Concurrency Pool (--concurrency / -t)

Enables parallel scanning for batch CSV targets.

| Setting | Detail | |---|---| | Default | 1 — sequential | | Maximum | 10 — hard cap to prevent socket exhaustion |

npx nord-sec --csv targets.csv -t 5
npx nord-sec --csv targets.csv -t 5 --crawl 1 --report fast-audit.html

🔧 CLI Reference

Usage:
  npx nord-sec [url]         Scan a single URL (positional)
  npx nord-sec -u <url>      Scan a single URL (flag)
  npx nord-sec --csv <file>  Batch scan from a CSV file

| Flag | Alias | Description | |---|---|---| | --url | -u | Target URL to scan | | --csv | | Batch scan targets from a CSV file | | --report | -r | Output filename for HTML report (default: report.html) | | --pdf | | Output filename for executive PDF report with charts (optional) | | --crawl | | BFS crawler depth limit (default: 0) | | --sca | | Software Composition Analysis | | --secrets | | Secret & API Key Hunter | | --waf | | WAF fingerprinting | | --subdomains | | Basic CNAME & subdomain takeover check | | --takeover | | Deep subdomain enumeration across 16 cloud providers | | --websocket | -w | WebSocket vulnerability scanner | | --cache-poison | | Cache poisoning prober | | --ai-deobfuscate | | JS deobfuscator & semantic analyzer | | --misconfig | | Security misconfiguration scanner | | --access-control | --bac | Broken access control scanner | | --crypto | | Cryptographic failures scanner | | --injection | --inject | Injection scanner (SQLi, XSS, CMDi, SSTI, LDAP, XPath, CRLF, LFI) | | --insecure-design | --design | Insecure design scanner | | --auth | --auth-failures | Authentication failures scanner | | --exceptional | --except | Exceptional conditions scanner | | --logging | --log-failures | Security logging & alerting failures scanner | | --supply-chain | --ssc | Software supply chain failures scanner | | --integrity | --a08 | Software & data integrity failures scanner | | --tech-detect | | Passive technology fingerprinting for frameworks, CMS/plugins, hosting/cloud, CDN/WAF, auth, gateways, DB errors, bundlers, SSGs, and frontend library versions | | --mfa-bypass | --mfa-audit | MFA bypass audit (OTP replay, weak codes, backup codes, device trust) | | --brute-force | --brute-force-audit | Brute-force protection audit (rate limit, lockout, CAPTCHA, IP blocking) | | --password-reset | --password-reset-audit | Password reset tampering audit (token prediction, replay, enumeration) | | --admin-discovery | --admin-paths | Hidden admin path discovery (170+ paths, signature verified) | | --npm-audit | --sca-npm | NPM package audit (local npm audit --json) | | --quick | | Quick scan under 10s (passive headers + tech fingerprint only) | | --safe | | Safe mode — skips all active/exploitative probing | | --concurrency | -t | Concurrent thread pool size (max 10) |

📄 PDF Executive Report (--pdf <file.pdf>)

Every scan can additionally emit a self-contained executive PDF with native vector charts — no extra dependencies and no external binaries required. The HTML report is always generated as before; the PDF is produced in parallel from the same findings.

npx nord-sec -u https://example.com --misconfig --secrets --pdf exec-report.pdf
npx nord-sec --csv targets.csv -t 5 --pdf audit-exec.pdf

The PDF contains:

• Cover band with target count, generation timestamp, proxy, and AI Triage average risk score (when --ai-triage was used)
• Summary stat cards — URLs scanned, total findings, critical, and high counts
• Severity donut chart — distribution of all findings across Critical / High / Medium / Low / Info, with a legend
• Findings-per-target bar chart — top 10 targets by finding volume
• Top Critical & High findings list (capped, with a pointer to the HTML report for the remainder)
• Per-target summary table — status, total findings, and Critical/High vs Medium/Low split per URL

The PDF is pure vector output (Helvetica font, hand-drawn bar/donut charts), so it stays sharp at any zoom and renders in any standards-compliant PDF viewer.

📊 HTML Report

Every scan produces a self-contained, zero-dependency report.html file that opens in any browser. The report uses a tabbed layout with a Summary tab (aggregated view across all scanned URLs) and a dedicated tab per URL.

Summary Tab Panels

| Panel | Description | |---|---| | Scan Metadata | URLs scanned, total findings, breakdown by severity (Critical/High/Medium/Low), proxy indicator if --proxy was used | | Overall Risk Score | A–F letter grade with numeric score (0–100), coloured badge, and finding count — deterministic, severity-weighted | | Technology Fingerprint | Aggregated detection across all targets: server, framework, CMS, CDN/WAF, cloud/hosting, analytics, auth providers, API gateways, database strings, build tools, SSGs, frontend libraries, CMS versions/plugins | | OWASP Top 10 Dashboard | 10-row heatmap mapping findings to OWASP Top 10 2021 categories; shows severity distribution (Critical/High/Medium/Low/Info dots), bar proportional to risk score, and total findings per category | | CVSS Dashboard | CVSS v3/v4 score distribution derived from finding severity; mean/median score, score bands, and finding count | | CWE Dashboard | Weakness taxonomy view — top CWEs by frequency, severity breakdown, and mapping to OWASP categories | | OWASP ASVS Compliance Dashboard | 14-chapter compliance view (V1–V14) mapped from findings; per-chapter finding count, compliance %, and overall coverage KPIs | | Risk Analytics | Two-column grid: (left) Risk score by category with proportional bars; (right) Business Impact chips (Data Breach, Account Takeover, Compliance, etc.) and Exploitability bands (Critical/High/Medium/Low) with counts | | AI Remediation Roadmap | (When --ai-remediation enabled) Executive summary + three priority tiers: Quick Wins (<1 day), Medium-Term (1 day–1 sprint), Long-Term (>1 sprint), plus Root Cause Groups showing one fix resolving multiple findings |

Per-URL Tabs

Each scanned URL gets its own tab with:

• Metadata card — URL, HTTP status, scan timestamp, finding count, tech fingerprint sentence
• AI Triage Panel (when --ai-triage enabled) — AI Risk Score (0–100) with coloured circular badge, natural-language summary, and Exploit Chains (named attack paths with severity, finding IDs, and chain descriptions)
• Findings Table with columns:
  • Severity — rule-based (Critical/High/Medium/Low/Info)
  • 🤖 AI Severity (when --ai-triage enabled) — AI-reassigned severity with ↑/↓ arrow and ↔ confirmed tooltip showing the model's reason
  • Category — deterministic OWASP/category badge (e.g., A05 Injection, Secrets Exposure)
  • Exploitability — numeric score (0–100) + band (Critical/High/Medium/Low) with coloured badge
  • Business Impact — chip tags (Data Breach, Account Takeover, Compliance, Supply Chain, etc.)
  • OWASP ID — finding identifier
  • Finding — name/title
  • Details — full description + inline tech fingerprint sentence

Interactive Features

• Responsive tab navigation with horizontal scroll on narrow screens; tabs show finding count badges (red = findings, green = clean)
• Client-side filtering (planned) — the table structure supports sort/filter by OWASP ID, severity, or finding type
• Colour-coded severity — consistent palette across badges, bars, dots, and exploitability bands
• Zero dependencies — pure HTML/CSS/JS, no external CDN calls; works offline
• Print/PDF friendly — clean layout renders well to PDF via browser print

🧱 Built With

• undici — High-performance Node.js HTTP client
• cheerio — Fast, flexible server-side HTML/DOM parsing
• ws — WebSocket client for Node.js

📝 License

Released under the MIT License. Free to use in personal, commercial, and open-source projects.