openvscan - OpenVScan is a web-based vulnerability scanner tha

项目说明

OpenVScan

OpenVScan is a web-based scanner that pairs open-source security tooling with AI-assisted analysis for faster, more reliable pre-production security testing. It runs entirely on Cloudflare — Workers, Containers, D1, R2, and Queues.

Architecture

| Tier | Stack | Responsibilities |
|------|-------|------------------|
| Web Worker (web/) | TanStack Start, React 19, Tailwind 4, Cloudflare Workers | UI, Better-auth, ser (project/scan CRUD), queue producer, exports |
| Scanner Worker (workers/) | Cloudflare Worker + Container, Queues | Consumes scan jobs, runs Trivy in a container, writes findings to D1 and artifacts to R2 |
| Database | Cloudflare D1 (SQLite, Drizzle ORM) | Users, sessions, projects, scans, findings, logs |
| Object storage | Cloudflare R2 | Raw scanner output artifacts |
| Queue | Cloudflare Queues | Decouples scan dispatch from execution |

There is no separate API server, Redis, or Postgres — the web Worker owns data access Start ser, and a consumer Worker drives the scanner container.

> Plan requirement: Cloudflare Containers require the Workers Paid plan ($5/mo). D1, R2, Queues, and Workers all ha free tiers.

Quick Start

The web app runs at

En

Bindings (D1, R2, Queue) live in wrangler.jsonc, not .env. Provide secrets for local dev in web/.dev.vars:

Generate a secret with openssl rand -base64 32.

GitHub integration

OpenVScan connects to GitHub through a GitHub App (repo access, push webhooks, PR
comments) plus an OAuth client (for "Continue with GitHub" login). The GitHub features are
optional — without them, manual project scans still work.

1. Register a GitHub App (Settings → De settings → GitHub Apps → New):

| Setting | Value |
|---------|-------|
| Webhook URL | |
| Setup URL (callback) | (check "Redirect on update") |
| Webhook secret | a random string (becomes GITHUB_WEBHOOK_SECRET) |
| Permissions | Contents: read, Pull requests: read & write, Metadata: read |
| Subscribe to events | Push, Pull request, Installation, Installation repositories |

Generate a private key for the App (downloads a .pem). The App's App ID, slug
(from its public page URL), Client ID/secret, and the private key feed the secrets below.

2. Provide secrets. Locally, copy web/.dev.vars.example → web/.dev.vars and
workers/.dev.vars.example → workers/.dev.vars and fill them in. In production:

3. Use it. Sign in → Repositories → install the App on the repos you want → connect a
repo → set its trigger to Automatic with an optional branch filter. On a matching push,
OpenVScan scans the repo and (when the branch has an open PR) posts a findings summary comment.

For local webhook testing, forward GitHub deli to your de with a tunnel (e.g.
smee.io or cloudflared tunnel) pointed at localhost:3000/api/github/webhook.

First Run

1. Go to and create an account.
2. Create a project from the dashboard.
3. Start a scan from the project page (target = a repo URL, container image, or path).
4. Open the scan detail page to view status, findings, logs, and exports.

> Local scan execution requires the scanner Worker (and Docker, for the container). Without it, scans queue but stay pending. See Deployment.

Features

Current

Planned

Repository Structure

De

Prerequisites

Commands

Deployment

E deploys to Cloudflare.

Documentation

Contributing

Contributions are welcome — see CONTRIBUTING.md.

1. Fork the repository
2. Create a feature branch
3. Make your changes
4. Run lint and build
5. Submit a pull request

License

Licensed under the GNU Affero General Public License v3.0 only. See LICENSE for details.

Acknowledgements

OpenVScan builds on trusted open-source security tools:

---

Made by Buddhsen Tripathi

For questions or support, please open an issue.

项目信息

开发语言：TypeScript

Star 数：16

技术要点

该项目属于安全软件方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕OpenVScan is a web-based vulnerability scanner that integrates open-source tools with AI to deliver smarter, faster and more reliable pre-production security testing.展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。