vulnradar.dev - Open-source web vulnerability scanner. Scan any we

项目说明

<di="center">

<img src=" width="96" height="96" alt=" logo" />

Open-source web scanner. Paste a URL and get 855+ deterministic
checks back, each with the response e behind it, a finding ID that does
not change between runs, and the config line that fixes it. No agent to
install. GPL-3.0 and self-hostable.

Scan a URL with no account ·
Docs ·
Self-host ·
Changelog

![Secured by ]()
![CI]()

</div>

What it does

Stable finding IDs, so two runs can be diffed and a CI job can fail on

exactly the finding you care about instead of a se count

E with every finding: the header, the certificate field, or the

response body fragment that triggered it, not just a rule name

18 categories co security headers, TLS and certificates, cookies,

DNS and email records, exposed secrets, ser, information
disclosure, client-side risks, supply chain exposure, and common
AI-generated code antipatterns

A CLI and a GitHub Action that poll a scan to completion and exit

non-zero when findings cross a threshold you set

A self-updating embed badge: generate it once and it always shows that

URL's most recent completed scan, with no new embed code to paste

Scan diffing and shareable report links, so a fix can be shown to have

landed rather than asserted

Scheduled scans, bulk scanning, and signed webhooks that fire when the

scan actually finishes rather than when the request that started it
returned, on every kind of scan: single URL, crawl, bulk, authenticated,
and GitHub repo. A scan.regressed event carries the findings that are new
since the previous scan of the same target, so an alert can be routed to a
person without a second API call

Exports to PDF, JSON, CS, Markdown, or a compliance crosswalk, so

findings go into the tool your team already uses

A browser extension for Chrome and Firefox that scans the tab you are on

Runs on your own hardware under GPL-3.0, with no telemetry. The only

outbound call it makes on its own behalf is the admin-triggered update check
against the GitHub releases API

Auth, teams, billing, the admin panel and the AI triage assistant are all
covered in the docs.

Quick Links

Documentation - setup, API reference, and guides

GitHub - source and contribution guidelines

Report a Bug - help us improve

Security Ad - pri report a

Support - pays for hosting the public instance and the time spent chasing false positives out of the detection engine

Embeddable Badge

The badge above is generated once and updates on its own: scan your site
again and the image changes with it, no new embed code to paste in. Pick a
scan at /badge, copy the HTML or Markdown
snippet, and the badge always reflects that URL's most recent completed
scan, not the scan you happened to pick when you made it.

Getting Started (Hosted)

1. Try it without an account at /demo
2. Sign up at .de for 25 scans a day, free
3. Read the docs at /docs for the API and ad features

Self-Hosting

is GPL-3.0 and can be self-hosted. See the
Self-Hosting Guide for full
instructions.

API_KEY_ENCRYPTION_KEY is required. Without it the app refuses to store TOTP
secrets rather than falling back to plaintext.

Configuration

Every setting resolves as database ?? en ?? shipped default (see
the Config Reference for every value):

| Layer | Where | Purpose |
| ------------------- | ------------------------------------ | ------------------------------------------------------------------------------------------------------------------------------- |
| Database | Admin -> Settings | Wins o else. No restart, no rebuild: a change reaches every running instance within the 30 second resol. |
| En | .env (or docker-compose.yml env) | A named exactly like the registry key pins a value without a database write. Also where secrets live. |
| Shipped default | lib/config/config-.ts | The CONFIG_* constant the repo ships with. Edit and rebuild. |

Most of the settings in lib/config/registry.ts are runtime tier and take
effect as soon as they are saved. The rest are build tier (app name, branding,
SEO metadata) and are baked into statically generated pages, so those need a
rebuild before the change is . /docs/config counts both from the
registry itself and is the number to trust: the figures that used to be written
out here had drifted by nine as settings were added, which is the same reason
that page computes them rather than stating them.

Secrets are en and have no admin control: DATABASE_URL,
API_KEY_ENCRYPTION_KEY, STRIPE_SECRET_KEY, SMTP credentials, Discord OAuth.

How a value gets read: lib/config/config-.ts exports the raw
CONFIG_* constants. lib/config/registry.ts classifies each one into
SETTINGS_REGISTRY (type, bounds, admin tab, tier).
lib/config/runtime-config.ts resolves it in the order above, and
lib/config/constants.ts / client-constants.ts re-export the results under
the con names (APP_NAME, ROUTES, API, ERROR_MESSAGES) used
throughout the app. lib/config/env.ts the required en
with Zod at boot.

Architecture

See docs/architecture for:

Project structure (app/, lib/, components/, hooks/, tests/)

Configuration system (above)

Database layer (PostgreSQL via the pg driver)

Authentication flow (sessions, 2FA, API keys)

Scanner engine and how to add a check category

REST API (v3)

CI/CD pipeline (GitHub Actions + Dependabot)

De

Prerequisites: Node 22 LTS (the engines field is >=22.0.0 <23.0.0, so
Node 20 and every release from 23 up fail the check outright; see .nvmrc) and
PostgreSQL 14+.

Use npm ci, not npm install. Regenerating package-lock.json on Windows
or macOS drops the Linux nati and breaks CI and the Docker build.
See CONTRIBUTING.md.

| Script | Purpose |
| ------------------------- | ------------------------------------------------------------ |
| npm run dev | De server |
| npm run build | Production build |
| npm run typecheck | tsc --noEmit |
| npm run lint | ESLint, including type-aware rules on auth code |
| npm run format | Prettier |
| npm run format:check | Prettier in check mode. CI gates on this |
| npm test | suite |
| npm run test:co | with per-file co thresholds |
| npm run build:knowledge | Regenerate lib/ai/ from the docs, changelog, checks, legal |
| npm run db:migrate | Apply schema migrations |
| npm run db:create | Clone the DB to a new name at a chosen schema |
| npm run db:diagnose | Read-only database corruption report. db:repair fixes |
| npm run db:backup | Full dump. db:restore puts one back |

Tests live in tests/, mirroring the source tree. See
tests/README.md for the layout and con.

See CONTRIBUTING.md for commit con and the pull
request process.

Tech Stack

Framework: Next.js 15.5 (App Router)

UI: React 19, TypeScript 6, Tailwind CSS 4, Radix UI primitives

Database: PostgreSQL via the pg driver

Auth: HTTP-only session cookies, scrypt password hashing (N=2^17, params

stored per hash so the cost can be raised without in old hashes),
custom TOTP (RFC 6238), bcrypt for API key hashing

Payments: Stripe (Elements)

Scanner: Custom TypeScript engine over HTTP/HTTPS/WebSocket/FTP

Testing:

CI: GitHub Actions + Dependabot

Security

Security Policy

security.txt

Dependency Scanning

To report a , email security@.dev. Please do not open
a public issue.

License

GPL-3.0. See LICENSE for the full text.

项目信息

开发语言：TypeScript

Star 数：8

技术要点

该项目属于安全软件方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕Open-source web vulnerability scanner. Scan any website for instant reports with severity ratings, actionable fix guidance, and team collaboration tools. Free and self-hostable.展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。