keyguard-ai-scan - KeyGuard AI Scan is a legitimate penetration testi

项目说明

![Neura KeyGuard AI Scan]()
![Rust]()
![TypeScript]()
![React]()
![Vite]()
![Docker]()
![TailwindCSS]()
![Shadcn]()
![ESLint]()
![Prettier]()
![MIT License]()

KeyGuard AI Scan

O

KeyGuard AI Scan is a comprehensi penetration testing platform that performs deep web application security assessments, scanning, and penetration testing methodologies. This open-source security tool combines traditional penetration testing techniques with AI-powered analysis to detect exposed credentials, security misconfigurations, and architectural .

Built for security professionals, penetration testers, and de teams, KeyGuard AI Scan automates the reconnaissance, assessment, and analysis phases of penetration testing, pro detailed security reports with actionable remediation guidance.

Key Penetration Testing Capabilities

Automated Reconnaissance: Technology stack fingerprinting and attack surface mapping

Acti Scanning: Multi-layer security testing with 7+ comprehensive test categories

Credential Discovery: Pattern-based detection of exposed API keys and secrets across 20+ services

Configuration Assessment: Security header analysis, CORS , SSL/TLS testing

Information Gathering: Directory tra testing, debug endpoint discovery, ser

AI-Powered Analysis: Comprehensi assessment with prioritized remediation recommendations

🚀 Penetration Testing Features

🎯 Automated Penetration Testing Engine

Automated Reconnaissance: Real-time target profiling with li tracking and attack surface mapping

Multi- Analysis: Deep scanning of HTML, Ja, CSS, inline scripts, and external resources

Credential Har Detection: Identifies 100+ API key types across major services (AWS, Google Cloud, GitHub, Stripe, OpenAI, Discord, Slack)

Ad Pattern Recognition: Entropy-based analysis with confidence scoring to minimize false positives

Intelligence Gathering: Technology stack fingerprinting (React, Vue, Angular), build tools (Webpack, Vite), and dependency mapping

Service Enumeration: Discovers integrated third-party services (Google Analytics, Stripe, Sentry, Hotjar, Mixpanel)

Attack Surface Analysis: Maps external resources, potential API endpoints, form actions, and security-relevant metadata

Target-Specific Testing: Framework-aware assessment based on detected technology stack

🔬 Acti Testing

Security Header Assessment: Comprehensi of CSP, HSTS, X-Frame-Options, and critical security headers

Information Disclosure Testing: Probes error pages and ser for sensitive data leakage

Directory Tra & Path Discovery: Safe enumeration of exposed configuration files (.en.json, .git/config)

Debug Interface Detection: Identifies publicly accessible de endpoints, admin panels, and debug information

CORS Security : Tests Cross-Origin Resource Sharing configurations for security bypasses

SSL/TLS Implementation Testing: HTTPS enforcement, redirect policies, and certificate security

Ser: Detects information disclosure through ser and technology stack exposure

Penetration Testing Scoring: Comprehensi scoring (0-100) based on assessment results

Compliance & Standards Testing: OWASP, SSL/TLS, and industry security standard

🤖 AI-Enhanced Penetration Testing Analysis

Intelligent Threat Analysis: NEURA_ROUTER or OpenAI-compatible integration for ad penetration testing insights

Comprehensi Testing Reports: AI-dri of attack , chaining, and exploitation scenarios

Correlation & Prioritization: AI interprets security test results and creates attack path prioritization

Risk-Based Se Classification: Automated C scoring (Critical, High, Medium, Low) with exploitation likelihood

Penetration Testing Remediation: Expert-level fix instructions with both tactical and strategic security impro

Modern Attack Analysis: 2025 security threat landscape including CSP bypasses, SRI attacks, and HTTPS downgrade risks

Framework-Specific Exploitation Guidance: Targeted security recommendations for React/Next.js, Vue.js, Angular exploitation

Technology-Aware Penetration Testing: Custom attack surface analysis based on detected tech stack

Architecture Penetration Assessment: Security recommendations for API endpoints, third-party integrations, and data flow attacks

Compliance & Regulatory Analysis: OWASP, GDPR, PCI-DSS, and industry compliance gap analysis

Security Posture Assessment: Detailed penetration testing report with risk-prioritized remediation roadmap

📊 Professional Penetration Testing Reports

Interacti Testing Dashboard: analysis with risk scoring and attack mapping

Comprehensi Testing Reports: Detailed assessments with exploitation scenarios and proof-of-concept

Multi-Format Export: PDF, JSON, CS testing reports with executi and technical details

Secure Report Sharing: Encrypted sharing of sensiti testing results with stakeholder access controls

Historical Assessment Tracking: Penetration testing timeline with security posture trends and remediation progress

Real-time Testing Progress: Li during acti testing phases with detailed methodology execution

Compliance & Standards Reporting: OWASP, PCI-DSS, NIST, and regulatory compliance assessment with gap analysis

Executi Testing Summaries: Risk-based reporting for C-le and security leadership

🔐 Enterprise Penetration Testing Platform

Penetration Tester Authentication: JWT-based secure access control for security professionals

Rate Limiting & Throttling: Prevents aggressi and maintains target system a

Sensitive Data Protection: Temporary storage with automatic cleanup of penetration testing artifacts

End-to-End Encryption: All penetration testing communications secured /TLS

Comprehensi Logging: Full penetration testing activity tracking with detailed methodology execution logs

🎯 Penetration Testing Methodology

KeyGuard AI Scan follows established penetration testing methodologies including OWASP Testing Guide, NIST Cybersecurity Framework, and PTES (Penetration Testing Execution Standard).

Phase 1: Reconnaissance & Information Gathering

Target Profiling: Domain analysis, technology stack identification, and service enumeration

Attack Surface Mapping: External resource discovery, endpoint enumeration, and entry point identification

Technology Fingerprinting: Framework detection, identification, and dependency analysis

Third-Party Service Discovery: Integrated service identification and potential attack

Phase 2: Assessment & Scanning

Automated Security Testing: 7+ comprehensive test categories with acti techniques

Credential Discovery: Pattern-based analysis for exposed API keys, tokens, and secrets

Configuration Analysis: Security header , CORS testing, and SSL/TLS assessment

Information Disclosure Testing: Error page analysis, debug endpoint discovery, and sensitive file exposure

Phase 3: Analysis & Exploitation Assessment

Risk-Based Prioritization: C scoring with exploitation likelihood assessment

Attack Analysis: chaining and potential exploitation scenarios

Business Impact Assessment: Risk e based on detected technologies and exposed assets

Compliance Gap Analysis: OWASP, PCI-DSS, and regulatory compliance

Phase 4: Reporting & Remediation

Executi Reports: High-le with business impact assessment

Technical Penetration Testing Reports: Detailed analysis with proof-of-concept

Remediation Roadmap: Prioritized fix recommendations with implementation timelines

Compliance Documentation: Standards-based reporting for audit and regulatory requirements

Automated Testing Categories

1. Security Headers Assessment (CSP, HSTS, X-Frame-Options)
2. Information Disclosure Detection (Error pages, debug information)
3. Directory Tra & Path Discovery (Sensitive file exposure)
4. Debug Interface Detection (De endpoints, admin panels)
5. CORS Configuration (Cross-origin security bypasses)
6. SSL/TLS Implementation Testing (HTTPS enforcement, certificate )
7. Ser Detection (Information leakage, fingerprinting)

🏗️ Architecture

Frontend Stack

Framework: React 18 with TypeScript

Build Tool: Vite for fast de and builds

Styling: Tailwind CSS + Shadcn/ui components

State Management: TanStack Query for ser

Icons: Lucide React for consistent iconography

Backend Stack (Penetration Testing Engine)

Language: Rust for high-performance security scanning and memory safety

Database: LibSQL for fast penetration testing data storage and result caching

Web Framework: Axum for async HTTP penetration testing services

Authentication: JWT with bcrypt for secure penetration tester access control

AI Integration: NEURA_ROUTER (OpenAI SDK compatible) for intelligent penetration testing analysis

HTTP Client: Reqwest for comprehensi reconnaissance and acti

Penetration Testing Engine: Ad pattern recognition with entropy analysis for credential discovery

Content Analysis Engine: Multi-layer parsing for identification across web technologies

Acti Framework: 7+ penetration testing modules for comprehensi assessment

Risk Assessment System: Automated penetration testing scoring with compliance

Infrastructure

Containerization: Docker with multi-stage builds

Orchestration: Docker Compose for local de

Ports: Frontend (11111), Backend (11112)

Database: Persistent LibSQL with file-based storage (production-ready for scaling)

🚀 Quick Start

Prerequisites

Node.js 18+ and npm

Rust 1.75+ (for backend de)

Docker and Docker Compose (recommended)

Using Docker (Recommended)

1. Clone the repository

2. Set en

3. Start the services

4. Access the application
- Frontend:
- Backend API:

Manual De Setup

#### Frontend Setup

#### Backend Setup

🔧 Configuration

En

#### Frontend (.env)

#### Backend (server/.env)

Open AI Compatible API Keys Setup

1. NEURA_ROUTER Integration
- Sign up at Neura Router or use your fa AI platform
- Generate API key
- Add to en

2. Production Deployment
- Use strong JWT secret (32+ characters)
- Enable HTTPS in production
- Configure proper CORS origins

📖 API Documentation

Core Endpoints

#### Penetration Testing

POST /api/scan - Initiate comprehensi test

GET /api/scan/:id - Retrie testing results and assessments

GET /api/scan/:id/progress - Monitor acti testing progress and methodology execution

#### Authentication & Access Control

POST /api/auth/register - Register security professional account

POST /api/auth/login - Penetration tester authentication

GET /api/user/scans - Retrie testing assessment history

#### Health

GET /api/health - Service health check

Request/Response Examples

#### Initiate Penetration Test

#### Penetration Testing Response

🧪 Penetration Testing

Frontend Security Testing

Backend Penetration Testing Engine

End-to-End Penetration Testing

🚀 Deployment

Production Docker Build

Manual Production Setup

1. Build frontend: npm run build
2. Build backend: cd server && cargo build --release
3. Configure reverse proxy (nginx/traefik)
4. Set up SSL certificates
5. Configure monitoring and logging

🔐 Penetration Testing Ethics & Security

Responsible Penetration Testing

Authorized Testing Only: Designed for authorized security assessments and owned assets

Non-Destructi: Read-only analysis without system compromise or data modification

Rate Limiting: Prevents aggressi that could impact target a

Legal Compliance: Adheres to GDPR, CCPA, and international cybersecurity regulations

Responsible Disclosure: Security-first approach with clear reporting

Data Privacy & Security

Temporary Data Storage: Scan results stored temporarily with automatic cleanup

End-to-End Encryption: All penetration testing data transmitted

Access Controls: JWT-based authentication with session management

Audit Logging: Comprehensi testing activity tracking

No PII Collection: Anonymized scanning without personal data storage

Professional Penetration Testing Capabilities

Multi- Assessment: Comprehensi across HTML, Ja, CSS, and external resources

Acti Testing: 7+ penetration testing categories including header analysis, CORS , SSL/TLS assessment

Technology Stack Penetration Testing: Framework-specific assessment and exploit identification

Third-Party Integration Security: Risk analysis of integrated services and potential attack

API Security Assessment: Endpoint discovery, authentication testing, and data flow analysis

Modern Attack Analysis: 2025 threat landscape including CSP bypasses, SRI exploitation, and secure header circum

Penetration Testing Scoring: Industry-standard risk assessment with 0-100 security scoring

Information Gathering: Safe enumeration of sensiti, debug endpoints, and configuration exposure

Penetration Testing Standards Compliance

OWASP Testing Guide: Follows OWASP web application security testing methodology

PTES Compliance: Aligned with Penetration Testing Execution Standard

NIST Framework: Incorporates NIST Cybersecurity Framework principles

Industry Best Practices: Implements professional penetration testing standards and methodologies

🤝 Contributing

De Workflow

1. Fork the repository
2. Create feature branch: git checkout -b feature/amazing-feature
3. Commit changes: git commit -m 'Add amazing feature'
4. Push to branch: git push origin feature/amazing-feature
5. Open Pull Request

Code Standards

Frontend: ESLint + Prettier configuration

Backend: Rustfmt + Clippy linting

Testing: Minimum 80% code co

Documentation: Comprehensi docs

📊 Analytics & Monitoring

Built-in Analytics

Scan Metrics: Success rates, duration, findings

User Behavior: Feature usage, engagement patterns

Performance: Response times, error rates

Security: trends, detection accuracy

Monitoring Stack

Logging: Structured logs with tracing

Metrics: Custom metrics for business KPIs

Alerting: Error rate and performance alerts

Health Checks: Automated service monitoring

🆘 Support

Documentation

API Reference: Comprehensi documentation

De Guide: Setup and customization instructions

Security Guide: Best practices and compliance

Troubleshooting: Common issues and solutions

Community

Issues: GitHub Issues for bug reports

Discussions: Feature requests and questions

Discord: Real-time community support

Security: for

📜 License

This project is licensed under the MIT License - see the LICENSE file for details.

📝 Changelog

v0.2.5 (2025-10-04)

Major SEO O: Completely rebranded as comprehensi penetration testing platform

Enhanced Meta Tags: Updated title (55 chars) and description (143 chars) to reflect full pentest capabilities

Content Realignment: Landing page now showcases 7+ test categories including security headers, CORS, SSL/TLS, and scanning

AI/LLM Discovery Files: Added ai.txt and llm.txt for proper search engine and AI crawler indexing

Improved SEO Structure: Fixed multiple H1 tags issue, optimized heading hierarchy for better search rankings

Structured Data Enhancement: Added datePublished and dateModified fields for impro

Accurate Positioning: Repositioned API key detection as one feature among comprehensi capabilities (not primary focus)

Professional Messaging: Updated all content to emphasize OWASP compliance, PTES methodology, and enterprise-grade security testing

v0.2.4 (2025-10-02)

Enhanced Security Findings Display: Fixed security findings section to properly show test failures alongside API key disco

Improved Type Definitions: Added comprehensi types for and SecurityAnalysis interfaces

Better Empty State Handling: Security dashboard now correctly displays "No security issues found" only when both API keys and tests pass

Bug Fix: Resol where failed tests were not triggering security findings display

v0.2.3 (2025-10-01)

Markdown Table Rendering: Fixed AI security audit reports not rendering tables properly by adding remark-gfm plugin

Enhanced Report Formatting: Security audit tables now display with proper styling in both light and dark modes

Impro: GitHub Flavored Markdown tables for executi, compliance status, and breakdowns now render correctly

v0.2.2 (2025-10-01)

Enhanced Summary Calculation: Fixed test results not being counted in the security findings summary

Comprehensi Display: Security audit now correctly shows total findings including both API key disco and failed tests

Impro Metrics: Total Findings, High Priority, and Lower Priority counts now include all security issues detected during scans

Bug Fix: Resol where security header failures, exposed files, and SSL/TLS issues were not reflected in the dashboard summary

En Configuration: Fixed configuration for proper frontend-backend communication in Docker deployments

v0.2.1 (2025-09-12)

Acti Testing Engine: Comprehensi testing with 7+ test categories including security headers, information disclosure, directory tra, debug endpoints, CORS, SSL/TLS, and ser

Security Scoring System: Automated 0-100 security score calculation based on API key findings and test results

Compliance Assessment: OWASP, SSL/TLS, and o security posture compliance checking with detailed status reporting

Enhanced AI Security Analysis: Updated AI system to interpret acti test results and provide prioritized remediation recommendations

Modular Security Testing Architecture: Organized security tests into dedicated module (security_tests.rs) for maintainability and extensibility

Ad Security Headers Testing: Comprehensi of CSP, HSTS, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, and Permissions-Policy headers

Safe Information Disclosure Detection: Non-intrusi for sensitive data exposure in error pages and debug information

Directory Tra Protection : Read-only checks for exposed sensiti (.en.json, .git/config, etc.)

CORS Security : Preflight request testing to identify overly permissive CORS configurations

SSL/TLS Implementation Assessment: HTTPS enforcement and HTTP-to-HTTPS redirect

Ser Protection: Detection of information disclosure through ser and technology stack exposure

Executi Reporting: Enhanced reporting with security scores, compliance status, and prioritized remediation roadmaps

v0.2.0 (2025-09-11)

Comprehensi Audit Engine: Completely redesigned scanning engine to detect not just API keys but comprehensi and architectural issues

Technology Stack Detection: Ad detection of frameworks (React, Vue, Angular, Next.js), build tools (Webpack, Vite), CSS frameworks (Tailwind, Bootstrap), and Ja libraries

Third-Party Service Analysis: Identifies and analyzes security implications of integrated services (Google Analytics, Stripe, Sentry, Hotjar, Mixpanel, Cloudflare)

Security Architecture Assessment: Deep analysis of external resources, potential API endpoints, form actions, meta tags, and security headers

Enhanced AI Security Expert: Upgraded AI system prompt with 2025 modern security best practices including CSP, SRI, HTTPS e, secure headers, and zero-trust architecture

Framework-Specific Security Recommendations: Tailored security advice based on detected technology stack (React XSS pre, injection, Angular sanitization)

Ad Pattern Matching: Improved API key detection with 20+ service patterns, entropy analysis, and confidence scoring

Comprehensi Analysis: Enhanced scanning of HTML content, inline scripts, external Ja/CSS files with detailed security context

Security Context Extraction: Intelligent extraction of security-relevant information including potential endpoints, external dependencies, and technology fingerprinting

Professional Security Reporting: Detailed secutity audit reports with technology stack breakdown, assessment, and prioritized remediation steps

v0.1.9 (2025-09-10)

Real Backend Integration: Replaced all mockup data and frontend scanning with real Rust backend API integration

Enhanced User Experience: Added Enter key support to both scan forms for faster form submission

Code Cleanup: Remo mockup files (scanner.ts, ai-recommendations.ts, HeroSection.tsx) for cleaner codebase

Na Impro: Made na logo clickable to return to main page with ho

Frontend Optimization: Fixed scan form to use actual backend API calls instead of test na

Production Ready: Eliminated all mock data ensuring real scan counts and authentic results

Error Handling: Impro handling with proper user feedback during scan failures

Performance: Streamlined frontend by removing duplicate components and unused code

v0.1.8 (2025-09-10)

Persistent Database Storage: Fixed shared scan result URLs not persisting after app restart by switching from in-memory to file-based database storage

Docker Integration: Added persistent mounting for database files in Docker containers to ensure data survi restarts

En Configuration: Added DATABASE_PATH en for configurable database file location

Production Deployment: Enhanced Docker configuration with proper data persistence for production en

Database File Management: Added database files to .gitignore to prevent committing persistent data

Container Optimization: Updated Dockerfile to create data directory structure for reliable database storage

v0.1.7 (2025-09-09)

Professional Share & Export System: Implemented comprehensi sharing and export functionality

Ad Export Formats: Added Markdown, JSON, and CS options with branded professional reports

Smart Social Sharing: Integrated Twitter/X, LinkedIn, Facebook sharing with branded previews and security status

Dark Mode Optimization: Fixed AI Secutity Audit white background issues for complete dark mode compatibility

Docker Networking Fixes: Resol deployment networking issues between frontend and backend containers

Enhanced Reporting: Comprehensi reports with executi, findings breakdowns, and AI recommendations

Clipboard Integration: One-click URL copying with nati sharing support

Analytics Integration: Added tracking for sharing and export events to understand user engagement

Modular Architecture: Created reusable ShareButton and ExportButton components for easy maintenance

Professional Branding: Consistent KeyGuard branding across all shared content and exported reports

v0.1.6

Complete Frontend Architecture O: Completely reorganized landing page into modular, maintainable components

Modern Na System: Implemented sticky na with glassmorphism design, backdrop blur, and automatic dark mode detection

Responsive Hero Layout: Combined hero section and scan form into elegant desktop side-by-side layout with mobile-first responsi

Component Organization: Split landing page into dedicated components (HeroWithScanForm, FeaturesSection, CTASection, Footer) for better maintainability

Dark Mode Implementation: Added automatic system preference detection with seamless light/dark mode switching across all components

Enhanced User Experience: Impro, hierarchy, and interacti with smooth animations and transitions

Docker Build Optimization: Fixed Rust compatibility issues and OpenSSL static linking for musl targets

Production Configuration: Updated Vite config with proper host allowlist and TypeScript error resolution

API Client Impro: Enhanced production/de URL handling with automatic en detection

Build System Fixes: Resol compilation errors and impro workflow

v0.1.5

Domain Updates: Updated all URLs to keyguard.meetneura.ai domain

Date Corrections: Fixed all dates to current date (2025-09-07)

Security.txt Updates: Extended expiration to 2026-09-07

Contact Information: Updated to

Sitemap Refresh: Updated lastmod dates to current

Humans.txt Updates: Refreshed team information and dates

v0.1.4

SEO Optimization: Added comprehensi meta tags and Twitter cards

Search Engine Enhancement: Implemented structured data (JSON-LD) for better search

Sitemap Integration: Added XML sitemap for impro engine crawling

PWA Support: Added web app manifest for progressive web app capabilities

Social Media Ready: Optimized og.png image integration for social sharing

Meta Tags Enhancement: Added proper keywords, canonical URLs, and theme colors

Robots.txt Optimization: Updated with sitemap reference and proper crawling directives

Mobile Optimization: Enhanced and mobile-first meta configurations

v0.1.3

Critical Bug Fixes: Fixed non-functional scan button and na issues

UI/UX Impro: Added real-time scanning progress with progress bar

Results Display: Fixed scan results page to properly show AI recommendations and findings

Na Flow: Implemented proper scan-to-results page flow with loading states

Polling System: Added automatic result polling for real-time scan status updates

Error Handling: Impro handling and user feedback during scan failures

Performance: Optimized frontend-backend communication and state management

v0.1.2

Enhanced AI Integration: Impro integration with better error handling

Backend Impro: Enhanced scanner module with better pattern matching

Database Optimizations: Impro integration and query performance

Authentication Enhancements: Strengthened JWT handling and user session management

Frontend Updates: Better AI recommendations display and user experience

Configuration: Updated en and API endpoints

Build System: Improved Vite configuration and de workflow

Security: Enhanced input and sanitization

v0.1.1

README documentation updates

Minor bug fixes and impro

v0.1.0

Initial release with core scanning functionality

Basic AI-powered recommendations

User authentication system

Docker containerization

🙏 Acknowledgments

Shadcn/ui: Beautiful, accessible React components

NEURA_ROUTER: AI-powered recommendation engine

Rust Community: Amazing ecosystem and libraries

Security Researchers: patterns and best practices

---

KeyGuard AI Scan - Professional automated penetration testing for modern web applications. 🎯🔐

项目信息

开发语言：TypeScript

Star 数：12

技术要点

该项目属于防护思路方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕KeyGuard AI Scan is a legitimate penetration testing tool designed for defensive security assessments, automated vulnerability scanning, and security posture evaluation.展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。