Features

Scanner Reference

BoringSec publishes 17 pre-verification URL modules plus 6 verified-owner heavy scanners (3 external engines). The 17 public modules can produce the pre-verification report. Injection, XSS, and Ports are in-process heavy scanners. Nuclei, ZAP, and Medusa are external background engines. All six share the stricter verified-owner authorization boundary. Findings use five severities — CRITICAL, HIGH, MEDIUM, LOW, INFO — and evidence-gated critical or high findings are downgraded when the required proof is missing.

Registry 2026-07-18.1, reviewed 2026-07-18. The same typed registry drives the public methodology and the machine-readable JSON contract.

Legal and authentication coverage boundary

Coverage is explicit by surface. Conditional or not-assessed work is never converted into a pass, and framework mapping is not presented as certification. Per-scan evidence uses distinct found, missing, not_observed, not_applicable, unavailable, and needs_auth states.

Capability	State	Evidence surface	Limit
Privacy, consent, and data rights signals	implemented	Public website content and observable privacy controls. The report records observable consent, tracking, privacy-notice, retention, and data-rights signals with supporting evidence.	Automated observations are not a legal assessment or proof of compliance. Missing evidence is reported as partial or not observed.
Terms, WCAG basics, and public notices	implemented	Public website content and explicitly linked notices. The report records observable terms, accessibility basics, page metadata, and public notices independently.	This is not a full WCAG audit, legal opinion, intellectual-property clearance, or proof that a document is enforceable in every jurisdiction.
Public authentication signals	implemented	Publicly observable authentication and session signals. The public scan checks browser-visible security configuration without signing in or changing application state.	Account-level authorization and identity controls require owner-authorized testing or manual review and are not marked as passed by a public scan.
Authenticated application surface	conditional	Verified-owner domains with an explicitly configured, expiring credential profile. Optional credentials remain server-side and are used only within an isolated, owner-authorized scan for the verified site. Public reports never expose credential names or values.	Coverage depends on the configured access and application behavior. Controls that were not assessed are reported as unavailable or partial, never as passed.
Repository auth and authorization patterns	conditional	User-authorized repository or archive scan. Authorized source analysis checks selected authentication, authorization, secret, dependency, and integration patterns.	Source patterns are evidence leads, not runtime proof. Business-object ownership and role policy still require dedicated authorized tests or manual review.

Security Headers

Applicable base modulepassive

Evaluates browser security policy and server-disclosure headers.

Authorization: Runs against the submitted public URL. It does not authorize verified-owner background engines.
Bounded request profile: Uses the bounded primary HTTP response and its response headers.

Public check families

Content Security Policybs.headers.csp
Evidence: Observed policy directives and response location.
Strict Transport Securitybs.headers.hsts
Evidence: Observed HSTS directives on the HTTPS response.
Browser isolation and content controlsbs.headers.browser-controls
Evidence: Observed frame, MIME, referrer, permissions, and isolation headers.
Server technology disclosurebs.headers.disclosure
Evidence: Names of disclosure headers without secret values.

Evidence, limits, and remediation

Evidence retained

HTTP status and final public URL
Relevant response header names and safe values

Standards mapped

Content Security Policy Level 3
RFC 6797 HTTP Strict Transport Security
OWASP Application Security Verification Standard

False-positive discipline

A control provided by an equivalent CSP directive is not reported as missing.

Remediation

Add the missing policy at the application or edge layer.
Roll out restrictive policies in report-only mode before enforcement when appropriate.

Limitations

A response header review does not prove every browser execution path is safe.

Partial: Useful evidence was collected, but one or more bounded stages could not be verified. The category is withheld from a clean pass and from weighted score credit.

Unavailable: The category could not produce reliable evidence, was not authorized, or was not applicable. The report records the reason and excludes that missing coverage from a verified pass.

SSL/TLS

Applicable base moduleactive

Checks certificate identity, validity, protocol posture, and HTTPS redirection.

Authorization: Runs against the submitted public URL. It does not authorize verified-owner background engines.
Bounded request profile: Uses a bounded number of TLS handshakes and redirect observations with strict timeouts.

Public check families

Certificate identity and validitybs.ssl.certificate
Evidence: Certificate subject, issuer, validity window, and hostname match outcome.
TLS protocol supportbs.ssl.protocols
Evidence: Successful or rejected bounded protocol negotiations.
Cipher posturebs.ssl.ciphers
Evidence: Negotiation outcomes for bounded cipher families.
HTTP to HTTPS redirectbs.ssl.redirect
Evidence: Observed redirect status and destination.

Evidence, limits, and remediation

Evidence retained

Certificate metadata
Negotiated protocol outcomes
Redirect chain summary

Standards mapped

Mozilla Server Side TLS guidance
OWASP Application Security Verification Standard

False-positive discipline

Handshake failures caused by target blocking or network policy become partial or unavailable, not vulnerabilities.

Remediation

Renew or replace invalid certificates.
Disable obsolete protocols and weak cipher families.
Redirect public HTTP traffic to HTTPS.

Limitations

Results represent the public endpoint reached during the scan and may not cover every regional edge.

Partial: Useful evidence was collected, but one or more bounded stages could not be verified. The category is withheld from a clean pass and from weighted score credit.

Unavailable: The category could not produce reliable evidence, was not authorized, or was not applicable. The report records the reason and excludes that missing coverage from a verified pass.

DNS & Email Authentication

Applicable base modulepassive

Reviews public DNS, mail-authentication, and transport-policy records.

Authorization: Runs against the submitted public URL. It does not authorize verified-owner background engines.
Bounded request profile: Uses a fixed family of public DNS lookups with per-query timeouts.

Public check families

SPF, DKIM, and DMARCbs.dns.email-auth
Evidence: Sanitized public record text and lookup outcome.
CAA, MTA-STS, TLS reporting, and DANEbs.dns.transport-policy
Evidence: Observed policy records and validation state.
DNSSEC, MX, and nameserversbs.dns.delegation
Evidence: Public record sets and resolver outcome.

Evidence, limits, and remediation

Evidence retained

Public DNS record values
Resolver response and validation state

Standards mapped

RFC 1035 domain names
RFC 7208 Sender Policy Framework
RFC 7489 DMARC

False-positive discipline

Unavailable record families remain explicit when a resolver or authoritative server cannot answer conclusively.

Remediation

Publish valid records with the domain DNS provider.
Stage stricter email policies and monitor aggregate reports before full enforcement.

Limitations

Selector-specific DKIM coverage depends on selectors observable from the public surface.

Partial: Useful evidence was collected, but one or more bounded stages could not be verified. The category is withheld from a clean pass and from weighted score credit.

Unavailable: The category could not produce reliable evidence, was not authorized, or was not applicable. The report records the reason and excludes that missing coverage from a verified pass.

Exposure

Applicable base moduleactive

Checks a bounded set of commonly exposed public artifacts and administrative surfaces.

Authorization: Runs against the submitted public URL. It does not authorize verified-owner background engines.
Bounded request profile: Uses a fixed, capped path inventory with response-size limits and no recursive crawling.

Public check families

Public secret and configuration artifactsbs.exposure.secrets
Evidence: Path class, status, and content-signature match without secret contents.
Public backup and data artifactsbs.exposure.backups
Evidence: Path class, status, and safe signature outcome.
Administrative and diagnostic surfacesbs.exposure.admin
Evidence: Observed public route and response classification.
Public source maps and development artifactsbs.exposure.source-maps
Evidence: Artifact location and validation outcome.

Evidence, limits, and remediation

Evidence retained

Public path and HTTP status
Content-signature verdict with sensitive values removed

Standards mapped

OWASP Web Security Testing Guide
OWASP Top 10

False-positive discipline

Generic SPA shells and branded error pages must match content signatures before a finding is confirmed.

Remediation

Remove the artifact from the public deployment.
Rotate any credential that may have been exposed.
Block sensitive paths at the origin and edge.

Limitations

The module checks a bounded public inventory and is not a recursive content-discovery crawler.

Partial: Useful evidence was collected, but one or more bounded stages could not be verified. The category is withheld from a clean pass and from weighted score credit.

Unavailable: The category could not produce reliable evidence, was not authorized, or was not applicable. The report records the reason and excludes that missing coverage from a verified pass.

Cookies

Applicable base modulepassive

Reviews observable cookie security attributes without retaining cookie values.

Authorization: Runs against the submitted public URL. It does not authorize verified-owner background engines.
Bounded request profile: Uses Set-Cookie headers from the bounded primary response.

Public check families

Secure transport attributebs.cookies.secure
Evidence: Cookie name and attribute presence without the cookie value.
HttpOnly attributebs.cookies.httponly
Evidence: Cookie name, classification, and attribute presence.
SameSite policybs.cookies.samesite
Evidence: Cookie name and normalized SameSite state.
Prefix and domain scopebs.cookies.scope
Evidence: Cookie name, prefix, and safe scope metadata.

Evidence, limits, and remediation

Evidence retained

Cookie names and attributes
Transport context

Standards mapped

RFC 6265 HTTP state management
OWASP Application Security Verification Standard

False-positive discipline

HttpOnly severity is higher only for cookies that appear session-sensitive.

Remediation

Set Secure, HttpOnly, and an intentional SameSite value.
Narrow domain and path scope for sensitive cookies.

Limitations

Cookies created only after authenticated or interactive browser actions may not be observed.

Partial: Useful evidence was collected, but one or more bounded stages could not be verified. The category is withheld from a clean pass and from weighted score credit.

Unavailable: The category could not produce reliable evidence, was not authorized, or was not applicable. The report records the reason and excludes that missing coverage from a verified pass.

CORS

Applicable base moduleactive

Tests how the public endpoint responds to bounded cross-origin requests.

Authorization: Runs against the submitted public URL. It does not authorize verified-owner background engines.
Bounded request profile: Uses a small fixed matrix of origin and preflight requests with strict timeouts.

Public check families

Allowed origin policybs.cors.origin-policy
Evidence: Sent origin class and returned CORS headers.
Credentialed cross-origin accessbs.cors.credentials
Evidence: Returned origin and credential headers.
Cross-origin methods and exposed headersbs.cors.methods
Evidence: Preflight response and safe header summary.

Evidence, limits, and remediation

Evidence retained

Request origin class
CORS response headers
HTTP status

Standards mapped

Fetch Standard CORS protocol
OWASP Application Security Verification Standard

False-positive discipline

A permissive header on a non-sensitive public response is reported separately from confirmed credential exposure.

Remediation

Allow only trusted origins.
Do not combine broad origin access with credentials.
Limit methods and exposed headers.

Limitations

Authenticated response behavior is not inferred from an unauthenticated public response.

Partial: Useful evidence was collected, but one or more bounded stages could not be verified. The category is withheld from a clean pass and from weighted score credit.

Unavailable: The category could not produce reliable evidence, was not authorized, or was not applicable. The report records the reason and excludes that missing coverage from a verified pass.

Platform Detection

Applicable base modulepassive

Identifies hosting and application-platform signals used to tailor remediation.

Authorization: Runs against the submitted public URL. It does not authorize verified-owner background engines.
Bounded request profile: Uses public response headers, markup, and asset references already collected for the scan.

Public check families

Hosting and deployment platformbs.platform.hosting
Evidence: Matched public signatures and confidence.
Application platformbs.platform.application
Evidence: Matched public markup, header, or asset signatures.

Evidence, limits, and remediation

Evidence retained

Matched public signature class
Confidence and supporting signal

Standards mapped

No normative mapping is claimed.

False-positive discipline

Low-confidence signals are not presented as definitive platform identification.

Remediation

Use the detected platform guidance only when the evidence matches the deployed stack.

Limitations

Reverse proxies and custom branding can hide or imitate platform signals.

Partial: Useful evidence was collected, but one or more bounded stages could not be verified. The category is withheld from a clean pass and from weighted score credit.

Unavailable: The category could not produce reliable evidence, was not authorized, or was not applicable. The report records the reason and excludes that missing coverage from a verified pass.

VirusTotal

Extended base modulepassive

Looks up existing multi-vendor reputation evidence for the normalized origin and hostname while suppressing single-vendor noise.

Authorization: Public and signed-in scans may perform privacy-minimized origin and hostname lookups. Full URL submission is disabled; enabling it would require a signed-in, currently verified domain owner and a separate durable, auditable VirusTotal consent receipt that is not currently implemented.
Bounded request profile: Uses at most two external GET lookups: the normalized HTTP(S) origin and ASCII hostname. Credentials, path, query, and fragment are stripped before the provider boundary. A cache miss is not submitted for analysis.

Public check families

Multi-vendor malicious and suspicious verdictsbs.virustotal.verdicts
Evidence: Aggregate vendor counts and scan timestamp.
Community reputationbs.virustotal.community
Evidence: Aggregate community score without user identities.

Evidence, limits, and remediation

Evidence retained

Aggregate verdict counts
Reputation summary
Observation time

Standards mapped

No normative mapping is claimed.

False-positive discipline

A single-vendor flag is shown as noise-sensitive evidence and does not trigger the multi-vendor cap.

Remediation

Investigate the flagged resource and vendor evidence.
Request vendor review after remediation when a verdict is incorrect.

Limitations

External reputation data can be delayed, unavailable, or disagree across vendors.
The origin and hostname cross the VirusTotal provider boundary when configured; full paths and query data do not. An unseen origin remains unavailable or partial because URL submission is disabled.

Partial: Useful evidence was collected, but one or more bounded stages could not be verified. The category is withheld from a clean pass and from weighted score credit.

Unavailable: The category could not produce reliable evidence, was not authorized, or was not applicable. The report records the reason and excludes that missing coverage from a verified pass.

Technology & Live CVEs

Extended base modulehybrid

Fingerprints observable components and enriches supported versions with live advisories.

Authorization: Runs against the submitted public URL. It does not authorize verified-owner background engines.
Bounded request profile: Uses bounded public fingerprint probes plus capped advisory lookups for supported ecosystems.

Public check families

Observable technology fingerprintbs.technology.fingerprint
Evidence: Technology name, public signature, and confidence.
Version disclosurebs.technology.version-disclosure
Evidence: Observed public version signal.
Version-linked vulnerability advisoriesbs.technology.advisories
Evidence: Advisory identifier, affected version mapping, and source.

Evidence, limits, and remediation

Evidence retained

Public fingerprint and confidence
Advisory identifiers and affected ranges

Standards mapped

Open Source Vulnerability schema
OWASP Web Security Testing Guide

False-positive discipline

Advisories require an observable version match. Product-name-only matches do not prove vulnerability.

Remediation

Upgrade the affected component to a fixed release.
Remove unnecessary version disclosure.

Limitations

Hidden, bundled, backported, or custom-patched versions can make remote version mapping inconclusive.

Partial: Useful evidence was collected, but one or more bounded stages could not be verified. The category is withheld from a clean pass and from weighted score credit.

Unavailable: The category could not produce reliable evidence, was not authorized, or was not applicable. The report records the reason and excludes that missing coverage from a verified pass.

Injection

Extended base moduleactive

Uses bounded differential probes for externally observable injection behavior.

Authorization: Requires a signed-in, non-anonymous scan owned by the account or team and a currently verified domain.
Bounded request profile: Uses a capped parameter set, safe non-destructive probes, baselines, and strict timeouts.

Public check families

Database error differentialbs.injection.sql-error
Evidence: Baseline and probe response difference with sanitized error class.
Boolean response differentialbs.injection.sql-boolean
Evidence: Reproducible true, false, and baseline comparison.
Command-processing signalbs.injection.command-signal
Evidence: High-signal sanitized response differential.

Evidence, limits, and remediation

Evidence retained

Baseline and probe response fingerprints
Reproducibility outcome

Standards mapped

OWASP Top 10
OWASP Web Security Testing Guide

False-positive discipline

A finding is downgraded or withheld when the differential is unstable or lacks required proof.

Remediation

Use parameterized queries and safe process APIs.
Validate inputs by schema and allowlist.
Run services with least privilege.

Limitations

The module does not brute force parameters or attempt destructive exploitation.

Partial: Useful evidence was collected, but one or more bounded stages could not be verified. The category is withheld from a clean pass and from weighted score credit.

Unavailable: The category could not produce reliable evidence, was not authorized, or was not applicable. The report records the reason and excludes that missing coverage from a verified pass.

XSS

Extended base modulehybrid

Looks for bounded reflected and client-side script-injection signals.

Authorization: Requires a signed-in, non-anonymous scan owned by the account or team and a currently verified domain.
Bounded request profile: Uses a capped public parameter set and static client-code analysis with response-size limits.

Public check families

Context-sensitive input reflectionbs.xss.reflection
Evidence: Parameter class and sanitized reflection context.
Client-side source and sink signalsbs.xss.dom-flow
Evidence: Public script location and matched source-to-sink class.
Dynamic code execution usagebs.xss.dynamic-code
Evidence: Public script location and safe function category.

Evidence, limits, and remediation

Evidence retained

Sanitized reflection context
Public script and code-location metadata

Standards mapped

OWASP Top 10
OWASP Web Security Testing Guide

False-positive discipline

Static DOM signals are labeled for verification unless an exploitable flow is proven.

Remediation

Encode output for its destination context.
Use safe DOM APIs and trusted templating.
Apply a restrictive CSP as defense in depth.

Limitations

Complex authenticated and multi-step browser flows require manual verification.

Partial: Useful evidence was collected, but one or more bounded stages could not be verified. The category is withheld from a clean pass and from weighted score credit.

Unavailable: The category could not produce reliable evidence, was not authorized, or was not applicable. The report records the reason and excludes that missing coverage from a verified pass.

Subdomains

Extended base modulehybrid

Enumerates a bounded public set and checks reachable hosts for takeover and transport signals.

Authorization: Runs against the submitted public URL. It does not authorize verified-owner background engines.
Bounded request profile: Caps discovered names and validates each candidate with bounded DNS and HTTP requests.

Public check families

Public subdomain inventorybs.subdomains.inventory
Evidence: Normalized host and discovery source class.
Dangling service bindingbs.subdomains.takeover
Evidence: DNS chain, service fingerprint, and verification state.
HTTPS reachabilitybs.subdomains.transport
Evidence: Public reachability and transport outcome.

Evidence, limits, and remediation

Evidence retained

Public DNS chain
HTTP reachability
Provider fingerprint and confidence

Standards mapped

RFC 1035 domain names
OWASP Web Security Testing Guide

False-positive discipline

A candidate without provider-specific proof remains unverified and cannot be treated as confirmed takeover.

Remediation

Remove stale DNS records or reclaim the referenced service.
Enable valid HTTPS on active subdomains.

Limitations

The bounded inventory is not guaranteed to discover every private or obscure subdomain.

Partial: Useful evidence was collected, but one or more bounded stages could not be verified. The category is withheld from a clean pass and from weighted score credit.

Unavailable: The category could not produce reliable evidence, was not authorized, or was not applicable. The report records the reason and excludes that missing coverage from a verified pass.

WAF

Extended base modulehybrid

Identifies observable web-application firewall signals and bounded response behavior.

Authorization: Runs against the submitted public URL. It does not authorize verified-owner background engines.
Bounded request profile: Uses passive fingerprints plus a small, safe response-differential matrix.

Public check families

WAF or edge-protection fingerprintbs.waf.fingerprint
Evidence: Matched public header, cookie, or response signature.
Bounded protection responsebs.waf.coverage
Evidence: Baseline and probe response classification.

Evidence, limits, and remediation

Evidence retained

Public protection signature
Baseline and probe response summary

Standards mapped

OWASP Web Security Testing Guide

False-positive discipline

No detectable fingerprint does not prove that no protection exists. Inconclusive probes remain partial.

Remediation

Review edge and application protections for sensitive routes.
Tune rules using monitored, non-production validation before blocking.

Limitations

The module does not publish attack strings and is not a comprehensive WAF evasion assessment.

Partial: Useful evidence was collected, but one or more bounded stages could not be verified. The category is withheld from a clean pass and from weighted score credit.

Unavailable: The category could not produce reliable evidence, was not authorized, or was not applicable. The report records the reason and excludes that missing coverage from a verified pass.

Ports

Extended base moduleactive

Checks a bounded set of high-risk public TCP services.

Authorization: Requires a signed-in, non-anonymous scan owned by the account or team and a currently verified domain.
Bounded request profile: Uses capped TCP connection attempts for a fixed high-risk service set with short timeouts.

Public check families

Public datastore servicesbs.ports.datastores
Evidence: Resolved public address, port class, and connect outcome.
Public remote administration servicesbs.ports.remote-admin
Evidence: Resolved public address, port class, and connect outcome.
Legacy cleartext servicesbs.ports.legacy
Evidence: Resolved public address, port class, and connect outcome.

Evidence, limits, and remediation

Evidence retained

Public address family
Port class and connection outcome

Standards mapped

OWASP Application Security Verification Standard

False-positive discipline

A successful TCP connection proves reachability, not that the service is unauthenticated or exploitable.

Remediation

Restrict the service to private networks or trusted source ranges.
Require authenticated encrypted access through a controlled gateway.

Limitations

This is a fixed high-risk port review, not a full network port scan or service exploit.

Partial: Useful evidence was collected, but one or more bounded stages could not be verified. The category is withheld from a clean pass and from weighted score credit.

Unavailable: The category could not produce reliable evidence, was not authorized, or was not applicable. The report records the reason and excludes that missing coverage from a verified pass.

Bundle Secrets

Extended base modulepassive

Checks publicly shipped scripts and configuration artifacts for credential-like material.

Authorization: Runs against the submitted public URL. It does not authorize verified-owner background engines.
Bounded request profile: Caps discovered HTTP(S) script follow-ups at ten, validates each fetch and redirect against the scanner SSRF policy, and limits bytes and analysis time.

Public check families

Credential-like material in shipped assetsbs.bundle-secrets.credentials
Evidence: Secret class and sanitized public asset location.
Sensitive service configurationbs.bundle-secrets.service-config
Evidence: Configuration class and sanitized public asset location.
Private-key materialbs.bundle-secrets.private-keys
Evidence: Key class and public asset location without key contents.

Evidence, limits, and remediation

Evidence retained

Public asset URL without credentials, query, or fragment and with credential-like path segments redacted
Detector class

Standards mapped

OWASP Top 10
NIST Secure Software Development Framework

False-positive discipline

Known public identifiers are separated from privileged credentials. Findings retain redacted proof only.

Remediation

Remove the secret from shipped assets and source history.
Rotate the credential immediately.
Move privileged operations to server-only code.

Limitations

Eligible cross-origin scripts referenced by the entry page may be fetched. Origin equality is not required, while every destination must pass public-address validation.
Minification and generated code can reduce source-location precision. Credential-like URL path segments are redacted, and unsafe or ambiguous source locations are withheld. No reusable credential is returned publicly.

Partial: Useful evidence was collected, but one or more bounded stages could not be verified. The category is withheld from a clean pass and from weighted score credit.

Unavailable: The category could not produce reliable evidence, was not authorized, or was not applicable. The report records the reason and excludes that missing coverage from a verified pass.

Supabase

Extended base moduleactive

Validates observable Supabase configuration and bounded unauthenticated data access.

Authorization: Runs against the submitted public URL. It does not authorize verified-owner background engines.
Bounded request profile: Uses redacted public configuration discovery and capped read-only API requests before domain verification.

Public check families

Privileged key exposurebs.supabase.privileged-key
Evidence: Redacted key class and public asset location.
Unauthenticated table accessbs.supabase.rls
Evidence: Endpoint class, safe request outcome, and response shape summary.
Public storage enumerationbs.supabase.storage
Evidence: Bucket class and bounded read outcome.

Evidence, limits, and remediation

Evidence retained

Redacted configuration fingerprint
Read-only API outcome
Safe response-shape summary

Standards mapped

OWASP Application Security Verification Standard
OWASP Top 10

False-positive discipline

A public anonymous key alone is not a vulnerability. The report distinguishes intended client keys from privileged keys and data-access proof.

Remediation

Rotate any privileged key exposed to clients.
Enable and test row-level security.
Restrict storage policies to intended public objects.

Limitations

Only bounded unauthenticated read checks run; authenticated roles and mutation paths are not exercised.
The module cannot prove authorization correctness for authenticated roles from an anonymous public scan.

Partial: Useful evidence was collected, but one or more bounded stages could not be verified. The category is withheld from a clean pass and from weighted score credit.

Unavailable: The category could not produce reliable evidence, was not authorized, or was not applicable. The report records the reason and excludes that missing coverage from a verified pass.

Firebase

Extended base moduleactive

Tests observable Firebase services for bounded unauthenticated read access.

Authorization: Runs against the submitted public URL. It does not authorize verified-owner background engines.
Bounded request profile: Uses public configuration discovery and capped read-only requests to detected services.

Public check families

Firebase configuration exposure contextbs.firebase.config
Evidence: Public project identifiers with credential values redacted.
Realtime Database read accessbs.firebase.database
Evidence: Bounded unauthenticated read outcome.
Firestore read accessbs.firebase.firestore
Evidence: Bounded unauthenticated read outcome.
Storage read accessbs.firebase.storage
Evidence: Bounded unauthenticated list or read outcome.

Evidence, limits, and remediation

Evidence retained

Redacted project configuration
Read-only service response outcome

Standards mapped

OWASP Application Security Verification Standard
OWASP Top 10

False-positive discipline

Client configuration is not automatically a secret. Severity depends on verified backend access.

Remediation

Restrict database and storage rules.
Test rules with authenticated and unauthenticated identities.
Rotate credentials only when privileged material was exposed.

Limitations

The public module does not validate every authenticated role or application-specific authorization rule.

Partial: Useful evidence was collected, but one or more bounded stages could not be verified. The category is withheld from a clean pass and from weighted score credit.

Unavailable: The category could not produce reliable evidence, was not authorized, or was not applicable. The report records the reason and excludes that missing coverage from a verified pass.

Reputation

Extended base modulepassive

Checks supported public threat and blocklist sources.

Authorization: Runs against the submitted public URL. It does not authorize verified-owner background engines.
Bounded request profile: Uses a fixed set of domain-reputation providers and DNS blocklist lookups.

Public check families

Safe browsing reputationbs.reputation.safe-browsing
Evidence: Provider verdict and observation time.
Supported domain blocklistsbs.reputation.blocklists
Evidence: List name, normalized domain, and lookup outcome.

Evidence, limits, and remediation

Evidence retained

Provider or list name
Verdict and observation time

Standards mapped

No normative mapping is claimed.

False-positive discipline

A listing is provider evidence, not proof of current compromise. Provider review can change over time.

Remediation

Investigate compromise and abusive content.
Remediate the cause before requesting delisting from the provider.

Limitations

Coverage depends on external provider availability and update cadence.

Partial: Useful evidence was collected, but one or more bounded stages could not be verified. The category is withheld from a clean pass and from weighted score credit.

Unavailable: The category could not produce reliable evidence, was not authorized, or was not applicable. The report records the reason and excludes that missing coverage from a verified pass.

Client-Side Threats

Extended base modulepassive

Reviews publicly shipped client code and resources for high-risk behavior signals.

Authorization: Runs against the submitted public URL. It does not authorize verified-owner background engines.
Bounded request profile: Caps public script and document bytes, asset count, and analysis time.

Public check families

Payment-skimmer behavior signalsbs.client-threats.skimmer
Evidence: Public script location and safe behavior class.
Cryptomining behavior signalsbs.client-threats.miner
Evidence: Public script location and safe behavior class.
Suspicious redirect behaviorbs.client-threats.redirect
Evidence: Public script location and redirect class.
Third-party resource integritybs.client-threats.sri
Evidence: Cross-origin resource URL and integrity-attribute state.
Mixed active or passive contentbs.client-threats.mixed-content
Evidence: Public insecure resource URL and document context.

Evidence, limits, and remediation

Evidence retained

Public script or resource URL
Behavior class and code-location metadata

Standards mapped

OWASP Top 10
Content Security Policy Level 3

False-positive discipline

Obfuscation alone is not treated as malicious. High-severity claims require corroborating behavior evidence.

Remediation

Remove or isolate untrusted scripts.
Pin trusted third-party resources with integrity metadata where supported.
Serve every active resource over HTTPS.

Limitations

Heuristic static analysis cannot prove intent and may require manual review.

Partial: Useful evidence was collected, but one or more bounded stages could not be verified. The category is withheld from a clean pass and from weighted score credit.

Unavailable: The category could not produce reliable evidence, was not authorized, or was not applicable. The report records the reason and excludes that missing coverage from a verified pass.

Nuclei

Verified-owner background engineactive

Runs a curated, non-destructive template set on an isolated verified-owner worker.

Authorization: Requires a signed-in, non-anonymous scan owned by the account or team and a currently verified domain.
Bounded request profile: Uses curated severity filters, strict rate and time limits, public-address enforcement, and capped findings.

Public check families

Curated vulnerability templatesbs.nuclei.curated-templates
Evidence: Template identifier, severity, matched public location, and sanitized matcher evidence.

Evidence, limits, and remediation

Evidence retained

Template identifier and version context
Sanitized matcher evidence
Public target location

Standards mapped

OWASP Web Security Testing Guide

False-positive discipline

A normalized finding retains the originating template ID and evidence for review.

Remediation

Apply the vendor or framework fix referenced by the confirmed finding.
Re-run the verified-owner engine after remediation.

Limitations

Denial-of-service, brute-force, intrusive, and fuzz classes are excluded from the public policy.

Partial: Useful evidence was collected, but one or more bounded stages could not be verified. The category is withheld from a clean pass and from weighted score credit.

Unavailable: The category could not produce reliable evidence, was not authorized, or was not applicable. The report records the reason and excludes that missing coverage from a verified pass.

OWASP ZAP

Verified-owner background enginehybrid

Runs bounded baseline or explicitly configured API analysis on an isolated verified-owner worker.

Authorization: Requires a signed-in, non-anonymous scan owned by the account or team and a currently verified domain.
Bounded request profile: Defaults to bounded baseline analysis. Any configured active path keeps strict duration, scope, and finding caps.

Public check families

Passive baseline alertsbs.zap.baseline
Evidence: ZAP alert identifier, confidence, public location, and sanitized evidence.
Configured API surface analysisbs.zap.configured-api
Evidence: Alert identifier and in-scope endpoint evidence.

Evidence, limits, and remediation

Evidence retained

ZAP alert and confidence identifiers
Sanitized public endpoint evidence

Standards mapped

OWASP ZAP baseline methodology
OWASP Web Security Testing Guide

False-positive discipline

Confidence and evidence are preserved. Alerts without sufficient proof remain review items.

Remediation

Follow the alert-specific fix and verify it against the affected endpoint.
Re-run the engine after deployment.

Limitations

Baseline mode is not equivalent to a full authenticated penetration test.

Partial: Useful evidence was collected, but one or more bounded stages could not be verified. The category is withheld from a clean pass and from weighted score credit.

Unavailable: The category could not produce reliable evidence, was not authorized, or was not applicable. The report records the reason and excludes that missing coverage from a verified pass.

Medusa

Verified-owner background enginepassive

Analyzes code-like artifacts that the verified site publicly ships.

Authorization: Requires a signed-in, non-anonymous scan owned by the account or team and a currently verified domain.
Bounded request profile: Caps public asset count, source-map collection, bytes, analysis duration, and normalized findings.

Public check families

Public client-code security rulesbs.medusa.code-rules
Evidence: Rule identifier, public file, line location, and sanitized message.
Public source-map analysisbs.medusa.source-maps
Evidence: Public artifact location and mapped code-location metadata.

Evidence, limits, and remediation

Evidence retained

Rule identifier
Public file and line metadata
Sanitized finding message

Standards mapped

SARIF 2.1.0
NIST Secure Software Development Framework

False-positive discipline

Every normalized finding keeps a rule ID and code location for review.

Remediation

Fix the referenced code path and remove unnecessary public source artifacts.
Rebuild and re-run the engine.

Limitations

Only artifacts publicly delivered by the target are analyzed. Customer source code is never executed.

Partial: Useful evidence was collected, but one or more bounded stages could not be verified. The category is withheld from a clean pass and from weighted score credit.

Unavailable: The category could not produce reliable evidence, was not authorized, or was not applicable. The report records the reason and excludes that missing coverage from a verified pass.

GitHub Repository Scanner

Repository modulepassive

Analyzes an authenticated public-repository snapshot or an explicitly connected private repository for secure-development risks.

Authorization: An authenticated request may analyze an exact public GitHub repository reference. Private repository access requires an explicit connected-repository grant; a URL scan never implies repository access.
Bounded request profile: Prefers one fixed-host public GitHub codeload snapshot with strict archive, file-count, byte, and analysis limits. Private or out-of-contract repositories can use the authenticated GitHub API fallback within bounded request and file limits when an explicit connected-repository grant is available; otherwise collection is unavailable.

Public check families

Committed secret and credential patternsbs.github-repository.secrets
Evidence: Rule identifier, repository-relative path, line metadata, and redacted fingerprint.
Dependency vulnerability signalsbs.github-repository.dependencies
Evidence: Package, declared version, advisory identifier, and manifest location.
Framework security patternsbs.github-repository.frameworks
Evidence: Rule identifier and repository-relative code location.
Container and CI hardeningbs.github-repository.pipeline
Evidence: Rule identifier and configuration location.

Evidence, limits, and remediation

Evidence retained

Stable rule identifier
Repository-relative file and line metadata
Redacted proof

Standards mapped

NIST Secure Software Development Framework
OWASP Top 10

False-positive discipline

Findings preserve source locations and rule IDs for repository-owner review. Secret values remain redacted.

Remediation

Fix the referenced code or configuration.
Rotate exposed credentials and remove them from history.
Upgrade affected dependencies.

Limitations

Static analysis does not execute the repository and cannot prove every runtime control.
A public snapshot that exceeds the analysis selection budget is reported as partial, never as a clean result. An inaccessible or invalid snapshot is unavailable unless the authenticated API fallback can collect bounded evidence.
The snapshot path supports exact public GitHub repository references only. It does not imply that every repository fits the archive contract or that private repositories are accessible without a connected grant.

Partial: Useful evidence was collected, but one or more bounded stages could not be verified. The category is withheld from a clean pass and from weighted score credit.

Unavailable: The category could not produce reliable evidence, was not authorized, or was not applicable. The report records the reason and excludes that missing coverage from a verified pass.

Orchestration & safety

Applicable base and extended-base modules run concurrently and publish the base report when their required work is terminal.
Public and anonymous scans run base modules only. Injection, XSS, and Ports, plus the external Nuclei, ZAP, and Medusa engines, require a signed-in, non-anonymous scan of a domain owned by that user or team and marked VERIFIED.
Without that authorization, a requested background engine is authorization_required. A module that was not requested is not_requested. Neither state is presented as queued or running.
On eligible scans, all six heavy scanners run independently in the background, do not block the base report, and update it when each result is ready.
Per-scanner timeouts and a per-category circuit breaker keep scans predictable. Runtime thresholds are operational controls and are not advertised as a universal request allowance.
All scanning is bounded and non-destructive: no exploit payloads, no DoS-class tests, SSRF-defended fetches, rate limits throughout.