mugdhav/security_auditor_orig

🔒 Security Auditor

Comprehensive SAST Platform for Vulnerability Detection

Scan your application code for security vulnerabilities with AI-powered analysis and NIST NVD integration.

✨ Features

🔍 Detection Capabilities

• —28+ Vulnerability Types - SQL Injection, XSS, Command Injection, and more
• —15+ Programming Languages - Python, JavaScript, Java, PHP, Go, Ruby, C/C++, and more
• —NIST NVD Integration - Enrich findings with real-world CVE data
• —Multiple Scan Modes - Local files, remote URLs, GitHub repositories

🎯 Analysis Types

1. 1.Local Directory Scan - Upload source code files for comprehensive analysis
2. 2.Remote URL Scan - Test live web applications for security misconfigurations
3. 3.GitHub Repository Scan - Analyze public or private GitHub repositories

📊 Vulnerability Categories

• —Injection Flaws - SQL, Command, LDAP, XXE, Path Traversal
• —Authentication Issues - Hardcoded credentials, weak hashing, JWT validation
• —Cryptographic Flaws - Weak algorithms, insecure random, hardcoded keys
• —Deserialization - Pickle, YAML, ObjectInputStream vulnerabilities
• —Security Misconfigurations - CORS, SSL/TLS, missing headers
• —Information Disclosure - Debug mode, sensitive logs, stack traces

🚀 How to Use

1. Upload Code (Local Scan)

• —Upload source code files (.py, .js, .java, .php, etc.)
• —Multiple files and folders supported
• —Detects vulnerabilities in real-time

2. Scan Repository (GitHub)

• —Enter GitHub repository URL
• —Supports public repositories (private with token)
• —Automatically clones and analyzes code

3. Test Web App (Remote URL)

• —Enter live application URL
• —Checks security headers
• —Scans for exposed sensitive files

🔐 Privacy & Security

• —✅ Temporary Storage Only - All files deleted after 1 hour
• —✅ No Permanent Storage - Code is never saved
• —✅ Isolated Sessions - Each scan is completely isolated
• —✅ No Logging - Source code content is not logged

📋 Report Formats

• —Interactive HTML - Visual dashboard with severity breakdown
• —JSON Export - Machine-readable format for CI/CD integration
• —Text Report - Console-friendly output

⚠️ Usage Guidelines

Only scan code and applications that:

• —You own or created
• —You have explicit permission to test
• —Are part of authorized security assessments

Do not:

• —Scan third-party applications without permission
• —Use for unauthorized security testing
• —Scan production systems without approval

🛠️ Technology Stack

• —Static Analysis - Pattern-based SAST engine with 28+ detection rules
• —NVD Integration - Real-time CVE enrichment from NIST database
• —Web Scanning - HTTP security analysis and exposed file detection
• —UI Framework - Modern Gradio interface with custom theme

📚 Detected Vulnerabilities

Critical Severity

• —SQL Injection (CWE-89)
• —Command Injection (CWE-78)
• —Insecure Deserialization (CWE-502)

High Severity

• —Cross-Site Scripting (CWE-79)
• —Hardcoded Credentials (CWE-798)
• —Weak Cryptography (CWE-327)

Medium Severity

• —Path Traversal (CWE-22)
• —LDAP Injection (CWE-90)
• —CORS Wildcard (CWE-942)

Low Severity

• —Debug Mode Enabled (CWE-215)
• —Sensitive Data in Logs (CWE-532)
• —Missing Security Headers (CWE-693)

🎓 Educational Purpose

This tool is designed for:

• —Security education and training
• —DevSecOps integration
• —Code review assistance
• —Vulnerability awareness
• —Secure coding practices

📖 Documentation

API Reference

• —OWASP Top 10
• —CWE Database
• —NIST NVD

Remediation Resources

• —Each finding includes detailed remediation guidance
• —Code examples for secure implementations
• —Framework-specific security best practices

💡 Pro Tips

1. 1.Enable NVD Enrichment for CVE correlation (slower but more detailed)
2. 2.Scan early and often - integrate into development workflow
3. 3.Review remediation guidance - learn from each finding
4. 4.Export reports for documentation and tracking
5. 5.Use GitHub mode for repository-wide analysis

🤝 Support

• —Report issues: GitHub Issues
• —Contribute: Pull requests welcome
• —Documentation: Full guide in repository

📄 License

MIT License - See LICENSE file for details

⚡ Performance

• —Scan Speed - ~1-2 seconds per 1000 files
• —Language Support - 15+ programming languages
• —Detection Rules - 28+ vulnerability patterns
• —Max Upload - 100MB per session

🔄 Updates

Regular updates include:

• —New vulnerability detection rules
• —Enhanced false positive reduction
• —Additional language support
• —Performance improvements

🛡️ Secure your code, protect your users.

Built with ❤️ for the security community.