Auto-scan on deploy · recursive fix with Claude or Codex
Coverage map
Honest inventory of trust boundaries and standards mapping for anal-probe / VibeTesting Agent. We automate the black-box observable slice — not a full pentest mind map. Gaps are deliberate: active injection, full auth abuse, and business logic need sessions and (often) staging.
From the public internet to multi-tenant isolation. Each card is a trust boundary attackers (or bad guys) try to cross.
SPF, DMARC, CAA, dangling-CNAME takeover heuristics
HTTPS, redirect, protocol/cipher grade, cert expiry, HSTS
Resolve IPs, reverse DNS, CDN fingerprint
recon mode opt-in for ports/CVE
Search engines, GitHub leaks, subdomain brute, archives
CSP, HSTS, nosniff, clickjacking, COOP/CORP, Permissions-Policy
Title, meta, canonical, lang, alt, labels, mixed content
Keys in bundles/HTML, downloadable .map files
retire.js-style version ranges (OWASP A06)
High-confidence client sinks, redirect params, third-party integrity
Payload-driven injection across every field
not safe black-box on production
.env, .git, backups, actuator, swagger, metrics…
Next / WP / Laravel / Django / Rails / Spring / ASP.NET
Dangerous verbs, reflected Origin + credentials
Researcher contact + llms.txt style signals
WorkOS, MFA, lockout, password policy, session fixation
needs authenticated testing
Can user A see user B’s projects/scans?
white-box IDOR helpers
Heuristic on public HTML; full CSRF needs session
Billing skips, race conditions, workflow abuse
GraphQL introspection, public swagger, method sprawl
Cross-user object access, role bypass
testkit idor/rbac
Leaked keys + JWT hygiene (alg:none, exp)
Stripe/GitHub signature verification bugs
app unit tests
Tenant B reaches tenant A resources
idorProbe / separation mode
Anonymous / user / admin matrix
rbacProbe
Client forges role / owner fields
massAssignmentProbe
Shared IDs across two sessions
dataIsolationProbe
Web Security Testing Guide v4.2 — the structure behind mind-map checklists like OWASP WSTG. We do not claim 100% of every test ID.
| Category | Coverage | What we do | How / limits |
|---|---|---|---|
WSTG-INFO Information Gathering Fingerprint stack, metafiles, JS leakage, architecture mapping | Partial |
| Black-box homepage + passive host; not Google/GitHub/subdomain brute |
WSTG-CONF Configuration & Deployment TLS, HTTP methods, debug surfaces, file exposure, security headers | Covered |
| Core of the free + full black-box suite |
WSTG-IDNT Identity Management Registration, account enumeration, provisioning | Out of scope |
| Needs account lifecycle tests against the app |
WSTG-ATHN Authentication Credential transport, lockout, MFA, default creds | Partial |
| Not full login abuse; WorkOS owns hosted auth |
WSTG-ATHZ Authorization Privilege escalation, IDOR, path traversal | Partial |
| White-box helpers — not automatic from a single URL |
WSTG-SESS Session Management Cookie flags, fixation, CSRF, logout | Partial |
| Cookie/JWT/CSRF heuristics; not fixation or logout flows |
WSTG-INPV Input Validation XSS, SQLi, SSRF, SSTI, LFI, command injection | Partial |
| No active payload fuzzing (by design on production targets) |
WSTG-ERRH Error Handling Stack traces, verbose errors, information leakage | Covered |
| When error pages leak internals |
WSTG-CRYP Cryptography Weak TLS, bad crypto, secrets in transit/storage | Partial |
| Transport + client-exposed secrets; not server-side crypto review |
WSTG-BUSL Business Logic Workflow abuse, races, price tampering, upload abuse | Out of scope |
| Manual / product-specific E2E |
WSTG-CLNT Client-side DOM XSS, clickjacking, CORS, storage, SRI | Covered |
| Strong black-box coverage of client surface |
WSTG-APIT API Testing REST/GraphQL authz, mass assignment, inventory | Partial |
| Public misconfig automatic; BOLA needs two sessions |
Requirements verifiable without source access or active exploitation. Full detail lives in the OSS package (docs/compliance.md). Run anal-probe URL --compliance for a live grade.
Free lite scan on the homepage, or the full CLI with compliance output.
npx github:newsengine/anal-probe https://your-app.example.com --compliance
Not a substitute for a professional pentest. A clean scan does not mean the application is secure. Active WSTG items (injection, full auth abuse, business logic) belong on staging with authorization — ZAP, Burp, or a human tester — plus our white-box helpers for multi-tenant suites.