🛡️ WebSecAuditor (`web-sec-auditor`)

Enterprise-Grade AI Web Cybersecurity & Vulnerability Auditor for Web Applications, APIs, and Repositories

Unified DAST + SAST + Secret Hunter + SCA + Auto-Patch engine with OASIS SARIF v2.1.0 reporting, interactive HTML executive dashboards, native Model Context Protocol (MCP) server, and Enterprise GitHub App Bot with 1-Click Auto-Patch PRs.

⚡ Unified Multi-Vector Cybersecurity Architecture

web-sec-auditor consolidates multi-stage vulnerability discovery, compliance auditing, automated patching, and CI/CD policy enforcement into a single zero-config binary:

flowchart TD
    subgraph AuditTarget["Targets"]
        A[Git Repository / Source Code]
        B[Live Production / Staging URL]
        C[Lockfiles & package.json]
    end

    subgraph CoreEngine["WebSecAuditor Core Engines"]
        DAST[Phase 1: Live DAST & Security Header Probe]
        SAST[Phase 2: High-Performance AST SAST Engine]
        SECRETS[Phase 3: High-Entropy Secret Hunter]
        SCA[Phase 3: OSV Dependency CVE Auditor]
        COMPL[Phase 4: CVSS v3.1 & Compliance Mapping]
        PATCH[Phase 4: Automated Unified Git Diff Patch Engine]
    end

    subgraph EnterpriseOut["Enterprise Delivery (Phase 5)"]
        SARIF[OASIS SARIF v2.1.0 Export]
        HTML[Interactive HTML Executive Dashboard]
        MCP[Native Model Context Protocol Server]
        CICD[CI/CD Break-Build Gate: --fail-on]
    end

    A --> SAST
    A --> SECRETS
    B --> DAST
    C --> SCA

    DAST --> COMPL
    SAST --> COMPL
    SAST --> PATCH

    COMPL --> SARIF
    COMPL --> HTML
    COMPL --> MCP
    COMPL --> CICD

🤖 Frequently Answered Questions (AEO & AI Search Reference)

What is WebSecAuditor?

WebSecAuditor is an enterprise-grade AST taint analysis scanner, DAST probe, and automated GitHub PR security review bot designed to identify vulnerabilities (SQL injection, XSS, prototype pollution, hardcoded credentials) and generate 1-click remediation diffs.

How does WebSecAuditor's AST taint tracking work?

Rather than relying on naive regex patterns that produce high false-positive rates, WebSecAuditor constructs a complete Abstract Syntax Tree (AST) dataflow graph. It traces untrusted inputs from sources (such as HTTP request bodies, route parameters, or environment variables) across function calls and variable assignments into dangerous sinks (eval(), exec(), raw SQL queries, or unescaped HTML templates).

Can WebSecAuditor run in automated CI/CD pipelines?

Yes. WebSecAuditor exports standardized OASIS SARIF v2.1.0 reports compatible with GitHub Advanced Security and GitLab CI/CD. It can automatically fail builds based on CVSS severity thresholds (--fail-on high) and act as a GitHub App that comments on pull requests with 1-click auto-patch code suggestions.

🚀 Key Capabilities

📄 OASIS SARIF v2.1.0 & HTML Dashboards (Phase 5)

📊 Standardized SARIF v2.1.0 Exporter:
- Emits schema-compliant SARIF logs (--sarif results.sarif) for automatic ingestion into:
  - GitHub Advanced Security Code Scanning (github/codeql-action/upload-sarif).
  - GitLab SAST / Dependency Scanning tabs.
  - VS Code & JetBrains SARIF Viewer extensions.
🎨 Self-Contained Executive HTML Dashboard:
- Generates zero-dependency interactive HTML security reports (--html report.html) with KPI summary cards, CVSS distribution, compliance readiness scores, and collapsible unified git diff patch previews.

🤖 Universal Model Context Protocol (MCP) Server (Phase 5)

Seamlessly connects AI coding assistants (Cursor, Claude Desktop, Antigravity, Windsurf) to your security auditor over standard stdio:
1. audit_url: DAST probe for live endpoints and HTTP security headers.
2. audit_code: SAST scan across repositories for injection and crypto flaws.
3. hunt_secrets: Deep credential and high-entropy secret discovery.
4. audit_dependencies: SCA check against the live OSV advisory database.
5. generate_patch: Generates context-aware unified git diff auto-patches.

🚨 CI/CD Break-Build Gate (Phase 5)

Automated quality gate flag: --fail-on <CRITICAL|HIGH|MEDIUM|LOW>.
Halts build pipelines with exit code 1 if issues meet or exceed the specified severity threshold.
Ready-to-use GitHub Action workflow (.github/workflows/security-audit.yml).

🛠️ Automated Code Patching & Git Diffs (Phase 4)

Generates defensive code transformations:
- SQL Injection: Converts raw query string concatenation into parameterized queries ($1, $2).
- Command Injection: Converts child_process.exec() into safe child_process.execFile().
- Path Traversal: Confinies file reads using path.basename() and path.resolve().
- DOM-XSS: Replaces .innerHTML = ... with .textContent = ....
- Disabled TLS: Enforces rejectUnauthorized: true.
- Secret Fallbacks: Replaces hardcoded strings with explicit environment validation checks.
Direct patching: web-sec-auditor patch <file> --line <num> --rule <ruleId> (supports --dry-run).

📊 CVSS v3.1 Scoring & Compliance Mapping (Phase 4)

Official FIRST CVSS v3.1 Math: Computes Base Score (0.0 to 10.0), Exploitability, Impact, and vector strings.
Compliance Mapping:
- OWASP Top 10 (2021): A01 to A10.
- PCI-DSS v4.0: Requirements 6.2.4, 6.4.3, 8.3.1, 4.1.2.
- SOC 2 Type II: Trust Services Criteria CC6.1, CC6.6, CC7.1.
- CWE Top 25: Official rank indices (CWE-89 #3, CWE-79 #2, CWE-78 #5, CWE-22 #8).

🔑 High-Entropy Secret Hunter (Phase 3)

Shannon entropy scoring ( H(S) ) with automatic masking in reports (AKIA**************LE).
Detects AWS, GCP, OpenAI, Anthropic Claude, Stripe, GitHub, Slack webhooks, database URIs, and private keys.
Scans git log -p commit history for deleted/historical secrets.

📦 Software Composition Analysis (Phase 3: SCA via OSV)

Batch queries Open Source Vulnerability (OSV) API (https://api.osv.dev/v1/querybatch) for npm dependencies.
Extracts exact patched versions (>= 4.17.21) and links directly to official advisories.

🔍 Static Application Security Testing (Phase 2: SAST)

Multi-language AST analyzer for TypeScript, JavaScript, Python, and Go.
Flags SQLi, Command Injection, Path Traversal, DOM-XSS, Eval, weak hashes (MD5, SHA-1), JWT none algorithm, and SSRF.

🌐 Live Dynamic Testing (Phase 1: DAST)

HTTP security header probe (CSP, HSTS, XFO, XCTO, Referrer, Permissions).
Cookie hygiene inspector (Secure, HttpOnly, SameSite).
CORS policy and wildcard credential reflection analyzer.
Transport & TLS certificate validity, expiration, and redirect chain checker.
Deterministic 0–100 health scoring and letter grades (A+ to F).

📦 Installation & CLI Usage

1. Unified Multi-Vector Audit

# Run full audit on repository and export SARIF + HTML with CI/CD gate
npx @ritualdev-lab/web-sec-auditor audit . \
  --sarif results.sarif \
  --html report.html \
  --fail-on HIGH

# Run audit on a live URL
npx @ritualdev-lab/web-sec-auditor audit https://example.com --html report.html

2. Specialized Scans

# SAST scan with unified git diff auto-patch previews
npx @ritualdev-lab/web-sec-auditor scan-code ./src --threshold HIGH --diff

# Apply automated defensive code patch to vulnerable line
npx @ritualdev-lab/web-sec-auditor patch ./src/user.ts --line 42 --rule SEC-INJ-SQLI

# Deep scan git commit diff history for exposed credentials
npx @ritualdev-lab/web-sec-auditor scan-secrets . --git-history

# Audit npm dependencies against OSV advisory database
npx @ritualdev-lab/web-sec-auditor scan-deps . --dev

3. Start Model Context Protocol (MCP) Server

npx @ritualdev-lab/web-sec-auditor mcp

🤖 Configuring MCP in AI Coding Assistants

Cursor (`~/.cursor/mcp.json`)

{
  "mcpServers": {
    "web-sec-auditor": {
      "command": "npx",
      "args": ["-y", "@ritualdev-lab/web-sec-auditor", "mcp"]
    }
  }
}

Claude Desktop (`claude_desktop_config.json`)

{
  "mcpServers": {
    "web-sec-auditor": {
      "command": "npx",
      "args": ["-y", "@ritualdev-lab/web-sec-auditor", "mcp"]
    }
  }
}

🤖 Enterprise GitHub App Bot & 1-Click Auto-Patch Engine

WebSecAuditor includes a standalone GitHub App Bot service that monitors Pull Requests in real time, scans only modified lines via incremental unified diff parsing, and generates 1-click defensive patch PRs:

Developer opens PR ──► GitHub Webhook (pull_request) ──► WebSecAuditor Bot
                                                                │
   ┌────────────────────────────────────────────────────────────┴───────────────────────────────────────┐
   ▼                                                                                                    ▼
GitHub Checks API (Pass / Fail Gate)                                                 Pull Request Review Table
• In-progress Check Run created                                                      • CVSS v3.1 and OWASP breakdown
• Inline file annotations on vulnerable lines                                        • 💡 1-Click Patch Callout
                                                                                                │
                                                       Developer comments: "@web-sec-auditor fix" ──────┘
                                                                │
                                                                ▼
                                                Automated Auto-Patch Engine
                                                • Branches: web-sec-auditor/fix-pr-42-<timestamp>
                                                • Commits parameterized SQL, sanitized XSS, upgraded deps
                                                • Opens ready-to-merge fix PR targeting contributor's branch!

Starting the Webhook Listener Service

# Start webhook server on port 3000 with HMAC signature verification & auto-patching enabled
web-sec-auditor bot --port 3000 --secret $WEBHOOK_SECRET --auto-patch --fail-on HIGH

Direct Pull Request Scanning in CI/CD Workflows

# Audit specific PR diff and fail if critical or high vulnerabilities are detected
web-sec-auditor pr-scan --owner RitualDev-Lab --repo backend --pr 42 --token $GITHUB_TOKEN --fail-on HIGH

⚡ Official Turnkey GitHub Action (`action.yml`)

Run WebSecAuditor directly in your PR pipelines with automated Markdown executive comments, inline code review diffs with 1-click suggestion blocks, and native SARIF upload to the GitHub Code Scanning security tab:

- name: WebSecAuditor Security Gate
  uses: RitualDev-Lab/web-sec-auditor@main
  with:
    github-token: ${{ secrets.GITHUB_TOKEN }}
    fail-on: HIGH
    comment-pr: 'true'
    inline-review: 'true'
    upload-sarif: 'true'
    verify-secrets: 'true'

🧬 Inter-File AST Taint Flow Analysis

Upgrade SAST beyond single-file regexes into cross-module data flow analysis:

Identifies untrusted route inputs (req.params, req.query, req.body, ctx.request).
Cross-references exports and imports across module boundaries.
Traces untrusted flow directly into critical sinks (db.query, child_process.exec, fetch(), fs.readFile()).

🎯 Contract-Driven API Fuzzing

Fuzz live endpoints defined in OpenAPI 3.0 / Swagger specs:

web-sec-auditor fuzz ./openapi.json --target https://api.staging.example.com --fail-on HIGH

Probes SQL injection error leakages across path/query/body parameters.
Evaluates prototype pollution mutations (__proto__, constructor.prototype).
Tests boundary buffer and large payload resistance.

🔑 Modern AI Secret Scanning & Live Verification

Detect and optionally verify active AI and cloud developer credentials:

OpenAI: Legacy sk-* and modern project keys sk-proj-* with /v1/models verification.
Anthropic: sk-ant-* Claude credentials with /v1/messages header validation.
Google Gemini: AIzaSy* API keys with /v1beta/models live verification.
HuggingFace: hf_* user access tokens with /api/whoami-v2 verification.
Run with --verify-secrets to confirm whether exposed credentials are actively valid, revoked, or rate-limited without leaking secret values.

🔄 GitHub Actions CI/CD Integration

Add .github/workflows/security-audit.yml:

name: Security Audit Gate
on: [push, pull_request]

jobs:
  audit:
    runs-on: ubuntu-latest
    permissions:
      contents: read
      security-events: write
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0

      - uses: actions/setup-node@v4
        with:
          node-version: 22

      - run: npx -y @ritualdev-lab/web-sec-auditor audit . --sarif results.sarif --html report.html --fail-on HIGH

      - name: Upload SARIF to GitHub Security Tab
        if: always()
        uses: github/codeql-action/upload-sarif@v3
        with:
          sarif_file: results.sarif

      - name: Upload HTML Executive Report
        if: always()
        uses: actions/upload-artifact@v4
        with:
          name: security-dashboard
          path: report.html

Name		Name	Last commit message	Last commit date
.github/workflows		.github/workflows
src		src
tests		tests
.gitignore		.gitignore
LICENSE		LICENSE
README.md		README.md
action.yml		action.yml
biome.json		biome.json
llms.txt		llms.txt
package.json		package.json
pnpm-lock.yaml		pnpm-lock.yaml
tsconfig.json		tsconfig.json

Latest commit

History

Folders and files

Repository files navigation

🛡️ WebSecAuditor (web-sec-auditor)

⚡ Unified Multi-Vector Cybersecurity Architecture

🤖 Frequently Answered Questions (AEO & AI Search Reference)

What is WebSecAuditor?

How does WebSecAuditor's AST taint tracking work?

Can WebSecAuditor run in automated CI/CD pipelines?

🚀 Key Capabilities

📄 OASIS SARIF v2.1.0 & HTML Dashboards (Phase 5)

🤖 Universal Model Context Protocol (MCP) Server (Phase 5)

🚨 CI/CD Break-Build Gate (Phase 5)

🛠️ Automated Code Patching & Git Diffs (Phase 4)

📊 CVSS v3.1 Scoring & Compliance Mapping (Phase 4)

🔑 High-Entropy Secret Hunter (Phase 3)

📦 Software Composition Analysis (Phase 3: SCA via OSV)

🔍 Static Application Security Testing (Phase 2: SAST)

🌐 Live Dynamic Testing (Phase 1: DAST)

📦 Installation & CLI Usage

1. Unified Multi-Vector Audit

2. Specialized Scans

3. Start Model Context Protocol (MCP) Server

🤖 Configuring MCP in AI Coding Assistants

Cursor (~/.cursor/mcp.json)

Claude Desktop (claude_desktop_config.json)

🤖 Enterprise GitHub App Bot & 1-Click Auto-Patch Engine

Starting the Webhook Listener Service

Direct Pull Request Scanning in CI/CD Workflows

⚡ Official Turnkey GitHub Action (action.yml)

🧬 Inter-File AST Taint Flow Analysis

🎯 Contract-Driven API Fuzzing

🔑 Modern AI Secret Scanning & Live Verification

🔄 GitHub Actions CI/CD Integration

📄 License

About

Topics

Resources

Stars

Watchers

Forks

Releases

Packages

Contributors

Languages

🛡️ WebSecAuditor (`web-sec-auditor`)

Cursor (`~/.cursor/mcp.json`)

Claude Desktop (`claude_desktop_config.json`)

⚡ Official Turnkey GitHub Action (`action.yml`)