KeyGuard AI Scan is a comprehensive, automated penetration testing platform that performs deep web application security assessments, vulnerability scanning, and penetration testing methodologies. This open-source security tool combines traditional penetration testing techniques with AI-powered analysis to detect exposed credentials, security misconfigurations, and architectural vulnerabilities.
Built for security professionals, penetration testers, and development teams, KeyGuard AI Scan automates the reconnaissance, vulnerability assessment, and analysis phases of penetration testing, providing detailed security reports with actionable remediation guidance.
- Automated Reconnaissance: Technology stack fingerprinting and attack surface mapping
- Active Vulnerability Scanning: Multi-layer security testing with 7+ comprehensive test categories
- Credential Discovery: Pattern-based detection of exposed API keys and secrets across 20+ services
- Configuration Assessment: Security header analysis, CORS validation, SSL/TLS testing
- Information Gathering: Directory traversal testing, debug endpoint discovery, server fingerprinting
- AI-Powered Analysis: Comprehensive security assessment with prioritized remediation recommendations
- Automated Reconnaissance: Real-time target profiling with live progress tracking and attack surface mapping
- Multi-Vector Analysis: Deep scanning of HTML, JavaScript, CSS, inline scripts, and external resources
- Credential Harvesting Detection: Identifies 100+ API key types across major services (AWS, Google Cloud, GitHub, Stripe, OpenAI, Discord, Slack)
- Advanced Pattern Recognition: Entropy-based analysis with confidence scoring to minimize false positives
- Intelligence Gathering: Technology stack fingerprinting (React, Vue, Angular), build tools (Webpack, Vite), and dependency mapping
- Service Enumeration: Discovers integrated third-party services (Google Analytics, Stripe, Sentry, Hotjar, Mixpanel)
- Attack Surface Analysis: Maps external resources, potential API endpoints, form actions, and security-relevant metadata
- Target-Specific Testing: Framework-aware vulnerability assessment based on detected technology stack
- Security Header Assessment: Comprehensive analysis of CSP, HSTS, X-Frame-Options, and critical security headers
- Information Disclosure Testing: Probes error pages and server responses for sensitive data leakage
- Directory Traversal & Path Discovery: Safe enumeration of exposed configuration files (.env, config.json, .git/config)
- Debug Interface Detection: Identifies publicly accessible development endpoints, admin panels, and debug information
- CORS Security Validation: Tests Cross-Origin Resource Sharing configurations for security bypasses
- SSL/TLS Implementation Testing: Validates HTTPS enforcement, redirect policies, and certificate security
- Server Fingerprinting: Detects information disclosure through server headers and technology stack exposure
- Penetration Testing Scoring: Comprehensive security scoring (0-100) based on vulnerability assessment results
- Compliance & Standards Testing: OWASP, SSL/TLS, and industry security standard validation
- Intelligent Threat Analysis: NEURA_ROUTER or OpenAI-compatible integration for advanced penetration testing insights
- Comprehensive Penetration Testing Reports: AI-driven analysis of attack vectors, vulnerability chaining, and exploitation scenarios
- Vulnerability Correlation & Prioritization: AI interprets security test results and creates attack path prioritization
- Risk-Based Severity Classification: Automated CVSS-style scoring (Critical, High, Medium, Low) with exploitation likelihood
- Penetration Testing Remediation: Expert-level fix instructions with both tactical and strategic security improvements
- Modern Attack Vector Analysis: 2025 security threat landscape including CSP bypasses, SRI attacks, and HTTPS downgrade risks
- Framework-Specific Exploitation Guidance: Targeted security recommendations for React/Next.js, Vue.js, Angular exploitation vectors
- Technology-Aware Penetration Testing: Custom attack surface analysis based on detected tech stack vulnerabilities
- Architecture Penetration Assessment: Security recommendations for API endpoints, third-party integrations, and data flow attacks
- Compliance & Regulatory Analysis: OWASP, GDPR, PCI-DSS, and industry compliance gap analysis
- Security Posture Assessment: Detailed penetration testing report with risk-prioritized remediation roadmap
- Interactive Penetration Testing Dashboard: Visual vulnerability analysis with risk scoring and attack vector mapping
- Comprehensive Penetration Testing Reports: Detailed vulnerability assessments with exploitation scenarios and proof-of-concept
- Multi-Format Export: PDF, JSON, CSV penetration testing reports with executive summaries and technical details
- Secure Report Sharing: Encrypted sharing of sensitive penetration testing results with stakeholder access controls
- Historical Assessment Tracking: Penetration testing timeline with security posture trends and remediation progress
- Real-time Testing Progress: Live updates during active penetration testing phases with detailed methodology execution
- Compliance & Standards Reporting: OWASP, PCI-DSS, NIST, and regulatory compliance assessment with gap analysis
- Executive Penetration Testing Summaries: Risk-based reporting for C-level executives and security leadership
- Penetration Tester Authentication: JWT-based secure access control for security professionals
- Rate Limiting & Throttling: Prevents aggressive scanning and maintains target system availability
- Sensitive Data Protection: Temporary storage with automatic cleanup of penetration testing artifacts
- End-to-End Encryption: All penetration testing communications secured via HTTPS/TLS
- Comprehensive Audit Logging: Full penetration testing activity tracking with detailed methodology execution logs
KeyGuard AI Scan follows established penetration testing methodologies including OWASP Testing Guide, NIST Cybersecurity Framework, and PTES (Penetration Testing Execution Standard).
- Target Profiling: Domain analysis, technology stack identification, and service enumeration
- Attack Surface Mapping: External resource discovery, endpoint enumeration, and entry point identification
- Technology Fingerprinting: Framework detection, version identification, and dependency analysis
- Third-Party Service Discovery: Integrated service identification and potential attack vectors
- Automated Security Testing: 7+ comprehensive test categories with active probing techniques
- Credential Discovery: Pattern-based analysis for exposed API keys, tokens, and secrets
- Configuration Analysis: Security header validation, CORS testing, and SSL/TLS assessment
- Information Disclosure Testing: Error page analysis, debug endpoint discovery, and sensitive file exposure
- Risk-Based Prioritization: CVSS-based scoring with exploitation likelihood assessment
- Attack Vector Analysis: Vulnerability chaining and potential exploitation scenarios
- Business Impact Assessment: Risk evaluation based on detected technologies and exposed assets
- Compliance Gap Analysis: OWASP, PCI-DSS, and regulatory compliance validation
- Executive Summary Reports: High-level findings with business impact assessment
- Technical Penetration Testing Reports: Detailed vulnerability analysis with proof-of-concept
- Remediation Roadmap: Prioritized fix recommendations with implementation timelines
- Compliance Documentation: Standards-based reporting for audit and regulatory requirements
- Security Headers Assessment (CSP, HSTS, X-Frame-Options)
- Information Disclosure Detection (Error pages, debug information)
- Directory Traversal & Path Discovery (Sensitive file exposure)
- Debug Interface Detection (Development endpoints, admin panels)
- CORS Configuration Validation (Cross-origin security bypasses)
- SSL/TLS Implementation Testing (HTTPS enforcement, certificate validation)
- Server Misconfiguration Detection (Information leakage, fingerprinting)
- Framework: React 18 with TypeScript
- Build Tool: Vite for fast development and builds
- Styling: Tailwind CSS + Shadcn/ui components
- State Management: TanStack Query for server state
- Icons: Lucide React for consistent iconography
- Language: Rust for high-performance security scanning and memory safety
- Database: LibSQL for fast penetration testing data storage and result caching
- Web Framework: Axum for async HTTP penetration testing services
- Authentication: JWT with bcrypt for secure penetration tester access control
- AI Integration: NEURA_ROUTER (OpenAI SDK compatible) for intelligent penetration testing analysis
- HTTP Client: Reqwest for comprehensive target reconnaissance and active probing
- Penetration Testing Engine: Advanced pattern recognition with entropy analysis for credential discovery
- Content Analysis Engine: Multi-layer parsing for vulnerability identification across web technologies
- Active Testing Framework: 7+ penetration testing modules for comprehensive security assessment
- Risk Assessment System: Automated penetration testing scoring with compliance validation
- Containerization: Docker with multi-stage builds
- Orchestration: Docker Compose for local development
- Ports: Frontend (11111), Backend (11112)
- Database: Persistent LibSQL with file-based storage (production-ready for scaling)
- Node.js 18+ and npm
- Rust 1.75+ (for backend development)
- Docker and Docker Compose (recommended)
-
Clone the repository
git clone <repository-url> cd keyguard-ai-scan
-
Set environment variables
cp .env.example .env # Edit .env with your NEURA_ROUTER_API_KEY -
Start the services
docker-compose up --build
-
Access the application
- Frontend: http://localhost:11111
- Backend API: http://localhost:11112
# Install dependencies
npm install
# Start development server
npm run dev# Navigate to server directory
cd server
# Build and run
cargo runVITE_API_URL=http://localhost:11112JWT_SECRET=your-secure-jwt-secret
NEURA_ROUTER_API_KEY=your-neura-router-api-key
NEURA_ROUTER_API_URL=https://api.neura-router.com/v1
RUST_LOG=info-
NEURA_ROUTER Integration
- Sign up at Neura Router or use your favotive AI platform
- Generate API key
- Add to environment variables
-
Production Deployment
- Use strong JWT secret (32+ characters)
- Enable HTTPS in production
- Configure proper CORS origins
POST /api/scan- Initiate comprehensive penetration testGET /api/scan/:id- Retrieve penetration testing results and vulnerability assessmentsGET /api/scan/:id/progress- Monitor active penetration testing progress and methodology execution
POST /api/auth/register- Register security professional accountPOST /api/auth/login- Penetration tester authenticationGET /api/user/scans- Retrieve penetration testing assessment history
GET /api/health- Service health check
POST /api/scan
{
"url": "https://target-domain.com",
"user_id": "penetration-tester-id"
}{
"success": true,
"data": {
"id": "pentest-uuid",
"url": "https://target-domain.com",
"status": "active_testing",
"findings": [],
"summary": {
"critical": 0,
"high": 0,
"medium": 0,
"low": 0,
"total": 0
},
"security_analysis": {
"frameworks": ["React", "Next.js"],
"technologies": ["Webpack", "Tailwind CSS"],
"third_party_services": ["Google Analytics", "Stripe"],
"potential_endpoints": ["/api/users", "/api/auth"],
"external_resources": ["https://cdn.target.com/script.js"],
"form_actions": ["/api/contact"],
"meta_tags": {"viewport": "width=device-width"},
"vulnerability_tests": [
{
"test_name": "CSP Header Assessment",
"status": "fail",
"severity": "medium",
"description": "Content Security Policy header missing - XSS vulnerability identified",
"recommendation": "Implement strict CSP header to mitigate XSS attack vectors"
}
],
"security_score": 75,
"compliance_status": {
"OWASP": "Partial Compliance",
"SSL/TLS": "Good",
"Security Posture": "Moderate Risk"
}
},
"ai_recommendations": "Comprehensive penetration testing analysis with attack vector prioritization..."
}
}npm run test # UI security component testing
npm run test:coverage # Security test coverage analysiscd server
cargo test # Core penetration testing module tests
cargo test --release # Performance testing for security scanning enginedocker-compose -f docker-compose.test.yml up --build # Full penetration testing platform validation# Build production images
docker-compose -f docker-compose.prod.yml build
# Deploy to production
docker-compose -f docker-compose.prod.yml up -d- Build frontend:
npm run build - Build backend:
cd server && cargo build --release - Configure reverse proxy (nginx/traefik)
- Set up SSL certificates
- Configure monitoring and logging
- Authorized Testing Only: Designed for authorized security assessments and owned assets
- Non-Destructive Testing: Read-only analysis without system compromise or data modification
- Rate Limiting: Prevents aggressive scanning that could impact target availability
- Legal Compliance: Adheres to GDPR, CCPA, and international cybersecurity regulations
- Responsible Disclosure: Security-first approach with clear vulnerability reporting
- Temporary Data Storage: Scan results stored temporarily with automatic cleanup
- End-to-End Encryption: All penetration testing data transmitted via HTTPS
- Access Controls: JWT-based authentication with session management
- Audit Logging: Comprehensive penetration testing activity tracking
- No PII Collection: Anonymized scanning without personal data storage
- Multi-Vector Assessment: Comprehensive analysis across HTML, JavaScript, CSS, and external resources
- Active Security Testing: 7+ penetration testing categories including header analysis, CORS validation, SSL/TLS assessment
- Technology Stack Penetration Testing: Framework-specific vulnerability assessment and exploit identification
- Third-Party Integration Security: Risk analysis of integrated services and potential attack vectors
- API Security Assessment: Endpoint discovery, authentication testing, and data flow analysis
- Modern Attack Vector Analysis: 2025 threat landscape including CSP bypasses, SRI exploitation, and secure header circumvention
- Penetration Testing Scoring: Industry-standard risk assessment with 0-100 security scoring
- Information Gathering: Safe enumeration of sensitive files, debug endpoints, and configuration exposure
- OWASP Testing Guide: Follows OWASP web application security testing methodology
- PTES Compliance: Aligned with Penetration Testing Execution Standard
- NIST Framework: Incorporates NIST Cybersecurity Framework principles
- Industry Best Practices: Implements professional penetration testing standards and methodologies
- Fork the repository
- Create feature branch:
git checkout -b feature/amazing-feature - Commit changes:
git commit -m 'Add amazing feature' - Push to branch:
git push origin feature/amazing-feature - Open Pull Request
- Frontend: ESLint + Prettier configuration
- Backend: Rustfmt + Clippy linting
- Testing: Minimum 80% code coverage
- Documentation: Comprehensive inline docs
- Scan Metrics: Success rates, duration, findings
- User Behavior: Feature usage, engagement patterns
- Performance: Response times, error rates
- Security: Vulnerability trends, detection accuracy
- Logging: Structured logs with tracing
- Metrics: Custom metrics for business KPIs
- Alerting: Error rate and performance alerts
- Health Checks: Automated service monitoring
- API Reference: Comprehensive endpoint documentation
- Developer Guide: Setup and customization instructions
- Security Guide: Best practices and compliance
- Troubleshooting: Common issues and solutions
- Issues: GitHub Issues for bug reports
- Discussions: Feature requests and questions
- Discord: Real-time community support
- Security: [email protected] for vulnerabilities
This project is licensed under the MIT License - see the LICENSE file for details.
- Major SEO Overhaul: Completely rebranded as comprehensive automated penetration testing platform
- Enhanced Meta Tags: Updated title (55 chars) and description (143 chars) to reflect full pentest capabilities
- Content Realignment: Landing page now showcases 7+ test categories including security headers, CORS, SSL/TLS, and vulnerability scanning
- AI/LLM Discovery Files: Added ai.txt and llm.txt for proper search engine and AI crawler indexing
- Improved SEO Structure: Fixed multiple H1 tags issue, optimized heading hierarchy for better search rankings
- Structured Data Enhancement: Added datePublished and dateModified fields for improved search visibility
- Accurate Positioning: Repositioned API key detection as one feature among comprehensive pentest capabilities (not primary focus)
- Professional Messaging: Updated all content to emphasize OWASP compliance, PTES methodology, and enterprise-grade security testing
- Enhanced Security Findings Display: Fixed security findings section to properly show vulnerability test failures alongside API key discoveries
- Improved Type Definitions: Added comprehensive TypeScript types for VulnerabilityTest and SecurityAnalysis interfaces
- Better Empty State Handling: Security dashboard now correctly displays "No security issues found" only when both API keys and vulnerability tests pass
- Bug Fix: Resolved issue where failed vulnerability tests were not triggering security findings display
- Markdown Table Rendering: Fixed AI security audit reports not rendering tables properly by adding remark-gfm plugin
- Enhanced Report Formatting: Security audit tables now display with proper styling in both light and dark modes
- Improved Readability: GitHub Flavored Markdown tables for executive summaries, compliance status, and vulnerability breakdowns now render correctly
- Enhanced Summary Calculation: Fixed vulnerability test results not being counted in the security findings summary
- Comprehensive Findings Display: Security audit now correctly shows total findings including both API key discoveries and failed vulnerability tests
- Improved Summary Metrics: Total Findings, High Priority, and Lower Priority counts now include all security issues detected during scans
- Bug Fix: Resolved issue where security header failures, exposed files, and SSL/TLS issues were not reflected in the dashboard summary
- Environment Configuration: Fixed VITE_API_URL configuration for proper frontend-backend communication in Docker deployments
- Active Vulnerability Testing Engine: Comprehensive security testing with 7+ test categories including security headers, information disclosure, directory traversal, debug endpoints, CORS, SSL/TLS, and server misconfigurations
- Security Scoring System: Automated 0-100 security score calculation based on API key findings and vulnerability test results
- Compliance Assessment: OWASP, SSL/TLS, and overall security posture compliance checking with detailed status reporting
- Enhanced AI Security Analysis: Updated AI system to interpret active vulnerability test results and provide prioritized remediation recommendations
- Modular Security Testing Architecture: Organized security tests into dedicated module (security_tests.rs) for maintainability and extensibility
- Advanced Security Headers Testing: Comprehensive analysis of CSP, HSTS, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, and Permissions-Policy headers
- Safe Information Disclosure Detection: Non-intrusive testing for sensitive data exposure in error pages and debug information
- Directory Traversal Protection Validation: Read-only checks for exposed sensitive files (.env, config.json, .git/config, etc.)
- CORS Security Validation: Preflight request testing to identify overly permissive CORS configurations
- SSL/TLS Implementation Assessment: HTTPS enforcement and HTTP-to-HTTPS redirect validation
- Server Fingerprinting Protection: Detection of information disclosure through server headers and technology stack exposure
- Executive Security Reporting: Enhanced reporting with security scores, compliance status, and prioritized remediation roadmaps
- Comprehensive Secutity Audit Engine: Completely redesigned scanning engine to detect not just API keys but comprehensive security vulnerabilities and architectural issues
- Technology Stack Detection: Advanced detection of frameworks (React, Vue, Angular, Next.js), build tools (Webpack, Vite), CSS frameworks (Tailwind, Bootstrap), and JavaScript libraries
- Third-Party Service Analysis: Identifies and analyzes security implications of integrated services (Google Analytics, Stripe, Sentry, Hotjar, Mixpanel, Cloudflare)
- Security Architecture Assessment: Deep analysis of external resources, potential API endpoints, form actions, meta tags, and security headers
- Enhanced AI Security Expert: Upgraded AI system prompt with 2025 modern security best practices including CSP, SRI, HTTPS everywhere, secure headers, and zero-trust architecture
- Framework-Specific Security Recommendations: Tailored security advice based on detected technology stack (React XSS prevention, Vue template injection, Angular sanitization)
- Advanced Pattern Matching: Improved API key detection with 20+ service patterns, entropy analysis, and confidence scoring
- Comprehensive Content Analysis: Enhanced scanning of HTML content, inline scripts, external JavaScript/CSS files with detailed security context
- Security Context Extraction: Intelligent extraction of security-relevant information including potential endpoints, external dependencies, and technology fingerprinting
- Professional Security Reporting: Detailed secutity audit reports with technology stack breakdown, vulnerability assessment, and prioritized remediation steps
- Real Backend Integration: Replaced all mockup data and frontend scanning with real Rust backend API integration
- Enhanced User Experience: Added Enter key support to both scan forms for faster form submission
- Code Cleanup: Removed unused mockup files (scanner.ts, ai-recommendations.ts, HeroSection.tsx) for cleaner codebase
- Navigation Improvements: Made navigation logo clickable to return to main page with hover effects
- Frontend Optimization: Fixed scan form to use actual backend API calls instead of test navigation
- Production Ready: Eliminated all mock data ensuring real scan counts and authentic results
- Error Handling: Improved error handling with proper user feedback during scan failures
- Performance: Streamlined frontend by removing duplicate components and unused code
- Persistent Database Storage: Fixed shared scan result URLs not persisting after app restart by switching from in-memory to file-based database storage
- Docker Volume Integration: Added persistent volume mounting for database files in Docker containers to ensure data survives container restarts
- Environment Configuration: Added DATABASE_PATH environment variable for configurable database file location
- Production Deployment: Enhanced Docker configuration with proper data persistence for production environments
- Database File Management: Added database files to .gitignore to prevent committing persistent data
- Container Optimization: Updated Dockerfile to create data directory structure for reliable database storage
- Professional Share & Export System: Implemented comprehensive modular sharing and export functionality
- Advanced Export Formats: Added Markdown, JSON, and CSV export options with branded professional reports
- Smart Social Sharing: Integrated Twitter/X, LinkedIn, Facebook sharing with branded previews and security status
- Dark Mode Optimization: Fixed AI Secutity Audit white background issues for complete dark mode compatibility
- Docker Networking Fixes: Resolved production deployment networking issues between frontend and backend containers
- Enhanced Reporting: Comprehensive markdown reports with executive summaries, findings breakdowns, and AI recommendations
- Clipboard Integration: One-click URL copying with native device sharing support
- Analytics Integration: Added tracking for sharing and export events to understand user engagement
- Modular Architecture: Created reusable ShareButton and ExportButton components for easy maintenance
- Professional Branding: Consistent KeyGuard branding across all shared content and exported reports
- Complete Frontend Architecture Overhaul: Completely reorganized landing page into modular, maintainable components
- Modern Navigation System: Implemented sticky navigation with glassmorphism design, backdrop blur, and automatic dark mode detection
- Responsive Hero Layout: Combined hero section and scan form into elegant desktop side-by-side layout with mobile-first responsive design
- Component Organization: Split landing page into dedicated components (HeroWithScanForm, FeaturesSection, CTASection, Footer) for better maintainability
- Dark Mode Implementation: Added automatic system preference detection with seamless light/dark mode switching across all components
- Enhanced User Experience: Improved spacing, visual hierarchy, and interactive elements with smooth animations and transitions
- Docker Build Optimization: Fixed Rust version compatibility issues and OpenSSL static linking for musl targets
- Production Configuration: Updated Vite config with proper host allowlist and TypeScript error resolution
- API Client Improvements: Enhanced production/development URL handling with automatic environment detection
- Build System Fixes: Resolved TypeScript compilation errors and improved development workflow
- Domain Updates: Updated all URLs to keyguard.meetneura.ai domain
- Date Corrections: Fixed all dates to current date (2025-09-07)
- Security.txt Updates: Extended expiration to 2026-09-07
- Contact Information: Updated to [email protected]
- Sitemap Refresh: Updated lastmod dates to current
- Humans.txt Updates: Refreshed team information and dates
- SEO Optimization: Added comprehensive OpenGraph meta tags and Twitter cards
- Search Engine Enhancement: Implemented structured data (JSON-LD) for better search visibility
- Sitemap Integration: Added XML sitemap for improved search engine crawling
- PWA Support: Added web app manifest for progressive web app capabilities
- Social Media Ready: Optimized og.png image integration for social sharing
- Meta Tags Enhancement: Added proper keywords, canonical URLs, and theme colors
- Robots.txt Optimization: Updated with sitemap reference and proper crawling directives
- Mobile Optimization: Enhanced viewport and mobile-first meta configurations
- Critical Bug Fixes: Fixed non-functional scan button and navigation issues
- UI/UX Improvements: Added real-time scanning progress with visual progress bar
- Results Display: Fixed scan results page to properly show AI recommendations and findings
- Navigation Flow: Implemented proper scan-to-results page flow with loading states
- Polling System: Added automatic result polling for real-time scan status updates
- Error Handling: Improved error handling and user feedback during scan failures
- Performance: Optimized frontend-backend communication and state management
- Enhanced AI Integration: Improved NEURA_ROUTER integration with better error handling
- Backend Improvements: Enhanced scanner module with better pattern matching
- Database Optimizations: Improved LibSQL integration and query performance
- Authentication Enhancements: Strengthened JWT handling and user session management
- Frontend Updates: Better AI recommendations display and user experience
- Configuration: Updated environment variables and API endpoints
- Build System: Improved Vite configuration and development workflow
- Security: Enhanced input validation and sanitization
- README documentation updates
- Minor bug fixes and improvements
- Initial release with core scanning functionality
- Basic AI-powered recommendations
- User authentication system
- Docker containerization
- Shadcn/ui: Beautiful, accessible React components
- NEURA_ROUTER: AI-powered recommendation engine
- Rust Community: Amazing ecosystem and libraries
- Security Researchers: Vulnerability patterns and best practices
KeyGuard AI Scan - Professional automated penetration testing for modern web applications. 🎯🔐