TigahandGitHub 0d96838ee4 fix(scan): bound crawl breadth with a page budget (#269) ...

Crawl only capped recursion depth, not breadth per level. A link-heavy page
(pagination, faceted search) drives fetch count toward branching^depth with no
ceiling: a depth-3 crawl of a page linking 40 fresh urls issued 1641 real
fetches.

Cap total fetches at a page budget via an atomic counter in an OnRequest hook
that aborts once exceeded, and add a Truncated flag on CrawlResult so callers
can tell a run was cut short.

2026-07-22 12:35:18 -07:00

..

builtin

chore: migrate module path to github.com/vmfunc/sif (#194)

2026-06-22 22:25:39 -07:00

frameworks

fix(frameworks): stop false positives and version mis-extraction (#247)

2026-07-02 12:55:34 -07:00

js

style: apply gofmt to source tree (#232)

2026-06-25 18:19:17 -07:00

cloudstorage_test.go

feat(scan): broaden cloudstorage bucket name candidates (#162)

2026-06-22 17:48:45 -07:00

cloudstorage.go

chore: migrate module path to github.com/vmfunc/sif (#194)

2026-06-22 22:25:39 -07:00

cms_drupal_test.go

fix(scan): detect modern drupal by its headers (#170)

2026-06-22 20:20:36 -07:00

cms_joomla_test.go

fix(scan): key joomla detection on the generator tag (#173)

2026-06-22 16:47:58 -07:00

cms_wordpress_mention_test.go

fix(scan): drop the bare wordpress detection marker (#171)

2026-06-22 17:41:28 -07:00

cms_wordpress_probe_test.go

fix(scan): require a wordpress marker on probed wp paths (#169)

2026-06-22 18:21:19 -07:00

cms.go

chore: migrate module path to github.com/vmfunc/sif (#194)

2026-06-22 22:25:39 -07:00

cors_test.go

fix(scan): don't follow redirects when probing cors (#200)

2026-06-22 18:18:09 -07:00

cors.go

chore: migrate module path to github.com/vmfunc/sif (#194)

2026-06-22 22:25:39 -07:00

crawl_budget_test.go

fix(scan): bound crawl breadth with a page budget (#269)

2026-07-22 12:35:18 -07:00

crawl_test.go

feat(scan): add web crawler and passive subdomain/url discovery

2026-06-09 18:11:38 -07:00

crawl.go

fix(scan): bound crawl breadth with a page budget (#269)

2026-07-22 12:35:18 -07:00

dirlist_test.go

fix(scan): apply reflected-path tolerance to soft-404 calibration (#180)

2026-06-22 20:26:19 -07:00

dirlist.go

chore: migrate module path to github.com/vmfunc/sif (#194)

2026-06-22 22:25:39 -07:00

dnslist_test.go

fix(scan): dnslist dedup, robots recursion bound, framework version lookup, takeover cname

2026-06-10 14:47:17 -07:00

dnslist.go

chore: migrate module path to github.com/vmfunc/sif (#194)

2026-06-22 22:25:39 -07:00

dork.go

style: apply gofmt to source tree (#232)

2026-06-25 18:19:17 -07:00

favicon_demo_sync_test.go

chore: migrate module path to github.com/vmfunc/sif (#194)

2026-06-22 22:25:39 -07:00

favicon_test.go

refactor(scan): extract favicon hashing into internal/fingerprint (#182)

2026-06-22 17:43:30 -07:00

favicon.go

chore: migrate module path to github.com/vmfunc/sif (#194)

2026-06-22 22:25:39 -07:00

fuzz_test.go

chore: bump copyright headers to 2026

2026-06-08 18:30:48 -07:00

git.go

chore: migrate module path to github.com/vmfunc/sif (#194)

2026-06-22 22:25:39 -07:00

headers.go

chore: migrate module path to github.com/vmfunc/sif (#194)

2026-06-22 22:25:39 -07:00

integration_test.go

test(scan): fix integration_test SQL arity after calibrate param (#230)

2026-06-22 22:10:46 -07:00

jwt_test.go

fix(scan): crack weak hmac secrets on hs384 and hs512 tokens (#197)

2026-06-22 18:21:02 -07:00

jwt.go

chore: migrate module path to github.com/vmfunc/sif (#194)

2026-06-22 22:25:39 -07:00

lfi_test.go

fix(scan): don't count a reflected payload as lfi evidence (#179)

2026-06-22 16:48:17 -07:00

lfi.go

chore: migrate module path to github.com/vmfunc/sif (#194)

2026-06-22 22:25:39 -07:00

nuclei.go

style: apply gofmt to source tree (#232)

2026-06-25 18:19:17 -07:00

openapi_test.go

fix(scan): flag openapi operations reachable without authentication (#175)

2026-06-22 17:32:58 -07:00

openapi.go

chore: migrate module path to github.com/vmfunc/sif (#194)

2026-06-22 22:25:39 -07:00

passive_test.go

fix(scan): scope passive ct-feed subdomains to the target (#181)

2026-06-22 16:48:23 -07:00

passive.go

chore: migrate module path to github.com/vmfunc/sif (#194)

2026-06-22 22:25:39 -07:00

ports.go

chore: migrate module path to github.com/vmfunc/sif (#194)

2026-06-22 22:25:39 -07:00

probe_test.go

feat: live-host probe and sarif/markdown report export

2026-06-10 14:47:17 -07:00

probe.go

chore: migrate module path to github.com/vmfunc/sif (#194)

2026-06-22 22:25:39 -07:00

redirect_test.go

fix(scan): detect open redirects through scheme-malformed payloads (#172)

2026-06-22 16:47:52 -07:00

redirect.go

chore: migrate module path to github.com/vmfunc/sif (#194)

2026-06-22 22:25:39 -07:00

result.go

chore: drop decorative emoji and redundant comments

2026-06-08 18:53:06 -07:00

scan_test.go

fix(scan): dnslist dedup, robots recursion bound, framework version lookup, takeover cname

2026-06-10 14:47:17 -07:00

scan.go

chore: migrate module path to github.com/vmfunc/sif (#194)

2026-06-22 22:25:39 -07:00

securityheaders_test.go

fix(scan): accept quoted hsts max-age values (#176)

2026-06-22 16:48:11 -07:00

securityheaders.go

chore: migrate module path to github.com/vmfunc/sif (#194)

2026-06-22 22:25:39 -07:00

securitytrails_test.go

feat: add securitytrails integration for domain discovery + target expansion

2026-02-17 13:38:07 +01:00

securitytrails.go

chore: migrate module path to github.com/vmfunc/sif (#194)

2026-06-22 22:25:39 -07:00

shodan_test.go

chore: bump copyright headers to 2026

2026-06-08 18:30:48 -07:00

shodan.go

chore: migrate module path to github.com/vmfunc/sif (#194)

2026-06-22 22:25:39 -07:00

sql_adminpanel_query_test.go

fix(scan): apply reflected-path tolerance to soft-404 calibration (#180)

2026-06-22 20:26:19 -07:00

sql_soft404_test.go

fix(scan): apply reflected-path tolerance to soft-404 calibration (#180)

2026-06-22 20:26:19 -07:00

sql_test.go

chore: bump copyright headers to 2026

2026-06-08 18:30:48 -07:00

sql.go

chore: migrate module path to github.com/vmfunc/sif (#194)

2026-06-22 22:25:39 -07:00

subdomaintakeover_stale_test.go

fix(scan): update stale ghost and pantheon takeover fingerprints (#168)

2026-06-22 18:20:54 -07:00

subdomaintakeover_test.go

fix(scan): drop subdomain-takeover fingerprints for mitigated and generic services (#165)

2026-06-22 20:15:47 -07:00

subdomaintakeover.go

chore: migrate module path to github.com/vmfunc/sif (#194)

2026-06-22 22:25:39 -07:00

whois.go

style: apply gofmt to source tree (#232)

2026-06-25 18:19:17 -07:00

xss_test.go

fix(scan): don't flag quotes reflected in text as attribute xss (#203)

2026-06-22 18:21:09 -07:00

xss.go

chore: migrate module path to github.com/vmfunc/sif (#194)

2026-06-22 22:25:39 -07:00