TigahandGitHub 5e1c029e09 fix(scan): grade hsts on the final response scheme after redirects (#310) ...

hsts grading was gated on the scheme of the originally requested url,
but the client follows redirects, so an http target that redirects to
https skipped the hsts check entirely and dropped a high-severity
finding. decide the scheme from the final response request url instead,
falling back to the requested url only when no response request is set.

2026-07-22 12:49:40 -07:00

..

builtin

chore: migrate module path to github.com/vmfunc/sif (#194)

2026-06-22 22:25:39 -07:00

frameworks

fix(frameworks): stop gatsby and svelte prose from faking detection (#285)

2026-07-22 12:45:38 -07:00

js

style: apply gofmt to source tree (#232)

2026-06-25 18:19:17 -07:00

cloudstorage_test.go

fix(scan): require a real bucket listing body before flagging s3 exposure (#282)

2026-07-22 12:36:29 -07:00

cloudstorage.go

fix(scan): require a real bucket listing body before flagging s3 exposure (#282)

2026-07-22 12:36:29 -07:00

cms_drupal_test.go

fix(scan): detect modern drupal by its headers (#170)

2026-06-22 20:20:36 -07:00

cms_joomla_test.go

fix(scan): key joomla detection on the generator tag (#173)

2026-06-22 16:47:58 -07:00

cms_wordpress_mention_test.go

fix(scan): drop the bare wordpress detection marker (#171)

2026-06-22 17:41:28 -07:00

cms_wordpress_probe_test.go

fix(scan): require a wordpress marker on probed wp paths (#169)

2026-06-22 18:21:19 -07:00

cms.go

chore: migrate module path to github.com/vmfunc/sif (#194)

2026-06-22 22:25:39 -07:00

cors_test.go

fix(scan): gate cors http-downgrade probe on https targets only (#305)

2026-07-22 12:48:40 -07:00

cors.go

fix(scan): gate cors http-downgrade probe on https targets only (#305)

2026-07-22 12:48:40 -07:00

crawl_budget_test.go

fix(scan): bound crawl breadth with a page budget (#269)

2026-07-22 12:35:18 -07:00

crawl_test.go

feat(scan): add web crawler and passive subdomain/url discovery

2026-06-09 18:11:38 -07:00

crawl.go

fix(scan): bound crawl breadth with a page budget (#269)

2026-07-22 12:35:18 -07:00

dirlist_test.go

fix(scan): apply reflected-path tolerance to soft-404 calibration (#180)

2026-06-22 20:26:19 -07:00

dirlist.go

chore: migrate module path to github.com/vmfunc/sif (#194)

2026-06-22 22:25:39 -07:00

dnslist_test.go

fix(scan): dnslist dedup, robots recursion bound, framework version lookup, takeover cname

2026-06-10 14:47:17 -07:00

dnslist.go

chore: migrate module path to github.com/vmfunc/sif (#194)

2026-06-22 22:25:39 -07:00

dork.go

fix(scan): report the found url in dork results and dedupe by url (#283)

2026-07-22 12:36:38 -07:00

favicon_demo_sync_test.go

chore: migrate module path to github.com/vmfunc/sif (#194)

2026-06-22 22:25:39 -07:00

favicon_test.go

refactor(scan): extract favicon hashing into internal/fingerprint (#182)

2026-06-22 17:43:30 -07:00

favicon.go

chore: migrate module path to github.com/vmfunc/sif (#194)

2026-06-22 22:25:39 -07:00

fuzz_test.go

chore: bump copyright headers to 2026

2026-06-08 18:30:48 -07:00

git.go

chore: migrate module path to github.com/vmfunc/sif (#194)

2026-06-22 22:25:39 -07:00

headers.go

chore: migrate module path to github.com/vmfunc/sif (#194)

2026-06-22 22:25:39 -07:00

integration_test.go

fix(scan): require a real bucket listing body before flagging s3 exposure (#282)

2026-07-22 12:36:29 -07:00

jwt_test.go

fix(scan): crack weak hmac secrets on hs384 and hs512 tokens (#197)

2026-06-22 18:21:02 -07:00

jwt.go

chore: migrate module path to github.com/vmfunc/sif (#194)

2026-06-22 22:25:39 -07:00

lfi_test.go

fix(scan): baseline-diff lfi evidence to stop static-content false positives (#303)

2026-07-22 12:48:22 -07:00

lfi.go

fix(scan): baseline-diff lfi evidence to stop static-content false positives (#303)

2026-07-22 12:48:22 -07:00

nuclei.go

style: apply gofmt to source tree (#232)

2026-06-25 18:19:17 -07:00

openapi_test.go

fix(scan): tolerate ref path items when parsing openapi specs (#309)

2026-07-22 12:49:31 -07:00

openapi.go

fix(scan): tolerate ref path items when parsing openapi specs (#309)

2026-07-22 12:49:31 -07:00

passive_test.go

fix(scan): scope passive ct-feed subdomains to the target (#181)

2026-06-22 16:48:23 -07:00

passive.go

chore: migrate module path to github.com/vmfunc/sif (#194)

2026-06-22 22:25:39 -07:00

ports.go

chore: migrate module path to github.com/vmfunc/sif (#194)

2026-06-22 22:25:39 -07:00

probe_test.go

feat: live-host probe and sarif/markdown report export

2026-06-10 14:47:17 -07:00

probe.go

chore: migrate module path to github.com/vmfunc/sif (#194)

2026-06-22 22:25:39 -07:00

redirect_test.go

fix(scan): strip url whitespace before open-redirect host check (#306)

2026-07-22 12:49:07 -07:00

redirect.go

fix(scan): strip url whitespace before open-redirect host check (#306)

2026-07-22 12:49:07 -07:00

result.go

chore: drop decorative emoji and redundant comments

2026-06-08 18:53:06 -07:00

scan_test.go

fix(scan): report the found url in dork results and dedupe by url (#283)

2026-07-22 12:36:38 -07:00

scan.go

chore: migrate module path to github.com/vmfunc/sif (#194)

2026-06-22 22:25:39 -07:00

securityheaders_test.go

fix(scan): grade hsts on the final response scheme after redirects (#310)

2026-07-22 12:49:40 -07:00

securityheaders.go

fix(scan): grade hsts on the final response scheme after redirects (#310)

2026-07-22 12:49:40 -07:00

securitytrails_test.go

feat: add securitytrails integration for domain discovery + target expansion

2026-02-17 13:38:07 +01:00

securitytrails.go

chore: migrate module path to github.com/vmfunc/sif (#194)

2026-06-22 22:25:39 -07:00

shodan_test.go

chore: bump copyright headers to 2026

2026-06-08 18:30:48 -07:00

shodan.go

chore: migrate module path to github.com/vmfunc/sif (#194)

2026-06-22 22:25:39 -07:00

sql_adminpanel_query_test.go

fix(scan): apply reflected-path tolerance to soft-404 calibration (#180)

2026-06-22 20:26:19 -07:00

sql_soft404_test.go

fix(scan): apply reflected-path tolerance to soft-404 calibration (#180)

2026-06-22 20:26:19 -07:00

sql_test.go

fix(scan): baseline-diff sql errors against shared templates (#304)

2026-07-22 12:48:31 -07:00

sql.go

fix(scan): baseline-diff sql errors against shared templates (#304)

2026-07-22 12:48:31 -07:00

subdomaintakeover_stale_test.go

fix(scan): correlate cname before confirming subdomain takeover (#281)

2026-07-22 12:36:19 -07:00

subdomaintakeover_test.go

fix(scan): correlate cname before confirming subdomain takeover (#281)

2026-07-22 12:36:19 -07:00

subdomaintakeover.go

fix(scan): correlate cname before confirming subdomain takeover (#281)

2026-07-22 12:36:19 -07:00

whois.go

style: apply gofmt to source tree (#232)

2026-06-25 18:19:17 -07:00

xss_test.go

fix(scan): don't flag quotes reflected in text as attribute xss (#203)

2026-06-22 18:21:09 -07:00

xss.go

chore: migrate module path to github.com/vmfunc/sif (#194)

2026-06-22 22:25:39 -07:00