Security Scanning

Web Scanning

Web security scans use two complementary tools that run in parallel:

Quick Scanner (~30 seconds)

A fast, zero-dependency scanner that checks the most common security issues:

• Security Headers — HSTS, X-Content-Type-Options, X-Frame-Options, CSP, X-XSS-Protection, Referrer-Policy, Permissions-Policy
• HTTPS — Certificate validity, HTTP-to-HTTPS redirect enforcement
• Cookie Security — Secure, HttpOnly, and SameSite flags
• Information Disclosure — Sensitive data in HTML comments, hidden fields, server version headers
• Exposed Files — .env, .git/config, phpinfo, wp-admin, .DS_Store, server-status
• TLS/SSL — HTTP availability check, redirect verification

Nuclei (4,000+ Templates)

Community-maintained vulnerability templates covering:

• CVE detection for known vulnerabilities
• Default credentials and misconfigurations
• Technology fingerprinting
• Exposed admin panels and sensitive endpoints
• XSS, SQL injection, SSRF, RCE patterns

Scan Depth

Choose how thorough the scan should be:

Authenticated Scanning

Scan pages that require a login. Provide a login URL, username, and password — bugAgent uses Playwright to:

1. Navigate to your login page
2. Fill in the email/username and password fields
3. Click the submit button
4. Wait for navigation and capture all session cookies
5. Pass cookies to Quick Scanner and Nuclei as a Cookie header

The scan report shows an Authenticated badge confirming the login succeeded. If login fails, an Auth Failed badge appears with the error.

Domain Verification

Before running a web scan, verify you own the domain by adding a DNS TXT record:

1. Add a domain in Security → Verified Domains
2. Copy the TXT record name (_bugagent-verify.yourdomain.com) and the verification token
3. Create a TXT record at your DNS provider (Cloudflare, Route53, Namecheap, etc.)
4. Click Verify — bugAgent queries public DNS (Google 8.8.8.8 / Cloudflare 1.1.1.1) for the record

Verification is one-time per domain. You can remove the TXT record after verification succeeds.

Mobile Binary Analysis (MobSF)

Upload an APK (Android) or IPA (iOS) binary for comprehensive static analysis via MobSF:

• Manifest Analysis — Exported components, debuggable flags, backup settings, intent filters
• Code Analysis — Hardcoded secrets, API keys, insecure network calls, weak crypto
• Binary Analysis — Native library vulnerabilities, anti-tampering, obfuscation checks
• Certificate Analysis — Signing certificate validation, pinning detection
• Permissions — Dangerous permission flagging with risk descriptions
• Tracker Detection — Embedded tracking libraries identified by signature

Each finding includes severity, CWE reference, OWASP Mobile mapping, and remediation guidance.

Findings & Security Score

Findings are categorized into five severity levels:

The security score starts at 100 and deducts points per finding. Scores are color-coded: green (80+), amber (50-79), red (below 50).

Each finding includes: title, description, severity, category, tool that detected it, affected location, remediation steps, and CWE/OWASP references where applicable. CSV export is available for all findings.

Auto-Bug Creation

Configure a severity threshold when creating a scan. Findings at or above the threshold automatically create security-type bug reports with:

• Vulnerability details and remediation steps
• Link back to the full security scan report
• AI quality score via Claude
• Proper severity mapping (Critical, High, Medium, Low)

Bug reports appear in your regular reports list and can be synced to Jira like any other bug.

Plan Limits

Both web and mobile scans count against the same monthly quota.

OWASP ZAP (Active Scanning)

When the ZAP Docker image is available, bugAgent runs an OWASP ZAP baseline scan alongside Quick Scanner and Nuclei. ZAP adds active scanning capabilities:

• Spider — Crawls the application to discover pages and endpoints
• Passive Analysis — Analyzes all responses for security issues
• Active Testing — Tests for reflected XSS, CSRF, session issues, and injection flaws
• Authenticated Crawling — Session cookies from Playwright login are passed to ZAP

Setup: docker pull ghcr.io/zaproxy/zaproxy:stable

Code SAST (Semgrep)

Connect a public or private GitHub, GitLab, or Bitbucket repository for comprehensive code security analysis:

• 30+ Languages — Python, JavaScript, TypeScript, Java, Go, Ruby, C#, PHP, and more
• OWASP Top 10 — Injection, broken auth, sensitive data exposure, XXE, security misconfigs
• Secret Detection — Hardcoded API keys, passwords, tokens, and credentials
• Supply Chain — Dependency confusion, typosquatting, malicious packages
• Dependency Audit — npm audit and pip-audit for known CVEs with fix versions
• License Scanning — Flags GPL, AGPL, and copyleft licenses for compliance review

Each finding includes: file path, line number, code snippet, severity, CWE reference, and OWASP mapping. Private repos supported via fine-grained GitHub PAT (Contents: Read-only).

Setup: brew install semgrep