TLS Scanner Community Edition

Open-source web app security scanner by TOUGH LOVE SECURITY.

Fast, self-hostable surface scanner for web apps. Detects missing security headers, exposed admin panels, Spring Boot actuator leaks, open redirects, XSS, SQLi, SSRF, and more — the same engine we use in production to scan medical billing, SaaS, and healthcare clients.

$ curl -X POST http://localhost:8080/scan \
    -H "x-tls-secret: $TLS_SCAN_SECRET" \
    -H "content-type: application/json" \
    -d '{"target":"https://example.com","depth":"quick"}'

What's in this repo

• server.js — HTTP wrapper with per-scan timeout, process-group kill, ring-buffer logging, client-abort handling
• scan.sh — orchestrator: recon → spider → payload sweep → findings aggregation
• scanners/ — curl-based scanner, recon, batch runner
• Dockerfile + fly.toml — one-command deploy to Fly.io
• .github/workflows/ci.yml — GitHub Action that runs a scan on every push

Quick start (local)

npm install
TLS_SCAN_SECRET=$(openssl rand -hex 24) node server.js
# in another shell
curl -X POST http://localhost:8080/scan \
  -H "x-tls-secret: $TLS_SCAN_SECRET" \
  -H "content-type: application/json" \
  -d '{"target":"https://your-own-site.example","depth":"quick"}'

Deploy to Fly.io

fly launch --no-deploy
fly secrets set TLS_SCAN_SECRET=$(openssl rand -hex 24)
fly deploy

Scan depths

depth	endpoints	payloads	spider	typical time
quick	20	1	1	30–90s
normal	100	3	3	3–6 min
deep	500	10	6	15–30 min

Authorization

Only scan systems you own or have written permission to test. This tool sends active payloads. Unauthorized scanning is illegal in most jurisdictions.

Community vs. Managed

	Community (this repo)	Managed ($29+/mo)
All detections	✅	✅
Self-host on Fly.io / your CI	✅	✅
JSON findings	✅	✅
You maintain it	✅	❌ (we do)
Signed PDF report	❌	✅
Remediation guidance per finding	❌	✅
Continuous scheduled scans w/ trend	❌	✅
Email / Slack alerts on new findings	❌	✅
HIPAA §164.308(a)(8) attestation	❌	✅ ($199+ tier)
Dedicated analyst review	❌	✅ ($399 / pentest)
White-label (your logo, your brand)	❌	✅ (pentest / WL deal)
Full penetration test + retest	❌	✅ ($2,500–4,500)

Auditors accept PDFs, not JSON. If you're an RCM / healthcare / medical billing shop and you need to show "we periodically evaluate our technical safeguards" for HIPAA §164.308(a)(8), the community scanner's JSON won't satisfy an auditor — the attestation letter on the $199/mo tier does.

Tiers at a glance

Tier	Price	What you get
Community	Free	This repo — JSON findings, self-hosted
GitHub Action	$29/mo	Managed CI action + PDF reports on every push
Starter	$69/mo	Weekly scheduled scans + remediation guidance per finding
Pro	$199/mo	Daily scans + HIPAA §164.308(a)(8) attestation letter
Enterprise	$399/mo	Pro + dedicated analyst + Slack/email alerts on new findings
Pentest	$2,500+	Full manual pentest, 2-week engagement, retest included
HIPAA bundle	$3,500	Pentest + attestation letter + remediation
White-label	50/50	Scan your clients under your brand — RCM / reseller deal

→ toughlovesec.win

License

MIT — see LICENSE.

Contributing

PRs welcome. See CONTRIBUTING.md.