A free, fully client-side product security assessment web app. Paste a repository URL from GitHub, GitLab, Bitbucket, Azure DevOps, or Gitea/Codeberg - firmware, PCB schematics, mobile apps, web apps, backends, cloud/IaC, or engineering documentation - and get a scored, visual security rubric with findings, remediation guidance, and regulatory readiness checklists.
No AI, no server, no cost to run. Everything executes in the visitor's browser; the only network calls are to the hosting provider's API (to fetch the repo) and the free OSV.dev vulnerability database (for live CVE data on declared dependencies). The interface uses the Berkner Tech color palette, the Berkner Tech BT logo, and the Poppins brand font (bundled in the page, so no font request leaves the browser either), and it is fully responsive on phones and tablets.
- Visual scored rubric across 11 categories with a donut gauge, letter grades, and per-category bars.
- Live CVE scanning against OSV.dev, plus offline known-bad version heuristics.
- CVE reproduction guidance: every known CVE gets a verification outline. Well-known CVEs (Log4Shell, Spring4Shell, the Commons Collections gadget, jQuery XSS, minimist and PyYAML, and others) include the canonical, publicly documented proof-of-concept, framed for authorized testing of your own systems. Everything else gets a CWE-class verification template.
- SBOM export in CycloneDX 1.5 and SPDX 2.3 (with valid PURLs, and CVE data embedded in the CycloneDX output).
- Selectable scan scope with presets, so visitors assess exactly the frameworks they care about.
- Example report button that builds a complete sample report from built-in data, so visitors can see how the output looks before running a scan. No network request is made.
The fastest path for berkner.tech is the WordPress plugin:
- In WordPress admin, go to Plugins, then Add New, then Upload Plugin.
- Upload
dist/berkner-tech-security-scanner-plugin.zipand click Install Now. - Click Activate Plugin.
- Add the shortcode
[berkner_tech_security_scanner]to any page, post, or Elementor Shortcode widget.
That is all that is required. The plugin serves a single self-contained HTML file and adds no
database tables, settings pages, or external dependencies. A step-by-step guide for all three
installation methods (plugin, iframe embed, and direct upload) ships next to the builds in
dist/README.md, and the full deployment notes are in the
Deploying to berkner.tech section below.
Visitors choose what to assess via checkboxes or one-click presets:
| Preset | Scopes |
|---|---|
| Enterprise-Grade (All) | everything below (default) |
| EU Market Readiness | Best Practices + CVEs + CRA + RED + Data Act |
| US Federal / FIPS | Best Practices + CVEs + FIPS 140-3/NIST |
| Essentials | Best Practices + CVEs |
Individual scopes: Security Best Practices, Known CVEs (OSV.dev), EU Cyber Resilience Act, EU RED 3.3 / EN 18031, EU Data Act, EU GDPR, EU NIS2, EU DORA, FIPS 140-3 / NIST, and MISRA C/C++. GDPR, NIS2, and DORA are EU law (DORA is specific to financial entities); MISRA is a global coding standard for safety-critical C/C++, not a regulation. Deselected frameworks show as "Not selected" in the rubric and are excluded from the weighted score.
| Provider | URL forms | Token (Advanced panel) |
|---|---|---|
| GitHub | github.com/owner/repo[/tree/branch[/dir]], owner/repo |
fine-grained PAT, read-only Contents |
| GitLab (gitlab.com) | gitlab.com/group[/subgroup]/project[/-/tree/branch[/dir]] |
PAT with read_api |
| Bitbucket Cloud | bitbucket.org/workspace/repo[/src/branch[/dir]] |
username:app_password or access token |
| Azure DevOps | dev.azure.com/org/project/_git/repo[?version=GBbranch] |
PAT with Code Read |
| Gitea / Codeberg | codeberg.org/owner/repo[/src/branch/name[/dir]] |
access token |
Notes: most Azure DevOps organizations disable anonymous access, so ADO scans generally need a PAT (the scanner shows a clear message when a sign-in page is returned). Self-hosted GitLab/Gitea instances are auto-detected by URL shape but must send CORS headers for a browser-based scan to work; cloud-hosted providers all do.
278 rules across 11 rubric categories (weights renormalize over the categories that apply):
| Category | What it covers |
|---|---|
| Secrets & Credential Hygiene | Cloud keys, tokens, private keys, .env files, Wi-Fi creds in firmware |
| Supply Chain & Known CVEs | Live OSV.dev lookup + offline known-bad versions (Log4Shell, etc.), lockfiles, pinning |
| Secure Coding (CWE) | Injection, XSS, deserialization, C buffer safety, path traversal, SSRF, debug configs |
| Cryptography & FIPS 140-3 | MD5/SHA-1/DES/RC4/ECB, weak keys/KDFs, disabled TLS validation, FIPS module declarations |
| Hardware & Embedded | Secure boot, flash encryption, signed OTA, JTAG/debug lockdown, BLE pairing, KiCad schematic scan |
| Cloud & Infrastructure | Terraform, Dockerfile, Kubernetes, docker-compose, GitHub Actions hardening, nginx TLS |
| Mobile (Android/iOS) | Manifest flags, ATS, trust-all TLS, secure storage, pinning, obfuscation |
| EU Cyber Resilience Act | Annex I Part I product-property checklist, Annex II user info, Art. 13/14 readiness |
| EU RED Art. 3.3(d)(e)(f) | EN 18031-1/-2/-3 mechanism families for radio equipment (applies since 1 Aug 2025) |
| EU Data Act | Art. 3-5 data access/sharing by design, cloud switching (applies since 12 Sep 2025) |
| EU GDPR | Personal-data readiness: privacy notice, lawful basis/consent, Art. 32 security, data-subject rights, breach notification |
| EU NIS2 | Art. 21 risk-management measures, incident reporting (24h/72h/1mo), supply chain, governance |
| EU DORA | Financial-sector ICT resilience: risk management, incident reporting, resilience testing, third-party risk |
| MISRA C/C++ | MISRA C:2012 conformance for C/C++ (dynamic memory, stdio, goto, unsafe functions, octal constants, checker configured) |
| Vulnerability Handling | SECURITY.md, SBOM, Dependabot/Renovate, CI security scanning, release signing |
The repo is profiled first (embedded, hardware, radio, Android, iOS, web, backend, cloud, containers, connected-product) and only relevant categories are scored - a pure web app is never penalized for missing secure-boot config, and a firmware repo gets the RED/Data Act checklists automatically.
-
In WP admin: Plugins > Add New > Upload Plugin, then upload
dist/berkner-tech-security-scanner-plugin.zip, then Activate. -
Put the shortcode on any page (Gutenberg Shortcode block, Elementor Shortcode widget, or the classic editor):
[berkner_tech_security_scanner]Optional attributes:
[berkner_tech_security_scanner height="1200" repo="https://github.com/owner/repo"]
The plugin serves the bundled scanner.html from the plugin directory and renders an iframe
that auto-resizes to the report height (postMessage). No database, no settings, no jQuery,
zero load on the server.
Upload dist/berkner-tech-security-scanner.html anywhere (Media Library, GitHub Pages, any static
host) and drop this into an Elementor HTML widget:
<iframe id="btss" src="https://YOUR-HOST/berkner-tech-security-scanner.html"
style="width:100%;border:0;height:1000px;" title="Security Scanner"></iframe>
<script>
window.addEventListener('message', function (ev) {
if (ev.data && ev.data.type === 'bt-scan-height')
document.getElementById('btss').style.height = Math.max(400, ev.data.height|0) + 'px';
});
</script>(Note: WordPress Media Library may rename .html uploads or block them depending on security
plugins - the plugin route avoids this entirely.)
Copy dist/berkner-tech-security-scanner.html to the web root (e.g.
wp-content/uploads/scanner/index.html via SFTP) and link or iframe it.
index.html app shell (dev - loads js/ and css/ separately)
js/core/ engine, scoring, profiler, multi-provider fetcher (repo.js), OSV client,
SBOM generator (sbom.js), CVE reproduction (repro.js), report renderer
js/rules/*.js 11 rule packs (see RULE-SPEC.md for the authoring contract)
test/validate-pack.mjs schema/robustness validator for a single pack
test/run-tests.mjs full integration test over test/fixtures (vulnerable) and
test/fixtures-clean (false-positive guard)
build.mjs bundles everything into dist/berkner-tech-security-scanner.html
Commands (Node 18+):
node test/run-tests.mjs # full test suite
node test/validate-pack.mjs js/rules/<pack>.js # validate one rule pack
node build.mjs # rebuild the single-file dist
node test/serve.mjs 8731 # local dev server
After a rebuild, refresh the plugin copy:
Copy-Item dist\berkner-tech-security-scanner.html wordpress-plugin\berkner-tech-security-scanner\scanner.html
then run node package-plugin.mjs to rebuild dist/berkner-tech-security-scanner-plugin.zip.
Read RULE-SPEC.md. Each pack is a plain script registering finding rules (pattern/check
detections with severity, CWE, compliance citations, remediation) and criterion rules (the
scored rubric checklist). Run the validator until it prints PASS, then node test/run-tests.mjs.
- Criteria evaluate to pass / partial / fail / n.a. and produce the category's base score.
- Findings deduct severity-weighted penalties (critical -20, high -9, medium -3.5, low -1, with diminishing repeats and a per-rule cap).
- Findings-driven categories blend ~60% actual cleanliness with ~40% tooling criteria; compliance categories (CRA/RED/Data Act/vuln-handling) are pure readiness gap analyses.
- The overall score is the weighted mean of applicable categories; any critical finding floors the risk label at High.
Anonymous GitHub API allows ~60 requests/hour per visitor IP (a scan uses 2 API calls; file contents come from raw.githubusercontent.com which is not metered the same way). GitLab and Bitbucket anonymous limits are comfortably above a scan's needs. The Advanced panel accepts an optional read-only token per provider (private repos + higher limits); it stays in the browser tab and is sent only to the chosen provider's API.
Automated heuristic review - not a penetration test, certification, or legal advice. Compliance criteria are documentation-readiness indicators for CRA / RED / Data Act / FIPS, not conformity assessments. Findings can include false positives; verify before acting.