v1.1.0

v1.1.0: scan behind a login, prove your fixes

Authenticated scanning (asked for by a user on the launch post): hand
hackable your own session cookie and the crawler plus all 14 probes run as
your logged-in session, so pages and forms behind a login get crawled and
tested too.

hackable https://your-site.com --cookie "sessionid=abc123"

• HACKABLE_COOKIE env var as an alternative to the flag (handy in CI),
  plus repeatable --header "Name: value" passthrough for bearer tokens.
• hackable never logs in for you: no passwords, no login flow, ever.
• The cookie value never appears in any output: not the terminal, not
  --json, --sarif, or --html. Reports stay clean of secrets.
• If the session looks expired (401/403 or a redirect to a login page),
  hackable warns you and scans the public site instead of failing.

Baselines and diffs: --save-baseline baseline.json snapshots a scan;
--diff-from baseline.json on the next run reports NEW and FIXED findings
plus the score change, in the terminal and in --json. Pair with cron for
scheduled scans with diff alerts, or with --fail-under as a CI gate.

Real before/after demo: demo/vulnapp_fixed.py is the hardened twin of
the intentionally vulnerable demo app. Scan vulnapp.py (scores 0/100, F),
apply the fixes the report cards suggest, scan the twin (86/100, B), and
watch a real score climb. Both numbers come from actual scans with this
release.

Test suite: 54/54 green (31 new, all against local fixtures, never a real
site).

v1.0.0

Hack yourself before they do.

One-command website security check for people who have never run a security tool. Add it to your workflow and every push gets scanned, with findings landing in your repo's Security tab.

What it checks

14 checks in one run: SQL injection (error-based and boolean-based), exposed files, reflected XSS, open redirects, CORS, debug traces, login rate limiting, security headers, cookie flags, TLS/HTTPS, version disclosure, dangerous HTTP methods, plus robots.txt and security.txt posture.

Before probing, the built-in mini-crawler maps your app like a visitor would, so every check hits a real page or form. No blind fuzzing of made-up paths.

Plain-English findings

Every finding ships with what it means (one sentence, no jargon) and how to fix it (one sentence, actionable), plus a 0-100 score and an A-F grade.

Usage

- uses: Shifu34/hackable@v1
  with:
    target: https://your-site.com
    fail-under: 70

Inputs

Input	Required	Default	Description
target	yes		URL of the app to scan
fail-under	no	70	Fail the workflow if the score is below this
sarif	no	true	Upload results to GitHub code scanning

Safety

Only scan apps you own or have explicit permission to test. Probes are harmless and non-destructive, but unauthorized scanning may be illegal.