Skip to content

SecureScope 2.0.0

Choose a tag to compare

View all tags
@mohamedmoatazsec mohamedmoatazsec released this 18 Oct 05:00
· 4 commits to main since this release
v2.0.0
791fb0a
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

SecureScope 2.0 is a rewrite around evidence-backed findings: every issue has a stable id, severity, confidence, the exact value observed, a remediation and references, and each target gets an A+ to F grade.

Highlights

  • Content-Security-Policy evaluator (unsafe-inline/eval, wildcard and scheme sources, missing object-src/base-uri/form-action, report-only, duplicates; 'strict-dynamic' understood)
  • Header quality: HSTS max-age/includeSubDomains, X-Frame-Options values, frame-ancestors wildcards, Referrer-Policy, Permissions-Policy, COOP, legacy X-XSS-Protection, public caching of HTML
  • Cookies from raw Set-Cookie: Secure/HttpOnly/SameSite, SameSite=None without Secure, __Host-/__Secure- prefix rules, domain scope
  • TLS: validation errors, expiry windows, TLS 1.0/1.1 acceptance, TLS 1.3 support, http→https redirect
  • CORS probes, OPTIONS/TRACE-only method review, version disclosure, security.txt
  • SARIF 2.1.0 for GitHub code scanning, Markdown, redesigned HTML report, JSON with schema, CSV
  • CI gate: --fail-on, --baseline (only new findings fail), --stdout; GitHub Action uses: mohamedmoatazsec/SecureScope@v2; Docker image on GHCR
  • Engagement ergonomics: --proxy (Burp), -H, --cookie, --insecure, targets file, check selection

Breaking changes: ports/subdomains/WHOIS are opt-in; report formats via -f; the methods check no longer sends PUT/DELETE/PATCH; python-whois is an optional extra; new Python API.

Full notes: CHANGELOG.md

Install: pip install git+https://github.com/mohamedmoatazsec/SecureScope.git@v2.0.0 or docker run --rm ghcr.io/mohamedmoatazsec/securescope:2.0.0 example.com

What's Changed

  • SecureScope 2.0: evidence-backed findings, CSP/TLS/cookie analysis, SARIF and CI gating by @mohamedmoatazsec in #2
  • Release 1.1.0: report HTML-injection fix, real CORS analysis, packaging, tests, CI by @mohamedmoatazsec in #1

New Contributors

Full Changelog: https://github.com/mohamedmoatazsec/SecureScope/commits/v2.0.0

Contributors

mohamedmoatazsec
Assets 4
Loading