Autonomous security scanner
Claude drives the whole audit: it crawls the target, invents attack hypotheses, tests them with safe payloads, judges the results, and hands back a graded report — not a canned rule list.
Five stages, in order — recon feeds the model, the model's output drives the probes, the probes' results come back for judgment.
Playwright crawls pages, forms, headers, cookies, scripts — and fingerprints embedded chat/AI widgets.
Claude proposes up to 12 attack vectors: OWASP Top 10, business logic, and LLM-specific risks.
Non-destructive payloads only, rate-limited, restricted to GET/POST/HEAD/OPTIONS by default.
Every response goes back to Claude for a verdict: severity, CVSS, evidence, remediation.
Graded A–F, grouped findings, saved to history for before/after comparison.
Every number below is from the actual repository and real scans, not an estimate.
Each of these surfaced by actually running the tool against live sites, then was fixed at the root — not patched at the symptom.
Healthy sites reported as unreachable. Playwright's networkidle wait never resolves on sites with analytics/chat traffic — switched to domcontentloaded as the real condition.
Empty recon crashed the whole scan. Claude's reply got cut off mid-JSON reasoning about nothing — AI probing is now skipped when recon finds zero pages, and truncation is detected and retried with more room.
Third-party assets blamed on the target. Header checks now run only against the target's own origin — a CDN's headers aren't the site's fault.
Before/after could silently swap. Same-second scan saves sorted randomly — fixed with microsecond-resolution timestamps.
UTC timestamps read as wrong. Reports and history now show local time with its offset.
Not synthetic test pages — my own production sites, scanned for real, published with the owner's go-ahead.
ATS Resume Builder SaaS, Next.js 16 — 0 findings across 7 pages. First scan caught a sitewide missing CSP header; fixed, and every re-scan since is clean.
Personal site, Cloudflare-fronted — 2 low-severity findings (missing CSP + HSTS) on a Cloudflare-injected script path, not the main page.
Also surfaced a real limitation of any headless-browser scanner: Cloudflare's bot management intermittently resets automated connections regardless of User-Agent — confirmed by side-by-side testing against plain curl.