Know if your app is secure before you ship it
isitsecure attacks your running site, reads your source code, and has a language model review the risky parts. One scan, one graded report, and patches for what it finds. These pages show how each part works, step by step.
Install and run a scan
Needs Python 3.11+ and git. The installer sets up an isolated environment and runs first-time setup. Nothing here needs an API key; add one to turn on the LLM review.
curl -fsSLo install.sh \
https://raw.githubusercontent.com/jaurakunal/isitsecure/main/install.sh
bash install.shisitsecure scan https://your-app.com --llm noneisitsecure scan --repo ./your-app \
--mode code-only --llm noneisitsecure fix --repo ./your-app --dry-runWindows installer, manual install, MCP setup and every flag are in the README.
How it works
Start here. The architecture page explains how a scan is built and run; the others zoom into one stage.
Architecture deep dive
Three entry points, one engine. How it is wired, the state every phase reads and writes, the concurrency model and the event stream.
The scan pipeline
Twenty phases in five stages, and which of them run with the inputs you give.
SAST ↔ DAST correlation
Paired findings confirm each other, and code findings generate new dynamic tests.
Triage and grading
Dedup without an LLM, remediation scope, the impact × likelihood matrix and the grade ladder.
The MCP remediation loop
Scan, explain, fix and verify from inside Cursor or Claude Code.
The scanners, by what they look for
Every scanner has its own animated page. Each group page first explains what the scanners in it have in common, then links to the individual pages.
Injection
SQL, command, NoSQL, XXE and template injection; XSS; SSRF; file upload; taint analysis.
Access control
IDOR, cross-user access, Row Level Security, route auth, privilege escalation, mass assignment.
Authentication and sessions
JWT forgery, token storage and cookie flags, login bypass, password reset, rate limiting.
Browser-side defenses
CSRF, CORS, open redirects, security headers, mixed content, SRI, source maps, client exposure.
Business logic
Race conditions, price manipulation and flow abuse that only reasoning can find.
Attack surface
Endpoint discovery, exposed files, method tampering, GraphQL, OpenAPI.
Secrets and dependencies
Keys in git history, known CVEs in npm, Python and Java packages, live OSV lookups.
Infrastructure configuration
Dockerfiles, Kubernetes manifests, Terraform and shell scripts.
Schemas and middleware
Prisma, Drizzle, Firebase rules, and middleware that does not cover every route.