NPMetaSECURITY
NPMeta SecurityDocumentationoverview
GETTING STARTED/ARCHITECTURE

Overview & Architecture

NPMeta Security (hosted at npmeta.com) is an automated, non-destructive web security and API attack surface auditor. It enables developers, security engineers, and DevOps teams to audit public websites and discover vulnerabilities across TLS configurations, HTTP response headers, cookie flags, exposed administrative surfaces, and broken authorization models.

Auditing AI-Generated & Vibe Coding Projects

When moving fast with AI coding tools (such as Claude coding, Cursor, Windsurf, or GitHub Copilot), security headers, permissive CORS policies, exposed Swagger schemas, and sensitive environment endpoints are often overlooked. NPMeta Security provides an instant baseline posture check before deploying vibe-coded prototypes to live production.

NON-DESTRUCTIVE
Passive Probes

Strictly read-only requests. No destructive payloads or database alterations.

ASYNCHRONOUS
Celery + Redis

Scalable job distribution with real-time SSE / polling progress telemetry.

ZERO-STORAGE
Safe Auth Audit

Credentials remain in RAM only for the scan lifetime and are never stored.

System Architecture Flow

architecture-pipeline.txt
[Client / Browser]
        │
        ├──> (POST /api/scans) ─────────> [FastAPI Backend]
        │                                        │
        │                                  (Enqueues Task)
        │                                        ▼
        │                                [Redis Task Broker]
        │                                        │
        │                                  (Worker Pulls)
        │                                        ▼
        │                              [Celery Scan Worker]
        │                                        │
        │       ┌────────────────────────────────┴──────────────────────────────┐
        │       ▼                                ▼                              ▼
        │  [SSRF Guard]                    [TLS Socket Probe]           [Admin & BFLA Engine]
        │       │                                │                              │
        │       └────────────────────────────────┬──────────────────────────────┘
        │                                        ▼
        │                            [Score Normalization (0-100)]
        │                                        ▼
        │                            [PostgreSQL Database (Scans)]
        │                                        ▲
        └─── (GET /api/scans/:id) ───────────────┘

Quickstart

Launch a scan directly from the web interface or via the REST API.

Step 1: Submit Target via cURL
terminal
curl -X POST http://localhost:8000/api/scans \
  -H "Content-Type: application/json" \
  -d '{"url": "https://example.com"}'
Returns:
response.json
{
  "id": "e7b03a62-9721-4d10-8b01-f9c464ef2d9a",
  "target_url": "https://example.com",
  "status": "PENDING",
  "progress": 0,
  "created_at": "2026-09-03T20:30:00.000Z"
}
Step 2: Poll Progress & Fetch Report
terminal
curl -s http://localhost:8000/api/scans/e7b03a62-9721-4d10-8b01-f9c464ef2d9a/report | jq .score

Public Surface Audits

Public audits run without credentials and evaluate the target exactly as an external observer would.

SSRF Defense & Host Validation:

Before initiating network connections, SecureScan performs strict Server-Side Request Forgery (SSRF) checks:

  • Blocks RFC 1918 Private IPv4 subnets (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16).
  • Blocks Loopback addresses (127.0.0.0/8, ::1).
  • Blocks Cloud Metadata endpoints (169.254.169.254).
  • Blocks non-HTTP protocols (file://, gopher://, ftp://).
Note: When testing locally, set ALLOW_LOCAL_TARGETS=true in your backend environment to scan mock targets like http://127.0.0.1:8085.

Authenticated Audits (Behind Login)

Authenticate your scan using session tokens or cookies to analyze internal API endpoints and privilege boundaries.

BEARER TOKEN
Authorization header with JWT or opaque token.
Header: Authorization: Bearer eyJ...
CUSTOM API KEY
Custom header name and secret key value.
Header: X-API-Key: key_live_...
SESSION COOKIE
Raw cookie string for web session emulation.
Cookie: sessionid=abc123...
Zero-Storage Guarantee:Tokens are accepted ephemerally by the API router, dispatched over Celery in-memory kwargs, and never written to the PostgreSQL database or persistent logs.

How NPMeta Security Detects BFLA:

When you run an authenticated audit with a standard user token, NPMeta Security safely probes administrative paths:

bfla-request.http
GET /api/admin/metrics HTTP/1.1
Host: api.target.com
Authorization: Bearer <STANDARD_USER_TOKEN>
Proper Authorization (PASS): Target returns HTTP 403 Forbidden or 401 Unauthorized.
Vulnerable to BFLA (CRITICAL): Target returns HTTP 200 OK and exposes administrative data.

Vulnerability Engines & Automated Posture Checks

NPMeta Security orchestrates comprehensive, safe, and non-destructive security engines auditing all 17 enterprise risk categories:

1. API Authorization, BOLA & Logic EngineOWASP API #1 & #5

BOLA / IDOR Detection

Scans parameterized resource paths (/api/orders/{id}) to verify that cross-tenant record lookups require authorization barriers and do not leak records to unprivileged callers.

Missing Backend Authorization

Probes sensitive collections (/api/users, /api/export) without credentials; flags routes returning HTTP 200 with sensitive collections without auth challenges.

Mass Assignment Audit

Audits POST/PUT/PATCH endpoints for vulnerable privilege-escalation parameters (role, is_admin, permissions, balance) accepted without DTO filtering.

Client-Side-Only Security

Detects administrative interfaces hidden only in frontend JavaScript where underlying backend API endpoints lack server-side authorization enforcement.

2. Hardcoded Secrets & AI API Key EngineCRITICAL SECRETS

AI API Key Exposure

Deep-scans client assets for leaked LLM credentials: OpenAI (sk-proj-), Anthropic Claude (sk-ant-api03-), Google Gemini (AIzaSy), HuggingFace (hf_), and Cohere keys.

Cloud & Infrastructure Secrets

Identifies exposed AWS Access Keys (AKIA...), Stripe live secret keys, GitHub Personal Access Tokens, Slack webhooks, Private RSA keys, and database connection strings.

3. SQL / NoSQL Injection Posture & AI EndpointsNon-Destructive Probing

Database Error Disclosure

Passively evaluates responses for raw SQL/NoSQL error disclosures (MySQL syntax errors, PostgreSQL traces, Oracle ORA- codes, SQLite JDBC exceptions, and MongoError signatures).

AI Prompt & Tool Injection Posture

Identifies exposed LLM chat and generation endpoints (/api/chat, /api/llm) lacking authentication, rate-limiting, or prompt injection guardrails.

4. XSS, CORS & HTTP Headers PostureClient-Side Defense

XSS Posture & CSP

Audits Content-Security-Policy for dangerous unsafe-inline or unsafe-eval keywords and missing script source controls.

CORS Misconfigurations

Tests for wildcard origin reflection (*) with credentials, arbitrary origin reflection, and null origin acceptance.

Cookies & Headers

Verifies HSTS, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, and cookie Secure, HttpOnly, and SameSite flags.

5. SSRF, File Upload & Business Logic EngineWorkflow Validation

SSRF Parameter Discovery

Flags URL/webhook reflection parameters (?url=, ?dest=, ?webhook=) prone to Server-Side Request Forgery.

File Upload Surface

Probes upload routes (/upload, /api/v1/files) for unauthenticated access and missing MIME restrictions.

Business Logic & Idempotency

Checks state-changing financial/transactional routes (/checkout, /orders) for missing Idempotency-Key protections.

6. Rate Limiting, Debug Endpoints & Cloud MisconfigInfrastructure Security

Missing Rate Limiting

Sends bounded safe bursts (7-8 rapid requests) against auth endpoints (/login) to verify HTTP 429 throttling and X-RateLimit-* headers.

Debug & Dev Endpoints

Probes for exposed Spring Actuators (/actuator/env), Django debug toolbar, Symfony profilers, PHP info (/phpinfo.php), and GraphQL consoles.

Dependency CVE Vulnerabilities

Inspects server banners and client libraries against known CVEs (e.g. legacy jQuery < 3.5.0, Apache-Coyote 1.1, EOL PHP versions).

Cloud & Docker Misconfigurations

Checks for exposed container manifests in webroot (/Dockerfile, /docker-compose.yml, /.dockerignore).

7. Transport Layer Security (TLS) EnginePassive Socket

Performs real TLS handshakes, verifies certificate validity period, detects expiration within 30 days, checks hostname SAN matching, and detects deprecated TLS 1.0/1.1 protocols.

API REFERENCE/ENDPOINTS

REST API Reference

Integrate NPMeta Security directly into your developer workflows, pre-deployment pipelines, or security dashboards.

Interactive Swagger UI
POST/api/scans

Creates an asynchronous scan job.

Create Scan (cURL)
curl -X POST "http://localhost:8000/api/scans" \
  -H "Content-Type: application/json" \
  -d '{
    "url": "https://example.com",
    "auth_type": "bearer",
    "auth_token": "eyJhbGciOiJIUzI1NiIs..."
  }'
Request Parameters
ParameterTypeRequiredDescription
urlstringYesTarget website address (e.g. https://example.com)
auth_typestringNonone | bearer | api_key | cookie
auth_tokenstringNoJWT Bearer token when auth_type is "bearer"
auth_header_namestringNoHeader name (default: X-API-Key)
auth_cookiestringNoRaw cookie header string
GET/api/scans/:id

Polls the live progress and status of a running scan.

GET /api/scans/:id Response
{
  "id": "e7b03a62-9721-4d10-8b01-f9c464ef2d9a",
  "status": "RUNNING",
  "progress": 75,
  "current_stage": "Security headers & cookie flags inspected",
  "error_message": null
}
GET/api/scans/:id/report

Retrieves the complete executive security report including category scores, rating tier, detailed findings, and discovered endpoints.

Report Response Snippet
{
  "id": "e7b03a62-9721-4d10-8b01-f9c464ef2d9a",
  "target_url": "https://example.com",
  "score": 94,
  "rating": "EXCELLENT",
  "is_authenticated": false,
  "severity_counts": { "critical": 0, "high": 0, "medium": 1, "low": 2, "info": 1, "passed": 8 },
  "category_scores": { "TLS": 100, "HTTP Headers": 88, "Cookies": 100, "CORS": 100, "API Security": 100 },
  "findings": [...]
}
GET/api/reports/:id/exportand/api/reports/:id/export/html

Exports the report as a downloadable JSON file or renders a standalone executive HTML report document.

CI/CD & Automation Integration

Enforce security baselines in your continuous delivery pipelines. Fail the build if the target score falls below 80 or if critical vulnerabilities exist.

ci-security-check.sh
#!/usr/bin/env bash
set -e

TARGET="https://staging.myapp.com"
API_URL="http://localhost:8000"

echo "Launching NPMeta Security audit on $TARGET..."
SCAN_ID=$(curl -s -X POST "$API_URL/api/scans" \
  -H "Content-Type: application/json" \
  -d "{\"url\": \"$TARGET\"}" | jq -r .id)

echo "Scan ID: $SCAN_ID. Waiting for audit to complete..."
while true; do
  STATUS=$(curl -s "$API_URL/api/scans/$SCAN_ID" | jq -r .status)
  if [ "$STATUS" = "COMPLETED" ]; then break; fi
  if [ "$STATUS" = "FAILED" ]; then echo "Scan Failed"; exit 1; fi
  sleep 2
done

SCORE=$(curl -s "$API_URL/api/scans/$SCAN_ID/report" | jq -r .score)
CRITICAL_COUNT=$(curl -s "$API_URL/api/scans/$SCAN_ID/report" | jq -r .severity_counts.critical)

echo "Security Score: $SCORE/100 | Critical Issues: $CRITICAL_COUNT"

if [ "$CRITICAL_COUNT" -gt 0 ]; then
  echo "FAIL: Critical vulnerabilities detected!"
  exit 1
fi

if [ "$SCORE" -lt 80 ]; then
  echo "FAIL: Posture score $SCORE is below threshold 80"
  exit 1
fi

echo "SUCCESS: Security baseline passed."

Benchmarking with Local Mock Target

The project includes a built-in intentionally vulnerable test target running on port 8085 to validate every scanner feature.

Pre-configured Test Endpoints:
  • /.env - Leaks mock database passwords (CRITICAL).
  • /admin - Unauthenticated administrative console (CRITICAL).
  • /api/admin/metrics - Vulnerable to BFLA with user token (CRITICAL).
  • /api/admin/restricted-vault - Properly enforces 403 Forbidden (PASS).