Overview & Architecture
NPMeta Security (hosted at npmeta.com) is an automated, non-destructive web security and API attack surface auditor. It enables developers, security engineers, and DevOps teams to audit public websites and discover vulnerabilities across TLS configurations, HTTP response headers, cookie flags, exposed administrative surfaces, and broken authorization models.
When moving fast with AI coding tools (such as Claude coding, Cursor, Windsurf, or GitHub Copilot), security headers, permissive CORS policies, exposed Swagger schemas, and sensitive environment endpoints are often overlooked. NPMeta Security provides an instant baseline posture check before deploying vibe-coded prototypes to live production.
Strictly read-only requests. No destructive payloads or database alterations.
Scalable job distribution with real-time SSE / polling progress telemetry.
Credentials remain in RAM only for the scan lifetime and are never stored.
System Architecture Flow
[Client / Browser]
│
├──> (POST /api/scans) ─────────> [FastAPI Backend]
│ │
│ (Enqueues Task)
│ ▼
│ [Redis Task Broker]
│ │
│ (Worker Pulls)
│ ▼
│ [Celery Scan Worker]
│ │
│ ┌────────────────────────────────┴──────────────────────────────┐
│ ▼ ▼ ▼
│ [SSRF Guard] [TLS Socket Probe] [Admin & BFLA Engine]
│ │ │ │
│ └────────────────────────────────┬──────────────────────────────┘
│ ▼
│ [Score Normalization (0-100)]
│ ▼
│ [PostgreSQL Database (Scans)]
│ ▲
└─── (GET /api/scans/:id) ───────────────┘
Quickstart
Launch a scan directly from the web interface or via the REST API.
curl -X POST http://localhost:8000/api/scans \
-H "Content-Type: application/json" \
-d '{"url": "https://example.com"}'{
"id": "e7b03a62-9721-4d10-8b01-f9c464ef2d9a",
"target_url": "https://example.com",
"status": "PENDING",
"progress": 0,
"created_at": "2026-09-03T20:30:00.000Z"
}curl -s http://localhost:8000/api/scans/e7b03a62-9721-4d10-8b01-f9c464ef2d9a/report | jq .scorePublic Surface Audits
Public audits run without credentials and evaluate the target exactly as an external observer would.
SSRF Defense & Host Validation:
Before initiating network connections, SecureScan performs strict Server-Side Request Forgery (SSRF) checks:
- Blocks RFC 1918 Private IPv4 subnets (
10.0.0.0/8,172.16.0.0/12,192.168.0.0/16). - Blocks Loopback addresses (
127.0.0.0/8,::1). - Blocks Cloud Metadata endpoints (
169.254.169.254). - Blocks non-HTTP protocols (
file://,gopher://,ftp://).
ALLOW_LOCAL_TARGETS=true in your backend environment to scan mock targets like http://127.0.0.1:8085.Authenticated Audits (Behind Login)
Authenticate your scan using session tokens or cookies to analyze internal API endpoints and privilege boundaries.
How NPMeta Security Detects BFLA:
When you run an authenticated audit with a standard user token, NPMeta Security safely probes administrative paths:
GET /api/admin/metrics HTTP/1.1
Host: api.target.com
Authorization: Bearer <STANDARD_USER_TOKEN>Vulnerability Engines & Automated Posture Checks
NPMeta Security orchestrates comprehensive, safe, and non-destructive security engines auditing all 17 enterprise risk categories:
BOLA / IDOR Detection
Scans parameterized resource paths (/api/orders/{id}) to verify that cross-tenant record lookups require authorization barriers and do not leak records to unprivileged callers.
Missing Backend Authorization
Probes sensitive collections (/api/users, /api/export) without credentials; flags routes returning HTTP 200 with sensitive collections without auth challenges.
Mass Assignment Audit
Audits POST/PUT/PATCH endpoints for vulnerable privilege-escalation parameters (role, is_admin, permissions, balance) accepted without DTO filtering.
Client-Side-Only Security
Detects administrative interfaces hidden only in frontend JavaScript where underlying backend API endpoints lack server-side authorization enforcement.
AI API Key Exposure
Deep-scans client assets for leaked LLM credentials: OpenAI (sk-proj-), Anthropic Claude (sk-ant-api03-), Google Gemini (AIzaSy), HuggingFace (hf_), and Cohere keys.
Cloud & Infrastructure Secrets
Identifies exposed AWS Access Keys (AKIA...), Stripe live secret keys, GitHub Personal Access Tokens, Slack webhooks, Private RSA keys, and database connection strings.
Database Error Disclosure
Passively evaluates responses for raw SQL/NoSQL error disclosures (MySQL syntax errors, PostgreSQL traces, Oracle ORA- codes, SQLite JDBC exceptions, and MongoError signatures).
AI Prompt & Tool Injection Posture
Identifies exposed LLM chat and generation endpoints (/api/chat, /api/llm) lacking authentication, rate-limiting, or prompt injection guardrails.
XSS Posture & CSP
Audits Content-Security-Policy for dangerous unsafe-inline or unsafe-eval keywords and missing script source controls.
CORS Misconfigurations
Tests for wildcard origin reflection (*) with credentials, arbitrary origin reflection, and null origin acceptance.
Cookies & Headers
Verifies HSTS, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, and cookie Secure, HttpOnly, and SameSite flags.
SSRF Parameter Discovery
Flags URL/webhook reflection parameters (?url=, ?dest=, ?webhook=) prone to Server-Side Request Forgery.
File Upload Surface
Probes upload routes (/upload, /api/v1/files) for unauthenticated access and missing MIME restrictions.
Business Logic & Idempotency
Checks state-changing financial/transactional routes (/checkout, /orders) for missing Idempotency-Key protections.
Missing Rate Limiting
Sends bounded safe bursts (7-8 rapid requests) against auth endpoints (/login) to verify HTTP 429 throttling and X-RateLimit-* headers.
Debug & Dev Endpoints
Probes for exposed Spring Actuators (/actuator/env), Django debug toolbar, Symfony profilers, PHP info (/phpinfo.php), and GraphQL consoles.
Dependency CVE Vulnerabilities
Inspects server banners and client libraries against known CVEs (e.g. legacy jQuery < 3.5.0, Apache-Coyote 1.1, EOL PHP versions).
Cloud & Docker Misconfigurations
Checks for exposed container manifests in webroot (/Dockerfile, /docker-compose.yml, /.dockerignore).
Performs real TLS handshakes, verifies certificate validity period, detects expiration within 30 days, checks hostname SAN matching, and detects deprecated TLS 1.0/1.1 protocols.
REST API Reference
Integrate NPMeta Security directly into your developer workflows, pre-deployment pipelines, or security dashboards.
Creates an asynchronous scan job.
curl -X POST "http://localhost:8000/api/scans" \
-H "Content-Type: application/json" \
-d '{
"url": "https://example.com",
"auth_type": "bearer",
"auth_token": "eyJhbGciOiJIUzI1NiIs..."
}'Request Parameters
| Parameter | Type | Required | Description |
|---|---|---|---|
| url | string | Yes | Target website address (e.g. https://example.com) |
| auth_type | string | No | none | bearer | api_key | cookie |
| auth_token | string | No | JWT Bearer token when auth_type is "bearer" |
| auth_header_name | string | No | Header name (default: X-API-Key) |
| auth_cookie | string | No | Raw cookie header string |
Polls the live progress and status of a running scan.
{
"id": "e7b03a62-9721-4d10-8b01-f9c464ef2d9a",
"status": "RUNNING",
"progress": 75,
"current_stage": "Security headers & cookie flags inspected",
"error_message": null
}Retrieves the complete executive security report including category scores, rating tier, detailed findings, and discovered endpoints.
{
"id": "e7b03a62-9721-4d10-8b01-f9c464ef2d9a",
"target_url": "https://example.com",
"score": 94,
"rating": "EXCELLENT",
"is_authenticated": false,
"severity_counts": { "critical": 0, "high": 0, "medium": 1, "low": 2, "info": 1, "passed": 8 },
"category_scores": { "TLS": 100, "HTTP Headers": 88, "Cookies": 100, "CORS": 100, "API Security": 100 },
"findings": [...]
}Exports the report as a downloadable JSON file or renders a standalone executive HTML report document.
CI/CD & Automation Integration
Enforce security baselines in your continuous delivery pipelines. Fail the build if the target score falls below 80 or if critical vulnerabilities exist.
#!/usr/bin/env bash
set -e
TARGET="https://staging.myapp.com"
API_URL="http://localhost:8000"
echo "Launching NPMeta Security audit on $TARGET..."
SCAN_ID=$(curl -s -X POST "$API_URL/api/scans" \
-H "Content-Type: application/json" \
-d "{\"url\": \"$TARGET\"}" | jq -r .id)
echo "Scan ID: $SCAN_ID. Waiting for audit to complete..."
while true; do
STATUS=$(curl -s "$API_URL/api/scans/$SCAN_ID" | jq -r .status)
if [ "$STATUS" = "COMPLETED" ]; then break; fi
if [ "$STATUS" = "FAILED" ]; then echo "Scan Failed"; exit 1; fi
sleep 2
done
SCORE=$(curl -s "$API_URL/api/scans/$SCAN_ID/report" | jq -r .score)
CRITICAL_COUNT=$(curl -s "$API_URL/api/scans/$SCAN_ID/report" | jq -r .severity_counts.critical)
echo "Security Score: $SCORE/100 | Critical Issues: $CRITICAL_COUNT"
if [ "$CRITICAL_COUNT" -gt 0 ]; then
echo "FAIL: Critical vulnerabilities detected!"
exit 1
fi
if [ "$SCORE" -lt 80 ]; then
echo "FAIL: Posture score $SCORE is below threshold 80"
exit 1
fi
echo "SUCCESS: Security baseline passed."Benchmarking with Local Mock Target
The project includes a built-in intentionally vulnerable test target running on port 8085 to validate every scanner feature.
- •
/.env- Leaks mock database passwords (CRITICAL). - •
/admin- Unauthenticated administrative console (CRITICAL). - •
/api/admin/metrics- Vulnerable to BFLA with user token (CRITICAL). - •
/api/admin/restricted-vault- Properly enforces 403 Forbidden (PASS).