Map the surface
A controlled demo application expands into routes, forms and endpoints.
Autonomous Vulnerability Scanner
CYBERSECURITY / QUEUED SYSTEMSAuthorized assessment tooling
Start with the surface. Finish with the evidence.
THE CONTEXT
Coordinate application discovery, security checks and remediation context.
THE KEY DECISION
Separate crawling from queued checks, and retain evidence with each finding.
THE RESULT
An inspectable security workflow illustrated here with a fictional local topology.
Security ScannerPROBE → FINDING
MECHANISM STUDY / 08SCHEMATIC
TAKE A CLOSER LOOKSELECT A STAGE ↓
SCROLL TO TRACE. SELECT TO EXPLORE.
Follow the connections as you scroll, or select a stage to see what happens there.
Queue the checks
Worker queues separate discovery, passive observations and active tests.
Explain the evidence
Stored observations lead; retrieval supplies secondary remediation context.
A multi-service security-assessment workflow joining browser crawling, queued checks, persistent findings and retrieval-assisted remediation.
PROJECT TYPE
Security workflow engineering
FOCUS
Cybersecurity + Backend + AI / ML + Developer tools
STATUS
Authorized assessment tooling
/01
The question.
Discovery, testing and explanation are different jobs. A useful report needs to preserve what was observed, how a check ran and why a remediation might apply.
/02
The approach.
A Playwright crawler discovers routes and forms. FastAPI orchestration feeds Celery/Redis workers for passive and active check categories. PostgreSQL retains jobs and findings; a Chroma-based retrieval layer supplies supporting remediation context.
/03
What came out of it.
The implementation includes SQL injection, reflected XSS, path-traversal, redirect and other check modules. The portfolio uses a fictional local topology to explain their coordination; it performs no scans and makes no validated detection-rate claim.
01
Discovery before inspection
Browser-driven crawling can observe rendered routes and forms that a static URL list misses.
02
Jobs have boundaries
Separate orchestrator, crawler and scanner services coordinate through queues and persistent job records.
03
AI does not create the finding
Retrieval-assisted text is an explanation layer. Request/response observations remain the basis of a finding.
Under the surface.
- Discovery & API
- Playwright · FastAPI
- Execution & history
- Celery · Redis · PostgreSQL · Docker Compose
- Reporting
- Chroma retrieval · optional model providers · evidence records
SCOPE & LIMITS
- Use requires authorization from the target owner.
- Implemented check categories are not proof of complete coverage or zero false positives.
- All targets and findings in the portfolio scene are schematic local examples.
NEXT PROJECT / 09
Have an idea of your own? Let’s talk