secaudit

Domain reconnaissance with a terminal report. Give it a domain; it runs read-only passive recon (DNS, TLS, RDAP, mail/HTTP security policy, CT logs, DNSSEC) and, on targets you own or are authorized to test, optional active scans (nmap/nuclei/httpx). Results land in a live split-pane TUI plus a shareable markdown/JSON report.

Passive by default. Active probing (port/vuln scans) is gated behind an ownership guardrail: scanning a third-party system you neither own nor are authorized to test is refused.

go install github.com/ismailtrm/secaudit@latest

Or from a clone:

go build -o secaudit .

secaudit                       # full-screen launcher (centered search + mode bar)
secaudit example.com           # jump straight in (launcher prefilled)
secaudit example.com --no-tui  # headless: print summary + write report files
secaudit example.com --format json
secaudit checkers list         # registered checkers + availability

Launcher keys: type a domain · tab cycle ownership · ↑/↓ toggle mode (passive only / passive + active) · enter scan · esc quit. Scanning keys: esc cancel and return to launcher · ? help · ctrl+c quit. Results keys: ↑/↓ move · ←/→ switch passive/active pane · PgDn/PgUp scroll detail · f filter by severity · s sort · w write report · n new scan · ? help · q quit.

The results screen splits passive findings (left) and active findings (right) with a full-width detail pane below; a passive-only scan shows a single list. The interactive UI runs full-screen (alternate screen) and restores your terminal on exit. --no-tui is a plain headless run.

Flags:

Reports are written as report-<domain>-<timestamp>.{md,json} (mode 0600).

The headless flags make secaudit usable as a CI gate:

# fail the pipeline (exit 2) if any HIGH+ finding appears; clean JSON to stdout
secaudit example.com --no-tui --format json --out - --fail-on high | jq .score
# run a focused subset; progress goes to stderr, report to stdout
secaudit example.com --no-tui --only tls.cert,dns.policy --format json --out -

--fail-on, --only, --skip, and --out - apply to the headless path only (the interactive TUI ignores them). Progress lines are written to stderr, so stdout stays clean for piping.

crt.sh and Wayback results are cached in a small SQLite TTL store (~/.config/secaudit/cache.db) so repeated scans don't re-hit flaky services.

Active checkers probe the target directly and only run with --mode active, which the guardrail permits solely for own/authorized ownership. They shell out to installed binaries and skip gracefully if a binary is missing. Findings stream into the live feed as they're discovered (nuclei especially).

secaudit example.com --mode active --ownership own   # headless active scan
# or pick "active" + "own" in the launcher's bottom bar

Adding a checker is one file: implement checker.Checker and call checker.Register from an init(). The engine and TUI discover it automatically.

cmd/            CLI (cobra): scan, checkers
internal/
  checker/      plugin contract + checkers + registry
  engine/       concurrent fan-out, streams Results
  tui/          bubbletea screens (launcher → live scan → split-pane results)
  report/       markdown / JSON / text rendering
  guard/        ownership × mode authorization (the legal hard-fail)
  tool/         external-binary discovery (active checkers)
  cache/        SQLite TTL cache
  config/       on-disk paths

make build      # go build ./...
make test       # go test -race -cover ./...
make lint       # golangci-lint run
make vuln       # govulncheck ./...
make ci         # build + vet + fmt-check + test

CI (.github/workflows/ci.yml) runs build, vet, gofmt check, test -race, golangci-lint, and govulncheck on every push and pull request.