Garden is a one-URL automated asset discovery and passive security scanning tool designed for authorized targets. It performs passive, read-only scans (bounded GET requests within same-origin boundaries) without active exploitation. The tool supports two primary modes: quick (anonymous) scans and authenticated coverage analysis across three fixed contexts (anonymous, user, admin). Outputs include structured Markdown reports with asset inventory, evidence, security control observations, and explicit coverage gap explanations, emphasizing that zero findings do not imply safety unless coverage is fully qualified. The architecture is a Python 3.10+ application using FastAPI for the web API, Typer for the CLI, SQLAlchemy with Alembic for database management, and Playwright for browser automation during login and inventory collection. The system follows a service layer pattern shared by CLI, Web, and API entry points, with a multi-stage pipeline (validate → collect → normalize → compare coverage → replay authorization → analyze → report) orchestrated by ScanApplicationService. External dependencies include httpx for HTTP requests, Pydantic for data validation, and Jinja2 for templating. Garden is positioned as an internal AppSec workflow for post-authentication verification of authorized application surfaces, not as a general-purpose vulnerability scanner like Burp or ZAP. It features centralized redaction of sensitive data across all outputs, an ephemeral secret store for temporary credential handling, and a plugin-based security check system with six built-in low-risk checks. The codebase includes extensive test coverage (unit, integration, e2e), a comprehensive threat model, and detailed implementation plans for versioned releases (v0.2 trusted report quality, v0.3 passive authenticated coverage).
SILENTCHAIN AIâ„¢ Community Edition is a Burp Suite extension that performs AI-powered passive vulnerability scanning of HTTP traffic. It intercepts requests/responses through Burp's proxy, sends them to configurable AI providers (Burp AI, Ollama, OpenAI, Claude, Gemini, Azure), and generates OWASP Top 10 vulnerability findings. The extension features a modular architecture with a thread pool for background AI processing, Swing-based UI integrated into Burp Suite, and persistence for settings via Burp's preferences API. Key capabilities include bidirectional data sanitization to prevent leaking secrets to AI providers, robust JSON parsing for handling LLM output inconsistencies, layered HTTP filtering (scope, content-type, rate limiting, URL deduplication), and real-time UI updates showing findings, task status, and statistics.