$ show Moxxkidd/Garden
Garden is a one-URL automated asset discovery and passive security scanning tool designed for authorized targets. It performs passive, read-only scans (bounded GET requests within same-origin boundaries) without active exploitation. The tool supports two primary modes: quick (anonymous) scans and authenticated coverage analysis across three fixed contexts (anonymous, user, admin). Outputs include structured Markdown reports with asset inventory, evidence, security control observations, and explicit coverage gap explanations, emphasizing that zero findings do not imply safety unless coverage is fully qualified. The architecture is a Python 3.10+ application using FastAPI for the web API, Typer for the CLI, SQLAlchemy with Alembic for database management, and Playwright for browser automation during login and inventory collection. The system follows a service layer pattern shared by CLI, Web, and API entry points, with a multi-stage pipeline (validate → collect → normalize → compare coverage → replay authorization → analyze → report) orchestrated by ScanApplicationService. External dependencies include httpx for HTTP requests, Pydantic for data validation, and Jinja2 for templating. Garden is positioned as an internal AppSec workflow for post-authentication verification of authorized application surfaces, not as a general-purpose vulnerability scanner like Burp or ZAP. It features centralized redaction of sensitive data across all outputs, an ephemeral secret store for temporary credential handling, and a plugin-based security check system with six built-in low-risk checks. The codebase includes extensive test coverage (unit, integration, e2e), a comprehensive threat model, and detailed implementation plans for versioned releases (v0.2 trusted report quality, v0.3 passive authenticated coverage).
The LLM identified 3 files worth highlighting for reuse:
Centralized redaction service that strips sensitive information (emails, tokens, passwords, session IDs, cookies, headers, control characters) from text, dictionaries, and HTTP headers. Used across evidence capture, exports, and diagnostics. Reusable as a standalone class with no internal dependencies beyond standard library and its own constants, making it easy to extract into any project needing consistent output sanitization.
Manages temporary credential files with strict permissions (0o600), atomic file replacement via os.replace, and automatic purging after a configurable timeout (default 15 minutes). Provides private, secure file handles for interactive coverage workflows, ensuring secrets never persist in memory or on disk beyond their intended lifetime. Reusable in any application needing short-lived secret storage without relying on a dedicated secrets manager.
Generates stable canonical identities for URLs and response fingerprints. URL identities normalize paths, ignore query values, ports, and fragments for consistent comparison. Response fingerprints strip timestamps, UUIDs, and other volatile content to produce stable signatures suitable for change detection and asset deduplication. Reusable in any system requiring robust URL-based identity resolution or response similarity matching.