$ show lissy93/web-check
This is a full-stack web application for performing open-source intelligence (OSINT) analysis on any website. The system runs 40+ checks encompassing DNS, SSL/TLS, HTTP security headers, mail configuration (SPF/DKIM/DMARC), social media presence, trackers, blocklists, threat feeds, carbon footprint, tech stack, and more. The frontend is built with Astro and React, featuring a reactive results view with a masonry grid, advisory panel, and progress bar. The backend is a Node.js Express server (also serverless-friendly) with individual API handlers per check, wrapped in a common middleware layer for error handling, rate limiting, and skip logic. The application is designed for self-hosting and supports deployment to Vercel, Netlify, Docker, Render, and Fly.io. It relies on many external sources (DNS, WHOIS, SSL Labs, HIBP, Google Safe Browsing, Shodan, etc.) and uses Puppeteer/Chromium for headless browser tasks. The codebase demonstrates a clean modular architecture, reusable UI components, and a novel analysis rule system that transforms raw data into structured findings with severity levels.
The LLM identified 4 files worth highlighting for reuse:
A pure function that takes raw mail configuration data (MX, SPF, DMARC, DKIM, MTA-STS, DANE) and produces structured findings with severity (pass/warning/issue). It demonstrates excellent separation of concerns, defensive parsing, and a reusable pattern for turning external data into actionable audit results. Could be extracted as a standalone library for email security auditing.
A configurable checker that determines whether a given check should be skipped based on environment variables (disabled checks, blocked hosts, private IPs, instance-level disable). It is self-contained (no internal imports) and implements a clean decision tree. Can be reused in any Express or serverless API that needs per-check skip logic.
Defines a registry mapping check IDs to job specs (fetch function + card components). Each job spec includes retry/polling helpers and fallback promotion. This centralized abstraction decouples data fetching from UI rendering and is easily extensible. The pattern is applicable to any dashboard application that needs to run multiple independent data sources and display results.
Discovers and verifies social media profiles (X, Bluesky, Mastodon, GitHub) on a target website. Uses a registry of NETWORKS with discovery methods (page metadata, JSON-LD, rel-me links, platform APIs). The approach is modular: adding a new platform requires only a new entry in the registry. This pattern is highly reusable for any social link mining task.