secrdev/secr

Application security made easy

secr's Issues

[FEATURE REQUEST] Add vulnerability descriptions and severity scores to table

[FEATURE REQUEST] Add steps to recreate + patch vulnerabilities to table

Is your feature request related to a problem? Please describe.
Add steps to recreate and patch vulnerabilities found to either the table UI or dashboard in some capacity; was thinking about a modal or some kind of popup that outlines clear steps for each task; will do designs for this soon.

[FEATURE REQUEST] Add search in table component

Describe the solution you'd like
Input component that, when typed into, displays matching data from table without requiring submission.

[FEATURE REQUEST] Make dashboard UI more responsive, and improve components generally

Describe the solution you'd like
Make dashboard UI functional on all machines, components need to be more user-friendly, readable, and searchable generally. Also, there should be a hyperlink in the dashboard to return to search.

URL parsing

Show exploits too, and differentiate them in dashboard from vulns.

[FEATURE REQUEST] Test Docker Compose architecture on all machines; ensure script installs dc if it isn't already.

[FEATURE REQUEST] Background scanning

Is your feature request related to a problem? Please describe.

The problem is that manual scanning can be forgotten, background scanning is an always-on proactive approach to application security

Describe the solution you'd like

The solution I have in mind is for Secr to run as an always-on service that scans a list of known endpoints for servers

Describe alternatives you've considered

There are two approaches I have thought of:

1. periodic scans: every 24-hours or some fixed time period, scan my servers
2. scanning is triggered by a deployment (such as integration with Github actions)

I think that periodic scanning is easiest to implement, and the code can be eventually reused in triggered scans, provided we add some sort of background-scanning functionality

Additional context

Not really targeted at localhost scanning, this is geared towards live staging and prod environments

Port and Build to Electron on all platforms.