An enterprise-grade web security and source code vulnerability scanner by VFN Media Lab.
Developed by VFN Media Lab, this project is designed to benefit programmers and enhance website security; it is not intended for hacking any websites.
VFN-CyberSite is an enterprise-grade security auditing platform engineered to empower developers, organizations, and security teams to proactively identify, analyze, and remediate web vulnerabilities and source code flaws.
It does two main things:
- URL Scanner: Tests a live website for vulnerabilities like SQL injection, XSS, exposed config files, and missing security headers.
- Code Scanner: Scans your source code files (JavaScript, Python, PHP, Java, Go, etc.) for leaked API keys, hardcoded passwords, and unsafe code.
Make sure you have Node.js (version 18 or newer) installed.
git clone https://github.com/VFN-Lab/VFN-CyberSite.git
cd VFN-CyberSite
npm install
npm startNow open your browser and go to:
http://localhost:3000
- Type your website URL in the search box (e.g.,
https://mywebsite.com). - Click Start Scan.
- Verify Ownership: To prevent scanning sites you do not own, the tool asks you to upload a simple text file (
security-scanner-verification.txt) to your site root:Security Scanner Verification Domain: mywebsite.com Token: security-token-xxxxxx - Once uploaded to
https://mywebsite.com/security-scanner-verification.txt, click Verify & Start Scan. - Watch the scan run in real-time and review the results with fix recommendations.
- Switch to Code Scanner mode.
- Drag and drop your code files or paste a snippet.
- Click Scan Code to see line-by-line security issues and leaked secrets.
- Common Vulnerabilities: SQL Injection, XSS, Path Traversal, and SSRF.
- Exposed Files: Hidden directories,
.git,.envfiles, and database backups. - Server Configuration: SSL certificate validity, HTTP security headers, and open ports.
- Forms & Uploads: Unsafe file upload forms and weak login cookies.
- Leaked API keys, database credentials, and secret tokens.
- Unsafe functions and raw SQL queries.
- Supported languages: JS, TS, Python, PHP, Java, C#, Go, Ruby, SQL, HTML.
The official version of VFN-CyberSite is strictly safe and defensive:
- It only scans websites that you own and verify via the verification file.
- It will not scan random or third-party websites.
- Any modified versions or copies that remove this domain verification are not official releases of VFN-CyberSite.
This tool is created for educational purposes and authorized security testing only. Always get written permission before testing any system you do not own.
Important: This project should not be considered a final, definitive, or complete security guarantee. It serves as an automated baseline scanner and does not replace a manual penetration test or consulting with a professional cybersecurity specialist.
The authors and VFN Media Lab are not responsible for any misuse of this tool.
MIT © 2026 VFN Media Lab & CyberSite Contributors