vigneshwaran1702/Cloud-Security-Scanner

What it is

A self-hostable, single-developer CSPM web app (React 18 + Vite frontend, FastAPI/Python 3.10+ backend) licensed MIT. It presents itself as a multi-cloud auditor with OpenAI-driven remediation. The README's own file tree and defaults reveal it to be demo/portfolio-grade rather than a production scanner — the detail the summary cannot carry.

Maturity signals in the page itself

• backend/app/mock_data.py is described as "Demo security posture data and scan store," and the architecture diagram lists backend state as "In-Memory / DB State." The dashboard is fed by mock/imported data by default.
• Despite the AWS/Azure/GCP claim, the code layout only names cloud/ # AWS and Azure inspection modules — GCP is in the marketing bullets and diagram but not the module tree.
• Every integration is optional. The .env template marks Supabase, OpenAI, and AWS credentials as (Optional), and lists no Azure or GCP credential variables at all — so a default install scans nothing real.
• Finding ingestion accepts uploaded JSON/CSV "with path traversal validation" — i.e., import-a-scan is a first-class path, reinforcing that it's a viewer as much as a scanner.

How to run it

git clone https://github.com/vigneshwaran1702/Cloud-Security-Scanner.git
cd Cloud-Security-Scanner
docker-compose up --build   # brings up PostgreSQL, API, Frontend

Or manually: backend on :8000 via python -m uvicorn app.main:app --host 0.0.0.0 --port 8000 --reload, frontend on :3000 via npm run dev. Windows one-click launchers start-all.bat / run.ps1 exist. Swagger at http://localhost:8000/docs.

What to do

• If you need a working multi-cloud scanner today, this isn't it — treat it as a dashboard/UI reference or a starting scaffold, not a deployable auditor.
• If evaluating the code, confirm what cloud/ actually inspects (AWS/Azure boto3 + Azure mgmt SDKs) before trusting any provider claim, and check whether mock_data.py still backs the dashboard in your build.
• Compliance coverage claimed: CIS (AWS/Azure Foundations), NIST SP 800-53, SOC 2 Type II, PCI-DSS v4.0, HIPAA Security Rule, ISO/IEC 27001 — verify these are enforced checks, not label mappings, given the demo-data posture.

Caveats

Auth is real (Supabase + PyJWT fallback, Google OAuth, Admin/User RBAC), but the default SECRET_KEY=your-super-secret-jwt-key and static Postgres credentials in the sample .env must be replaced before any exposure. No versioned releases, CVEs, or benchmarks are stated on the page.