Scorpr Technical Documentation
Everything you need to audit modern web apps, verify Supabase RLS security, optimize for ChatGPT & Perplexity, and automate pre-deploy CI/CD gates.
Quickstart & Unified Crawler Architecture
Scorpr audits modern single-page applications (SPAs) and server-rendered frameworks (Next.js, Remix, Astro, Vite) by combining a multi-layered security fuzzer with a headless browser evaluation pipeline.
Zero-Trust SSRF Defense
Every URL submitted is resolved through DNS pinning. Private IP subnets (`127.0.0.1`, `10.0.0.0/8`, `192.168.0.0/16`, `169.254.169.254` AWS metadata) are rejected before any socket connection is established.
Headless Chromium Session
Executes dynamic DOM hydration, intercepts console exceptions, computes true Core Web Vitals (LCP, FID/INP, CLS, TTFB), and inspects compiled client-side JavaScript chunk bundles.
5-Stage Autonomous Pipeline
SHIELD Security Audit Rules (SEC-01 to SEC-10)
SHIELD tests applications against the most common vulnerabilities introduced by AI code generators (Cursor, Lovable, Bolt, v0).
Supabase PostgREST Unauthenticated RLS Bypass
Detects tables exposed to unauthenticated anonymous queries via `/rest/v1/<table_name>` without active Row Level Security policies.
Client-Side Secret Key Leakage in Compiled Bundles
Searches client JS chunks for tokens matching Stripe (`sk_live_`), OpenAI (`sk-proj-`), AWS Access Keys (`AKIA`), and Supabase service role keys.
Exposed Production Source Maps (.js.map)
Probes for publicly reachable `.map` files (e.g. `/_next/static/chunks/app/page.js.map`) exposing raw TypeScript source code, backend routes, and database models.
Missing OWASP Security Headers (CSP, HSTS, X-Frame-Options)
Verifies presence of Content-Security-Policy, Strict-Transport-Security, X-Content-Type-Options: nosniff, and X-Frame-Options: DENY.
Overly Permissive Cross-Origin Resource Sharing (CORS)
Detects `Access-Control-Allow-Origin: *` configured alongside `Access-Control-Allow-Credentials: true` on sensitive API routes.
Publicly Accessible Environment File (.env / .env.local)
Checks root web server paths for exposed configuration files containing unhashed secrets and database connection strings.
Open GraphQL Introspection in Production
Queries `/graphql` with `__schema` introspection probe. Production instances should disable introspection to prevent schema scraping.
Unprotected Next.js Server Action State Exposure
Validates that Next.js Server Actions enforce user session authorization checks rather than relying on client-side state passing.
Insecure Direct Object Reference (IDOR) on Seed Endpoints
Checks default test routes (`/api/seed`, `/api/reset`, `/api/admin/users`) left active in production deployments.
Unsanitized SSR Injection (v-html / dangerouslySetInnerHTML)
Detects unsanitized user query params or database records injected directly into raw HTML blocks, leading to XSS.
RADAR GEO/AEO & /llms.txt Specification
Traditional web crawlers (Googlebot) render JavaScript over several hours in secondary waves. AI bots (GPTBot, ClaudeBot, PerplexityBot) prioritize raw fast text extraction and often discard pure CSR/SPA skeletons.
How AI Crawlers Ingest Web Apps
Fetches raw HTML without full headless JS execution. If your landing copy is rendered entirely client-side via React hooks, GPTBot sees an empty `<div id="root"></div>`.
Extracts semantic headers, facts, and `/llms.txt` directly to produce direct answer citations. Fast TTFB (<300ms) is strongly weighted.
Prioritizes structured JSON-LD schemas and clean Markdown text hierarchy for contextual retrieval into Claude search models.
CI/CD GitHub Actions Gatekeeper
Block dangerous PRs before they hit production. Copy this pipeline snippet to .github/workflows/scorpr.yml.
name: Scorpr Pre-Flight Audit
on:
push:
branches: [main]
pull_request:
branches: [main]
jobs:
scorpr-audit:
name: Scorpr Pre-Deploy Gate
runs-on: ubuntu-latest
steps:
- name: Checkout Code
uses: actions/checkout@v4
- name: Execute Scorpr Headless Scan
id: scorpr
uses: scorpr-security/scorpr-action@v1
with:
api-key: ${{ secrets.SCORPR_API_KEY }}
target-url: https://preview-${{ github.sha }}.yourdomain.com
min-score: 80
fail-on-critical: true
- name: Post Remediation Summary to PR
if: failure()
uses: actions/github-script@v7
with:
script: |
const report = `### 🚨 Scorpr Audit Gate Failed
- **Overall Score:** ${{ steps.scorpr.outputs.overall_score }}/100
- **Critical Findings:** ${{ steps.scorpr.outputs.critical_count }}
[View Full Audit & 1-Click Cursor Patch](${{ steps.scorpr.outputs.report_url }})`;
github.rest.issues.createComment({
issue_number: context.issue.number,
owner: context.repo.owner,
repo: context.repo.repo,
body: report
});REST API Reference
Integrate Scorpr audits into your existing CI pipelines, staging deploy webhooks, or agency management dashboards.
// Request
POST https://api.scorpr.dev/v1/scans
Authorization: Bearer sc_live_894f2910aefb418
Content-Type: application/json
{
"url": "https://myapp.vercel.app",
"options": {
"deepMapScan": true,
"simulateAiBots": true,
"webhookUrl": "https://api.myapp.com/webhooks/scorpr"
}
}
// Response (201 Created)
{
"success": true,
"data": {
"scanId": "3fa85f64-5717-4562-b3fc-2c963f66afa6",
"status": "PROCESSING",
"targetUrl": "https://myapp.vercel.app",
"createdAt": "2026-10-23T14:20:00.000Z",
"pollUrl": "https://api.scorpr.dev/v1/scans/3fa85f64-5717-4562-b3fc-2c963f66afa6"
}
}// Response (200 OK)
{
"success": true,
"data": {
"id": "3fa85f64-5717-4562-b3fc-2c963f66afa6",
"targetUrl": "https://myapp.vercel.app",
"status": "COMPLETED",
"overallScore": 84,
"securityScore": 72,
"qcScore": 95,
"seoGeoScore": 86,
"summary": {
"totalFindings": 4,
"criticalCount": 1,
"highCount": 1,
"mediumCount": 2,
"lowCount": 0
},
"findings": [
{
"id": "SEC-01",
"module": "SHIELD",
"category": "SUPABASE_RLS_EXPOSED",
"severity": "CRITICAL",
"title": "Unauthenticated PostgREST Read Access on user_profiles",
"scoreImpact": -18,
"recommendation": "ALTER TABLE public.user_profiles ENABLE ROW LEVEL SECURITY;"
}
],
"generatedArtifacts": {
"masterCursorPrompt": "// Master Cursor Fix Patch...",
"llmsTxt": "# myapp\n> Pre-launch audit...",
"crawlMetrics": {
"ttfbMs": 142,
"domContentLoadedMs": 680,
"loadTimeMs": 1250
}
}
}
}