corefixhq/cfix-web repository overview

⁠CoreFix Web Scanner

CoreFix Web Scanner runs dynamic application security testing (DAST) against any live URL — no source code required. It combines port scanning, CVE detection, web crawling, active scanning, and SSL/TLS analysis, then normalizes, deduplicates, and AI-prioritizes findings by real exploitability. One command. Zero configuration.

⁠Quick Start

docker run --rm \
  -e X_CFIX_API_KEY=cfix_live_YOUR_API_KEY \
  -v $(pwd):/web \
  -v ~/scan-results:/output \
  corefixhq/cfix-web \
  --target https://your-app.com

--target is the only required flag. First results in minutes.

⁠What Gets Scanned

All scanners run in parallel inside the container. Results are normalized into a single format, deduplicated, and sent for AI enrichment.

⁠Usage

⁠Scan with default scanners

Default: nmap,vuln,web

docker run --rm \
  -e X_CFIX_API_KEY=cfix_live_YOUR_API_KEY \
  -v $(pwd):/web \
  -v ~/scan-results:/output \
  corefixhq/cfix-web \
  --target https://your-app.com

⁠Run specific scanners only

Pass scanner names as the first argument.

# SSL/TLS only
docker run --rm \
  -e X_CFIX_API_KEY=cfix_live_YOUR_API_KEY \
  -v $(pwd):/web \
  -v ~/scan-results:/output \
  corefixhq/cfix-web testssl \
  --target https://your-app.com

# Port scan + CVEs only
docker run --rm \
  -e X_CFIX_API_KEY=cfix_live_YOUR_API_KEY \
  -v $(pwd):/web \
  -v ~/scan-results:/output \
  corefixhq/cfix-web nmap,vuln \
  --target https://your-app.com

⁠The web shorthand

web auto-selects the right sub-scanners for your target:

• Target is https:// → adds testssl
• Credentials provided → uses zap-auth (authenticated)
• No credentials → uses zap (unauthenticated)

⁠Authenticated Scans

Pass credentials to scan behind a login. The scanner uses a real browser to handle login flows, JavaScript rendering, and sessions — and picks its browser automatically:

docker run --rm \
  -e X_CFIX_API_KEY=cfix_live_YOUR_API_KEY \
  -v $(pwd):/web \
  -v ~/scan-results:/output \
  corefixhq/cfix-web \
  --target https://your-app.com \
  --username admin \
  --password s3cr3t

1. Cloudflare managed browser (default) — zero setup, used automatically when no local browser is found.
2. Local Chromium (optional) — launch headless Chromium on port 9222, then add --network host so the container can reach it. Use this for performance or network-isolation reasons.

For complex flows, drop a .cfix.web.yaml config or recorded .har files into the directory mounted at /web (see Configuration⁠).

⁠AI Enrichment

Findings are processed through CoreFix's AI pipeline:

1. Normalize — all scanner outputs converted to a common schema
2. Deduplicate — cross-scanner duplicates merged
3. AI Prioritize — each finding scored by real exploitability and exposure — not just CVSS
4. Remediation — fix suggestions generated with full context

⁠Choose your model

--model gpt-4o-mini        # Fast, cost-efficient (default for open source)
--model gpt-5.4-mini       # Balanced accuracy and cost
--model deepseek-v4-flash  # Cost-efficient alternative
--model claude-sonnet-4.6  # Premium — higher accuracy (credits required)
--model gpt-4o             # Premium (credits required)

Full model list: docs.corefix.dev/docs/models⁠

⁠Bring Your Own Key (BYOK)

docker run --rm \
  -e X_CFIX_API_KEY=cfix_live_YOUR_API_KEY \
  -v $(pwd):/web \
  -v ~/scan-results:/output \
  corefixhq/cfix-web \
  --target https://your-app.com \
  --openai-api-key sk-YOUR_KEY \
  --model gpt-4o-mini

⁠Environment Variables

⁠CLI Options

⁠Coverage levels

For authenticated scans, CoreFix auto-selects coverage based on application complexity when --coverage is not set.

⁠Volume Mounts

-v $(pwd):/web            # Mount current directory for config/HAR files
-v ~/scan-results:/output # Mount local directory for results

⁠Configuration

Place .cfix.web.yaml in the directory mounted at /web to configure authentication and scope. CoreFix derives the full auth flow automatically using Playwright + AI — just provide --username and --password.

authentication:
  loginPageUrl: https://your-app.com/login

scope:
  entryUrls:
    - https://your-app.com/dashboard

HAR files — drop .har files into /web to guide authenticated scanning for SPAs and complex flows, or record them via the CoreFix Chrome Extension⁠.

⁠CI/CD Integration

Drop CoreFix into any CI/CD pipeline. Use --coverage quick for fast gating on every build.

⁠GitHub Actions

- name: CoreFix Web Scan
  run: |
    docker run --rm \
      -e X_CFIX_API_KEY=${{ secrets.CFIX_API_KEY }} \
      -v ${{ github.workspace }}:/web \
      corefixhq/cfix-web \
      --target https://your-app.com \
      --coverage quick

⁠GitLab CI

web_scan:
  image: docker:24
  services:
    - docker:24-dind
  script:
    - |
      docker run --rm \
        -e X_CFIX_API_KEY=$CFIX_API_KEY \
        -v $CI_PROJECT_DIR:/web \
        corefixhq/cfix-web \
        --target https://your-app.com \
        --coverage quick

⁠Jenkins

stage('Web Security Scan') {
    steps {
        sh '''
            docker run --rm \
              -e X_CFIX_API_KEY=${CFIX_API_KEY} \
              -v ${WORKSPACE}:/web \
              corefixhq/cfix-web \
              --target https://your-app.com \
              --coverage quick
        '''
    }
}

⁠How It Works

Live URL ─→ [ CoreFix Container ]
                  │
                  ├── Nmap (Ports)        ──┐
                  ├── Nuclei (CVEs)        ──┤
                  ├── ZAP (Crawl + Scan)  ──┼──→ Normalize ──→ Deduplicate ──→ AI Prioritize
                  ├── ZAP-Auth (Login)    ──┤
                  └── testssl (SSL/TLS)   ──┘
                                                                                  │
                                            Dashboard ←── Reports ←── Findings ←──┘

• Scanners execute in parallel inside an isolated container
• Only findings (not credentials or traffic) leave the container
• The container is stateless — nothing is retained between runs

⁠Image Tags

docker pull corefixhq/cfix-web:latest
docker pull corefixhq/cfix-web:1.0.0

Also on GHCR: ghcr.io/corefixhq/cfix-web:latest

⁠Security and Privacy

• Credentials are used only at scan time and never persisted inside the container
• Only scan findings (not credentials or raw traffic) are transmitted to CoreFix
• The container is stateless and isolated — destroyed after each run
• Full privacy policy: corefix.dev/privacy⁠

⁠Links

• Website: corefix.dev⁠
• Documentation: docs.corefix.dev⁠
• Pricing: corefix.dev/pricing⁠
• Web Scanner: Web Scanner — Standalone Usage⁠
• CI CD Integration Web Scanner - CI CD Integration⁠
• Support: [email protected]⁠
• Chrome Extension - Recording Network Traffic using Extension⁠
• .cfix.web.yaml - Webscan Configuration file⁠

⁠Open Source Acknowledgements

CoreFix Web Scanner is built on: Nmap⁠ (NPSL), Nuclei⁠ (MIT), OWASP ZAP⁠ (Apache-2.0), testssl.sh⁠ (GPL-2.0).

Full attributions: docs.corefix.dev/acknowledgements⁠

Built with ❤️ in Bangalore, India — for developers everywhere.