infrastructure-security-scan

Soft-spot security auditor: pure check library (SSH/headers/CORS). Assessment, not exploitation.

What it is for

infrastructure-security-scan — soft-spot security auditor.

A pure check library: SSH / header / CORS analysis over injected observations. It does NOT fetch, schedule, store, or know about jobs / DB / tenants — that is the security-scan-runner (operations layer), which collects observations, drives these checks, and maps ScanFindings onto assessments::Finding.

Assessment, not exploitation: no payloads, no exploits, no writes.

# Closed loop with infrastructure-hardening

The header check verifies exactly what infrastructure_hardening::HardeningConfig declares — a single source of truth, so the auditor can't drift from what hardening promises.

# Dual-use guardrail

Active / intrusive checks require an ActiveScanGrant, obtainable only from an authorized ScanTarget. Unauthorized active scanning is therefore impossible at the type level, not merely discouraged by a CLI default.

Capabilities

checks::cors (other)

CORS reflection check.

checks::headers (other)

Response security-header coverage check.

checks::ioc (other)

Indicator-of-compromise sweep over an injected process / unit name list.

checks::packages (other)

Pending-security-update check over apt-get -s upgrade output.

checks::ports (other)

Open-port check: flag listeners that aren't on the expected allowlist.

checks::ssh (other)

SSH daemon config check.

TlsObservation

TLS posture check (over an injected observation — e.g. from an openssl

How to use it

No examples/ target and no doctest in this crate's rustdoc. The tests listed under Verification are the closest executable usage.

Module structure

infrastructure_security_scan

• checks
• checks::cors
• checks::headers
• checks::ioc
• checks::packages
• checks::ports
• checks::ssh
• checks::tls

flowchart TD
  n_infrastructure_security_scan["infrastructure_security_scan"]
  n_infrastructure_security_scan --> n_checks["checks"]
  n_checks --> n_checks__cors["cors"]
  n_checks --> n_checks__headers["headers"]
  n_checks --> n_checks__ioc["ioc"]
  n_checks --> n_checks__packages["packages"]
  n_checks --> n_checks__ports["ports"]
  n_checks --> n_checks__ssh["ssh"]
  n_checks --> n_checks__tls["tls"]

Public surface

`checks::cors`

`checks::headers`

`checks::ioc`

`checks::packages`

`checks::ports`

`checks::ssh`

`checks::tls`

Re-exports. Exported here, defined elsewhere.

Boundary

Depends on no other workspace tier.

Shares tier infrastructure with 82 other crates: infrastructure-acquire, infrastructure-adapters-google-calendar, infrastructure-adapters-google-gmail, infrastructure-adapters-google-places, infrastructure-adapters-google-trends, infrastructure-adapters-shodan, infrastructure-adapters-yelp, infrastructure-agent, … (82 total).

_What this crate deliberately does NOT own is a judgment. No committed registry records one for it, so none is stated here._

Where it sits

Dependencies

Runtime, in this workspace.

Runtime, from outside the workspace.

Development, from outside the workspace.

Build. None.

Depended on by. 1 workspace crate.

Signal flow — what reaches this crate, and what it reaches.

flowchart LR
  n_operations_net_discovery["operations-net-discovery"] -->|uses| SELF
  SELF["infrastructure-security-scan"]
  SELF -->|runtime| n_infrastructure_hardening["infrastructure-hardening"]
  classDef self fill:#1f883d,stroke:#1f883d,color:#fff;
  class SELF self;

Feature flags

No Cargo features are defined: every capability is unconditional, so no consumer can receive a half-wired crate.

Targets

Error model

No public error type was detected: no public item declares a type named *Error, and no public signature returns one.

Operational characteristics

No unsafe block, unsafe fn, unsafe impl or unsafe trait was found by the parser anywhere in this crate's source.

Configuration

No environment variable is read with a literal name anywhere in this crate. A variable whose key is computed at run time cannot be listed here, and is not claimed to be absent.

Related capabilities

1 workspace crate depends on this one: operations-net-discovery.

Verification

Evidence by module. How often each public module is named by something executable.

What the tests establish, by name:

• no_reflection_no_finding — src/checks/cors.rs
• reflect_with_credentials_is_critical — src/checks/cors.rs
• reflect_without_credentials_is_medium — src/checks/cors.rs
• fully_hardened_response_has_no_findings — src/checks/headers.rs
• missing_headers_are_reported — src/checks/headers.rs
• clean_process_list_no_findings — src/checks/ioc.rs
• incident_miner_is_critical — src/checks/ioc.rs
• nothing_pending_no_finding — src/checks/packages.rs
• pending_nginx_security_update_is_high — src/checks/packages.rs
• all_expected_no_findings — src/checks/ports.rs
• unexpected_port_flagged_and_telnet_is_high — src/checks/ports.rs
• hardened_ssh_has_no_findings — src/checks/ssh.rs
• open_root_password_login_flagged — src/checks/ssh.rs
• legacy_protocol_and_expired_cert_flagged — src/checks/tls.rs
• modern_tls_is_clean — src/checks/tls.rs
• finding_round_trips_json — src/finding.rs
• severity_orders_low_to_critical — src/finding.rs
• authorized_target_yields_grant — src/target.rs
• passive_target_yields_no_active_grant — src/target.rs
• range_target_is_unauthorized_until_authorized — src/target.rs

Documentation coverage

pie showData
    title Public items with rustdoc
    "Documented" : 8
    "No rustdoc detected" : 0

Metrics

pie showData
    title Public API by kind
    "function" : 7
    "struct" : 1

pie showData
    title Rust source composition
    "Code" : 574
    "Blank or comment" : 188

Generation

Rendered by tools-corpus corpus readme from repository evidence alone, renderer schema 2, lexicon current. No model, network service or database was consulted. Regenerate with tools-corpus corpus readme --write; verify with --check.