VoidSpider: Building a Visual Security Scanner for Websites and Local Code

Hi everyone! 👋

I've been working on an open-source project called VoidSpider, a Node.js-based security auditing and monitoring tool for websites and local codebases.

The idea behind VoidSpider is simple: security findings should not only be detected, but also be easy to understand, monitor, and investigate.

Instead of relying entirely on terminal output and static reports, I wanted to build a tool that combines security checks with a real-time, interactive visualization.

🔗 GitHub Repository: https://github.com/patrickivanuellf/VoidSpider

🕷️ What Is VoidSpider?

VoidSpider is a security auditing tool designed to inspect websites and local projects for potential security issues.

It has two primary operating modes.

1. Website Security Auditing

The website mode inspects an authorized target for potential security misconfigurations, exposed resources, unsafe HTTP configurations, TLS issues, and other indicators that may deserve investigation.

2. Local Code Auditing

The local mode performs static inspection of project files without executing them. It looks for potential secrets, suspicious files, risky code patterns, insecure configurations, and other issues that developers may want to review.

VoidSpider can repeat scans, compare findings between cycles, and report newly discovered or resolved issues.

💡 Why I Built It

Security tools can generate a lot of information, especially when a project contains hundreds of pages, files, or dependencies.

The challenge is not always finding a potential issue. Sometimes, the challenge is understanding what is being inspected, what changed, and which findings deserve attention first.

I wanted to experiment with a more visual approach.

That idea became the core of VoidSpider: a spider-inspired interface that moves between nodes representing pages and files being inspected.

The dashboard combines this visualization with scan telemetry, findings, severity levels, security scores, and live updates.

The goal is to make security auditing more observable and easier to follow without sacrificing its technical purpose.

✨ Key Features

1. Interactive Real-Time Dashboard

VoidSpider includes an interactive dashboard that visualizes scanning activity and displays security findings.

The dashboard uses Server-Sent Events (SSE) to stream updates from the Node.js server, so users can monitor scan progress without repeatedly refreshing the page.

The interface includes:

• Interactive graph visualization
• Scan status and telemetry
• Security findings and severity levels
• Security score and report access
• Live updates when findings change

2. Website Security Checks

The website scanner performs passive checks for potential issues, including:

• Missing or weak HTTP security headers
• Insecure cookie configurations
• Mixed content and unsafe form configurations
• Exposed sensitive files and source maps
• Potentially exposed credentials and API keys
• Broken links and server errors
• Information disclosure and stack traces
• TLS certificate and configuration issues
• DNS and email security configuration problems

These findings are intended to help developers identify configurations and resources that deserve further investigation.

A scanner finding is not automatically proof of an exploitable vulnerability. Results should be validated in the context of the target application.

3. Local Code and Project Auditing

VoidSpider can inspect a local project directory or individual files.

Its static checks cover areas such as:

• Potentially exposed secrets and credentials
• Suspicious files and backup artifacts
• Risky code patterns in supported languages
• Insecure project and container configurations
• Dependency versions and known vulnerabilities
• Hidden Unicode characters and suspicious text patterns
• Potential webshell and code-obfuscation indicators

The local scanner reads files rather than executing the target project. Its findings can help developers identify issues before deployment.

4. Dependency Vulnerability Checks

VoidSpider supports dependency checks for supported package formats and ecosystems.

It can use the OSV.dev vulnerability database to identify known vulnerabilities associated with detected package versions.

This feature is intended as an additional source of information, not a replacement for a dedicated dependency-management or software composition analysis platform.

5. Change Monitoring and Reporting

VoidSpider compares findings between scan cycles to help identify new issues and issues that appear to have been resolved.

It supports reports in:

• Markdown for human-readable summaries
• JSON for structured processing
• SARIF for compatible code-scanning workflows

Optional Telegram notifications can also alert users about new findings.

6. Custom Rules and Optional Integrations

The project supports custom security rules for supported checks.

Optional integrations include AI-assisted finding triage and OWASP ZAP for additional security testing.

These integrations are optional. The basic scanner does not require an AI API key or an OWASP ZAP installation.

🔐 A Security-First Approach

VoidSpider is designed for authorized security auditing.

For website targets outside localhost, the tool requires an explicit ownership-confirmation flag. Passive checks are the default, and active exploitation is not part of the default scanning process.

The optional OWASP ZAP active-scanning integration has a different risk profile and should only be used against targets for which the operator has explicit authorization.

The dashboard binds to localhost by default, and the scanner operates on the target supplied at startup.

I also considered how sensitive information should appear in findings. When potential secrets are detected, the scanner is designed to report their types and locations rather than expose their actual values in findings.

These safeguards are useful design choices, but they do not eliminate all security risks. Users should review the documentation and configure the tool appropriately for their environment.

🚀 Getting Started

VoidSpider requires Node.js 18.14 or later.

Step 1: Clone the Repository

Open your terminal and run:

git clone https://github.com/patrickivanuellf/VoidSpider.git

Step 2: Enter the Project Directory

cd VoidSpider

Step 3: Install Dependencies

npm install

Step 4: Audit a Local Project

Provide a path to a project or directory you want to inspect:

node server.js ./your-project

Replace ./your-project with the actual path to your local project.

Step 5: Audit an Authorized Website

For a website you own or have explicit permission to test, run:

node server.js https://your-domain.com --saya-pemilik-situs

Replace https://your-domain.com with your authorized target.

Step 6: Open the Dashboard

Once the server is running, open this address in your browser:

http://127.0.0.1:3000

You should then be able to access the dashboard and monitor the scan.

For additional commands, environment variables, reports, integrations, and usage details, consult the repository README.

📖 Full Documentation: https://github.com/patrickivanuellf/VoidSpider/blob/main/README.md

🧪 What I Want to Improve Next

VoidSpider is an ongoing open-source project, and there is still room to improve its detection quality, usability, and extensibility.

Some areas I would like to explore further include:

• Improving detection accuracy and reducing false positives
• Making findings easier to prioritize
• Improving dashboard performance for larger projects
• Expanding useful checks for different development environments
• Improving integration with existing development workflows
• Making reports more actionable for developers

I'm also interested in hearing how other developers approach security monitoring and which findings they consider most useful in their daily workflows.

🤝 Feedback Is Welcome

I'd love to hear feedback from developers, security researchers, and open-source contributors.

A few questions for the community:

• What features would make a visual security scanner more useful?
• Which security checks do you find most valuable during development?
• How would you improve the way security findings are displayed?
• What integrations would you like to see in a project like this?

Suggestions, bug reports, and constructive criticism are welcome.

If you find the project interesting, feel free to explore the source code, open an issue, or contribute ideas.

🔗 Explore VoidSpider

GitHub Repository: https://github.com/patrickivanuellf/VoidSpider

README and Documentation: https://github.com/patrickivanuellf/VoidSpider/blob/main/README.md

Thanks for reading, and happy building! 🕷️