DEV Community

SecURL
SecURL

Posted on

I changed my security CLI's final question from want another report? to want to know when this changes?

#security #opensource #webdev #devops

A one-off security scan has an obvious weakness: it starts ageing as soon as it finishes.

I have been building SecURL, a passive outside-in posture scanner for public websites. It checks the evidence available without credentials or invasive probing: HTTP security headers, TLS and certificate health, DNS and email trust, cookie attributes, redirects, visible third parties, public services, and related posture signals.

The CLI already produced a useful local result:

npx securl scan example.com
Enter fullscreen mode Exit fullscreen mode

But the next step was wrong.

After an interactive scan, the CLI offered to create a hosted report. That worked, but it mostly repeated value the user had just received. A second report does not create a reason to return.

The better question is whether the result stays true.

So securl@1.28.4 now ends an eligible interactive scan with one optional prompt:

Watch this site for security drift in the free web app?
This sends the target URL to app.securl.online. [y/N]
Enter fullscreen mode Exit fullscreen mode

If the user explicitly accepts, SecURL prints a target-prefilled web link. Opening it runs a fresh browser-owned hosted scan, then offers a daily or weekly watch. The local scan result is not uploaded.

The prompt deliberately stays out of automation. It does not appear for:

  • CI or piped runs
  • batch scans
  • redirected output
  • JSON, SARIF, manifest, evidence, or other structured formats
  • file output
  • baseline comparisons
  • policy-gated runs

It also defaults to No. A developer tool should not quietly send a target elsewhere just because the command was interactive.

Explicit report and mobile workflows still exist:

npx securl scan example.com --publish
npx securl scan example.com --notify
Enter fullscreen mode Exit fullscreen mode

The product idea is simple:

  1. Scan locally and get immediate evidence.
  2. Fix what matters.
  3. Watch the public target for meaningful drift.
  4. Get attention only when something changes.

This is still a small experiment. npm download counts are noisy and include automation, mirrors, indexers, and other activity that may never represent a person at a terminal. SecURL does not add hidden install-time telemetry to solve that measurement problem.

The real success metric is much stricter: does a useful scan become a first watch, and does that watch later run again?

Try the CLI:

npx securl scan yourdomain.com
Enter fullscreen mode Exit fullscreen mode

Project and live scanner: https://securl.online/?utm_source=devto&utm_medium=content&utm_campaign=cli_monitoring_launch

Source: https://github.com/this-is-securl/securl

I would particularly value feedback on the final prompt. Is ongoing drift monitoring the natural next step after a local posture scan, or would another action be more useful?

Top comments (0)