Building a security posture scanner with Next.js and Python
I wanted to learn cloud security the way it actually sticks: by building something real. So I built PostureGuard, a web application that scans a domain and returns a security posture report covering TLS, HTTP security headers and open ports, with a 0-100 score and an A-F grade. This post walks through the architecture and the decisions I found most interesting. Update: Phase 1 is done.…
A security posture scanner called PostureGuard was developed by Sam Dossou using Next.js and Python. This web application scans a domain and returns a security report covering TLS, HTTP security headers, and open ports, providing a score from 0 to 100 and a grade from A to F. PostureGuard comprises three components: a Next.js web app for user management and scan requests, a PostgreSQL database to store user, domain, and scan information, and a Python worker that performs the actual scans.
The web app does not execute scans; instead, it stores a queued job in the scans table, which the worker retrieves and processes. To keep the system simple and efficient, PostureGuard uses PostgreSQL as a job queue without a separate message broker. The Python worker performs three checks: TLS, HTTP headers, and ports. Scanning is restricted to domains the user owns, verified by adding a specific DNS TXT record.
The authentication system uses email and password with bcrypt hashing, and sessions are stored server-side in the database in an httpOnly cookie. For operations, PostureGuard runs as a systemd service with journal logging and a nightly database backup script.
Written by urgent.news from Dev.to's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
