internal/

Package api hosts the HTTP routing layer: a chi router that exposes /api/v1/scan (POST + GET by id) and /api/v1/checks, wired with request-ID, slog request logger, panic recovery and per-IP rate limiting.

Package cache provides a thread-safe TTL + LRU cache used to retain recently completed scan results.

Package config loads, validates and exposes the websec0.yaml runtime configuration.

Package custom hosts the non-scoring "additional findings" checks.

Package frontend embeds the Astro static build and exposes it as an http.Handler with SPA fallback.

Package headers fetches and evaluates the HTTP security headers exposed by a target.

Package history maintains the opt-in, in-memory list of recently completed public scans.

Package safehttp is the security-critical core that gates every outbound connection made by a scan.

Package scan defines the public payload shapes returned by the scanner API.

Package scanner is the scan orchestrator.

Package scoring contains the threshold tables and computation rules that turn observation reports into a 0–100 score and a scan.Grade letter.

Package sslv2 detects whether a server speaks the obsolete SSLv2 protocol.

Package sslv3 detects whether a server speaks SSLv3 by sending a TLS-framed ClientHello with version 0x0300 and classifying the response.

Package tls runs the modern TLS probe — protocol enumeration, cipher enumeration per legacy protocol, certificate-chain extraction with system-root validation, OCSP-stapling presence and presence-based weakness heuristics.

Package version exposes the build-time identifiers (release tag, git commit, build date) injected via -ldflags.