SiteShield — Web Security Scanner
A multi-tenant SaaS security scanner that audits any website across four engines — transport/TLS, HTTP security headers, cookie flags, and information exposure — scores the result, and generates a downloadable PDF report.
The Problem
Solo developers and small teams ship web apps without ever running a real security audit — misconfigured headers, insecure cookies, and weak TLS slip into production because proper scanners are enterprise-priced or CLI-only.
Architecture & Approach
Built a multi-tenant SaaS scanner: a FastAPI backend runs four analysis engines against a target, grades the posture, and produces a PDF report. PostgreSQL (Neon) via psycopg v3 stores per-tenant scan history, everything is Dockerised, and a GitHub Actions pipeline runs a green pytest suite before every deploy.
Engineering Challenges & Solutions
- Making scans run on free-tier hosting — refactored the engine to run synchronously behind an env toggle so Celery/Redis aren't required on Render's free plan
- CAA DNS lookups intermittently timed out inside containers; treated query failures as an inconclusive state rather than a false 'no record' finding
- Secure multi-tenancy — JWT auth with strict secret rotation before any live deploy, plus per-tenant isolation of scan data
Outcome & Results
A working multi-tenant scanner with four scan categories, cookie analysis, PDF export, a green pytest suite, Docker Compose, and CI/CD. Live deployment (Render + Neon + Vercel) is in final wiring.
Lessons Learned
Building a scanner makes you audit your own stack the way an attacker would — every header and cookie on this very portfolio got hardened because I'd already written the check for it.
