# SiteShield — Web Security Scanner

> Category: Cybersecurity | Period: 2026–Present | Metric: 4 scan engines
> Canonical URL: https://www.arman-portfolio.online/projects/siteshield/
> Live Demo: N/A
> Source Repository: https://github.com/arman080325/SiteShield-Web

## Overview
A multi-tenant SaaS security scanner that audits any website across four engines — transport/TLS, HTTP security headers, cookie flags, and information exposure — scores the result, and generates a downloadable PDF report. Try the live demo below.

## Architecture & Tech Stack
Python, FastAPI, PostgreSQL, Docker, CI/CD, OWASP

## Case Study

### The Problem
Solo developers and small teams ship web apps without ever running a real security audit — misconfigured headers, insecure cookies, and weak TLS slip into production because proper scanners are enterprise-priced or CLI-only.

### Architecture & Approach
Built a multi-tenant SaaS scanner: a FastAPI backend runs four analysis engines against a target, grades the posture, and produces a PDF report. PostgreSQL (Neon) via psycopg v3 stores per-tenant scan history, everything is Dockerised, and a GitHub Actions pipeline runs a green pytest suite before every deploy.

### Engineering Challenges & Solutions
- Making scans run on free-tier hosting — refactored the engine to run synchronously behind an env toggle so Celery/Redis aren't required on Render's free plan
- CAA DNS lookups intermittently timed out inside containers; treated query failures as an inconclusive state rather than a false 'no record' finding
- Secure multi-tenancy — JWT auth with strict secret rotation before any live deploy, plus per-tenant isolation of scan data

### Outcome & Results
A working multi-tenant scanner with four scan categories, cookie analysis, PDF export, a green pytest suite, Docker Compose, and CI/CD. Live deployment (Render + Neon + Vercel) is in final wiring.

### Lessons Learned
Building a scanner makes you audit your own stack the way an attacker would — every header and cookie on this very portfolio got hardened because I'd already written the check for it.

---
Author: Arman Ahemad Khan (https://www.arman-portfolio.online/)
Role: Application Security & Full-Stack Developer
Education: Final-year B.Tech CSE at Silicon University, Bhubaneswar (CGPA 9.15, graduating May 2027)