DevAudit-Local 🛡️

DevAudit-Local is a zero-configuration security auditing and response latency profiling proxy designed for local development servers. By acting as a transparent reverse proxy between your browser/client and your local server (e.g. Node, Go, python, etc.), it logs traffic metrics and performs real-time security analysis on HTTP headers and cookies.

It features a beautiful glassmorphic dark-theme web dashboard containing live latency graphs, security grading, and actionable fixing recommendations for missing or misconfigured security headers.

Dashboard Preview

---

Features

• Zero Code Modification: No middleware, SDKs, or code changes required in your application.
• Security Audits: Real-time evaluation of security configurations:
  • Security Headers: Content-Security-Policy (CSP), X-Frame-Options (XFO), X-Content-Type-Options, Referrer-Policy.
  • Cookie Audits: Inspection of Set-Cookie for missing Secure, HttpOnly, and SameSite flags.
  • Information Leaks: Identification of detailed runtime banner leakage in X-Powered-By or Server headers.
  • CORS Configuration: Warnings for loose wildcard configurations (Access-Control-Allow-Origin: *).
• Performance Profiling: Captures response latencies and flags slow endpoints (>200ms and >500ms).
• Responsive Dashboard: Beautiful web-based dark-theme dashboard powered by WebSockets.
• Custom Latency Charting: Zero-dependency SVG-based live latency graphing.
• Graceful Fault-Tolerance: Captures local server crashes/disconnects and flags them as critical Gateway errors on the dashboard.

---

Installation

Clone the repository and install the dependencies:

git clone https://github.com/your-username/devaudit-local.git
cd devaudit-local
npm install

To make it globally executable on your machine:

npm link

---

Usage

Start your local application as you normally do (e.g., listening on port 3000).

In another terminal window, start devaudit-local pointing to your application's port:

devaudit-local --target 3000

By default:

• DevAudit Proxy will listen on http://localhost:3001 (forwarding traffic to your target).
• Web Dashboard will start on http://localhost:3002.
• A browser tab will automatically open displaying the live dashboard.

Now, instead of pointing your requests to http://localhost:3000, send them to the proxy port http://localhost:3001 to capture and inspect live audit reports.

Working with Subdirectories (Laragon, XAMPP, Apache)

If your local server serves multiple projects via subdirectories (e.g., your app is accessed at http://localhost/my-project/ which runs on port 80 by default):

1. Start devaudit-local targeting port 80:

   devaudit-local --target 80

2. In your browser, open the application through the proxy port 3001 while maintaining the original subdirectory path:

   http://localhost:3001/my-project/
   

   The proxy will correctly forward /my-project/* to http://localhost:80/my-project/*.

CLI Parameters

Usage: devaudit-local [options]

Zero-config security & latency profiler for local dev servers.

Options:
  -v, --version           output the version number
  -t, --target <port>     Port of your running local dev server (default: "3000")
  -p, --port <port>       Port where the auditor proxy will listen (default: "3001")
  -d, --dashboard <port>  Port where the web dashboard will run (default: "3002")
  --no-open               Prevent opening the dashboard in browser automatically
  -h, --help              display help for command

---

Auditing Engine Grading Criteria

Each HTTP request starts with a security score of 100. Points are deducted based on standard security practices:

Audit Item	Issue	Deduction	Priority
Content-Security-Policy	Missing header	-15	High
X-Frame-Options	Missing clickjacking protection	-15	High
X-Content-Type-Options	Missing nosniff setting	-10	Medium
Access-Control-Allow-Origin	Wildcard * in development	-10	Medium
Cookie HttpOnly Flag	Session hijacking vulnerability	-5	High
Cookie Secure Flag	Transmitted over unencrypted HTTP	-5	Medium
Cookie SameSite Flag	CSRF vulnerability	-5	Low
X-Powered-By / Server	Exposing technology banners	-8 / -5	Low
Referrer-Policy	Leaking referrer credentials	-5	Low

Scores are mapped to Grades:

• Grade A: 90 - 100 (Excellent security posture)
• Grade B: 80 - 89 (Good, minor header missing)
• Grade C: 70 - 79 (Average, missing core headers)
• Grade D: 60 - 69 (Poor, critical clickjacking/CSP risk)
• Grade F: < 60 (Vulnerable, credentials or server exposed)

---

License

This project is licensed under the MIT License.