Scanners — Platform Overview

Scanners is a multi-tenant security-scanning platform. Pluggable scanner modules probe an organization's external attack surface, web applications, and cloud accounts; the engine normalizes everything into a single model — Assets → Checks → Findings → Tasks — enriches and finalizes it in one deterministic pass, and serves the result over an authenticated REST API.

Live in production. Deployed on AWS eu-north-1 (account 429134227608), serving the REST API at https://modules.binarynetworks.ai/api/v1 (OpenAPI/Swagger at /docs). See Platform Operations → Production Deployment for the as-built record.

The three modules

Module	Key	What it does	Intrusive?
EASM	easm	Discovers internet-exposed assets (subdomains, hosts, ports, web apps) and turns them into findings.	No — observes and infers.
DAST	dast	Actively tests discovered web apps for vulnerabilities. Gated on an EASM-discovered surface.	Yes — active payloads.
Cloud / CSPM	aws · azure · gcp	Agentless, read-only cloud security-posture scanning across AWS, Azure, and GCP. Gated on a validated connected account.	No — read-only.

Every module normalizes into the same Assets → Checks → Findings → Tasks model and inherits the same lifecycle (triage, suppression, re-scan reconciliation, feedback-validation). Findings carry the module that produced them, and reconciliation and dedup are scoped per module — one module never ages, resolves, or dedups another's findings.

How the platform is organized

• Platform Architecture — the production topology (SQS broker, scale-to-zero ECS workers, the two-hop cloud chain, the Jarvis investigator), the engine and scanner-plugin contract, and the deep implementation reference.
• Platform API — the single /api/v1 REST API that drives every module: three-key authentication, the full endpoint reference, and a step-by-step usage guide.
• Platform Operations — the as-built AWS + Cloudflare deployment, four-layer monitoring & alerting, activity logging & SIEM streaming, and the read-only AI investigator (Jarvis).
• Modules — EASM, DAST, and Cloud/CSPM, each with its own overview, customer guide, and module-specific detail.

Key properties

• Schema-per-tenant isolation — each tenant (customer org) gets its own Postgres schema; one codebase, strong data isolation.
• One authenticated API — three keys (X-Master-Key, X-Admin-Key, X-Org-Key) gate global, admin, and org-scoped actions respectively.
• Run-to-completion scans — a scan runs until it finishes (an inactivity watchdog kills only a genuinely hung tool); there is no fixed time cap.
• Per-(org, module) cooldown — one scan per module per interval (default 14 days); failed/cancelled scans don't burn the slot.
• Deterministic finalization — severity, classification, enrichment, knowledge-base text, and lifecycle run in one auditable pass (no LLM in the scoring path).