Add new feature

.github/workflows/ci.yml

@@ -0,0 +1,25 @@
+name: CI
+
+on:
+  push:
+    branches:
+      - master
+  pull_request:
+    branches:
+      - master
+
+jobs:
+  test:
+    runs-on: ubuntu-latest
+
+    steps:
+    - name: Checkout code
+      uses: actions/checkout@v2
+
+    - name: Set up Go
+      uses: actions/setup-go@v2
+      with:
+        go-version: 1.17
+
+    - name: Run tests
+      run: go test ./...

.gitignore

@@ -0,0 +1,93 @@
+# Binaries for programs and plugins
+*.exe
+*.exe~
+*.dll
+*.so
+*.dylib
+api-security-scanner
+api-security-scanner-test
+api-security-scanner-custom
+
+# Test binary, built with `go test -c`
+*.test
+
+# Output of the go coverage tool, specifically when used with LiteIDE
+*.out
+
+# Dependency directories (remove the comment below to include it)
+vendor/
+
+# Go workspace file
+go.work
+
+# IDE files
+.vscode/
+.idea/
+*.swp
+*.swo
+*~
+
+# OS generated files
+.DS_Store
+.DS_Store?
+._*
+.Spotlight-V100
+.Trashes
+ehthumbs.db
+Thumbs.db
+
+# Log files
+*.log
+logs/
+
+# Coverage reports
+coverage.html
+coverage.out
+
+# Configuration files with sensitive data
+config-local.yaml
+config-prod.yaml
+.env
+
+# Temporary files
+*.tmp
+*.temp
+tmp/
+
+# Node modules (if any frontend components)
+node_modules/
+
+# Build artifacts
+dist/
+build/
+
+# Documentation build
+docs/_build/
+
+# Cache directories
+.cache/
+*.cache
+
+# Database files
+*.db
+*.sqlite
+*.sqlite3
+
+# Session files
+*.session
+
+# Backup files
+*.bak
+*.backup
+
+# Archive files
+*.tar.gz
+*.zip
+*.rar
+
+# Development files
+*.dev
+*.local
+
+# Roadmap documentation (commit for historical reference)
+# IMPLEMENTATION_ROADMAP.md

CLAUDE.md

@@ -0,0 +1,94 @@
+# CLAUDE.md
+
+This file provides guidance to Claude Code (claude.ai/code) when working with code in this repository.
+
+## Project Overview
+
+This is a Go-based API Security Scanner tool designed to perform security testing on API endpoints. The tool conducts three main security tests: authentication testing, HTTP method validation, and SQL injection detection.
+
+## Development Commands
+
+### Building and Running
+- `go run main.go` - Run the main security scanner
+- `go run automate.go` - Run automation script for Git operations and CI setup
+- `go build` - Build the application
+- `go build -o api-security-scanner main.go` - Build with custom output name
+
+### Testing
+- `go test ./...` - Run all tests
+- `go test -v ./...` - Run tests with verbose output
+- `go test -run TestIntegration ./...` - Run integration tests
+- `go test -run TestPerformAuthTest ./...` - Run specific auth tests
+
+### Code Quality
+- `go fmt ./...` - Format all Go code
+- `go vet ./...` - Check for potential issues
+- `go mod tidy` - Clean up dependencies
+
+## Architecture
+
+### Core Components
+
+1. **main.go** - Entry point with configuration loading and test orchestration
+2. **scanner.go** - Core security testing logic with test implementations
+3. **automate.go** - Git automation and CI/CD workflow setup
+4. **config.yaml** - Configuration file defining API endpoints and test parameters
+
+### Security Testing Implementation
+
+The scanner performs three types of security tests concurrently using goroutines:
+
+- **Authentication Testing** (`testAuth`): Validates basic auth credentials and handles HTTP 401/403 responses
+- **HTTP Method Testing** (`testHTTPMethod`): Validates that endpoints respond appropriately to different HTTP methods
+- **SQL Injection Testing** (`testInjection`): Tests for SQL injection vulnerabilities using payload-based testing
+
+### Configuration Structure
+
+```yaml
+api_endpoints:  # List of endpoints to test
+  - url: "endpoint_url"
+    method: "HTTP_METHOD"
+    body: "request_body"
+auth:           # Basic auth credentials
+  username: "username"
+  password: "password"
+injection_payloads:  # SQL injection test payloads
+  - "malicious_payload"
+```
+
+### Test Result Scoring
+
+Each endpoint starts with a score of 100/100. Points are deducted for failed tests:
+- Authentication failures: -30 points
+- HTTP method failures: -20 points  
+- Injection vulnerabilities: -50 points
+
+### Error Handling
+
+The project uses custom error types for different test failures:
+- `AuthError` - Authentication-related failures
+- `HTTPMethodError` - HTTP method validation failures
+- `InjectionError` - SQL injection detection
+
+## Key Files and Their Purposes
+
+- **config.yaml**: Main configuration with endpoints and test parameters
+- **scanner.go**: Contains all security testing logic and report generation
+- **main_test.go**: Integration tests with mock servers
+- **scanner_test.go**: Unit tests for individual security functions
+- **automate.go**: Git automation and GitHub Actions workflow creation
+
+## Testing Approach
+
+The project uses httptest for HTTP testing with mock servers. Tests validate:
+- Authentication success/failure scenarios
+- HTTP method compliance
+- SQL injection detection accuracy
+- Report generation functionality
+
+## Important Notes
+
+- The tool is designed for defensive security testing only
+- Configuration should target your own API endpoints for testing
+- Test payloads are defensive in nature, designed to detect vulnerabilities rather than exploit them
+- All HTTP requests include proper timeouts (10 seconds) to prevent hanging

GEMINI.md

@@ -0,0 +1,35 @@
+# Project Overview
+
+This project is a Go-based API security scanner. It is designed to test API endpoints for common security vulnerabilities. The scanner reads a configuration file (`config.yaml`) to define the target API endpoints, authentication credentials, and payloads for injection attacks.
+
+The scanner performs the following tests:
+- **Authentication Tests:** Verifies that endpoints are properly secured and that authentication credentials are required.
+- **HTTP Method Tests:** Checks for improper handling of HTTP methods.
+- **SQL Injection Tests:** Attempts to inject malicious SQL queries to identify potential vulnerabilities.
+
+After running the tests, the scanner generates a detailed report that includes an overall security score, a breakdown of passed and failed tests, a risk assessment, and an overall security assessment.
+
+# Building and Running
+
+## Prerequisites
+- Go 1.16 or higher
+
+## Running the Scanner
+To run the scanner, use the following command:
+```bash
+go run main.go scanner.go
+```
+
+## Testing
+To run the tests, use the following command:
+```bash
+go test
+```
+
+# Development Conventions
+
+The project follows standard Go conventions. The code is organized into two main files: `main.go` and `scanner.go`. `main.go` handles the main application logic, while `scanner.go` contains the core scanning functionality.
+
+The project uses the `gopkg.in/yaml.v2` library for parsing the `config.yaml` file.
+
+The tests are located in `main_test.go` and `scanner_test.go` and can be run using the standard `go test` command.