Intruder

Promptfree, for everyone, and the only version there is

Copy the prompt for Claude CodeCopy the prompt for CodexCopy the prompt for Cursor

Copy

Build me the continuous scanning I actually need instead of Intruder.

The honest description of this product is **a good scanner plus a very good filter.** The scanners are free; the filter is what you are building.

STACK
- Node 20+ with Fastify, server-rendered HTML
- SQLite through better-sqlite3, WAL mode
- Nuclei and an infrastructure scanner as the engines
- Caddy in front

THE DATA MODEL
- targets: id, kind, value, scope_note, added_by, is_active
- scans: id, target_id, engine, started_at, finished_at, raw_path
- findings: id, target_id, fingerprint, engine, code, severity, cvss, detail_json, first_seen, last_seen, status, suppressed_reason, suppressed_until
- notes: id, finding_id, author, body, at
- **The fingerprint is the whole design**: engine plus code plus target plus port plus path. It must be stable across scans or every night produces the same findings as new

RUNNING THE SCANS
- On a schedule, and again immediately when a new template lands for something you run — **that is the 'continuous' claim and it is a webhook plus a rerun**
- Store raw output permanently. A parsing change later must not lose the evidence
- Concurrency and rate caps per target. A scan is unrequested load
- **Scope enforced in code**: an explicit list of what you may scan, checked before every run. Scanning something you do not own is a crime in many places, and an accident with a wildcard is how it happens

THE FILTER, WHICH IS THE PRODUCT
- Deduplicate by fingerprint and carry status across scans
- Suppress with a reason and an expiry — never permanently, because a suppression that never returns is a vulnerability you agreed to forget
- **Rank by exploitability in your context, not by the raw score.** A high score on an internal service behind authentication matters less than a medium one on a public login page, and this is exactly the judgement the paid product is selling
- Group by root cause: forty findings from one outdated library are one action
- Mark anything requiring authentication to reach as a lower tier automatically

ALERTING
- Only on new findings and on status changes. A digest, not a message per finding
- Immediate for anything critical on a public asset; daily for the rest
- **A finding that reappears after being fixed is its own alert type** and it is the most important one, because it means a deploy undid a fix

REPORTING
- A point-in-time report per target with the findings, the suppressions and their reasons, and the scan history
- Time-to-fix per severity, which is the number that shows whether the process works

WHAT MATTERS MOST
Stable fingerprints and expiring suppressions. One makes the tool readable; the other stops it becoming a place where problems are filed away.