VANTAGE

The problem

Security teams often work across disconnected scanners, spreadsheets and ticket queues. A scan can produce a list of weaknesses, but that alone does not tell a team which assets matter most, whether a finding is recurring, who owns the fix, or whether a remediation was verified.

VANTAGE is my attempt to build a broader continuous exposure management platform rather than another standalone scanner. Organizations are the primary audience; individuals should also be able to use a personal workspace to assess assets they own or are authorized to test.

Product model

• Individual workspaces: a self-service place to assess personal websites, domains, repositories and infrastructure, understand evidence-backed findings, and follow practical remediation guidance.
• Organization workspaces: the main product direction, with isolated tenants, projects, environments, teams, governed assessment scopes, risk workflows and hybrid deployment options.

Both audiences share the same authorization model. A personal account is not permission to scan arbitrary internet assets. Ownership verification and explicit scope approval are required before external assessment.

What is implemented

Scanner contracts and authorization-aware orchestration

VANTAGE defines vendor-neutral contracts for assets, approved scopes, scan requests, reports, findings and evidence. A scanner registry and coordinator check tenant, asset, scope, expiry, scanner allowlist and active-check permission before a scan can run. CloudSentry is integrated as the first specialist engine.

A usable local assessment path

The CLI can assess a local workspace after an authorization reference and exact interactive confirmation. The current scanner path performs static Terraform, Dockerfile and Docker Compose analysis; it does not perform network reconnaissance or exploit testing. Reports are exported as JSON without overwriting existing files.

Finding lifecycle and prioritization

An optional SQLite ledger tracks stable finding identity across assessments, occurrence counts, first and last seen timestamps, analyst dispositions, and lifecycle events. Findings can be reopened when they return. Only completed scans can resolve findings by absence; partial or failed scans cannot silently make an issue disappear. The transparent priority score uses severity, confidence and asset criticality, and is explicitly not a probability of compromise.

PostgreSQL tenant foundation

The PostgreSQL schema supports personal and organization tenants, OIDC issuer/subject identity records, memberships, projects, environments, assets, approved scopes and audit events. Composite foreign keys prevent cross-organization relationships. The initial migration enables and forces row-level security on tenant-owned tables, and a database trigger rejects updates or deletes of audit events.

How I tested the isolation model

GitHub Actions runs the migration against PostgreSQL 16 and exercises tenant boundaries using a restricted runtime role that is neither a superuser nor allowed to bypass row-level security. Integration tests verify that one tenant cannot read another tenant’s rows, cross-tenant writes are rejected, composite foreign keys prevent mismatched project references, and transaction-local tenant context does not leak into the next transaction.

The current CI run passed Ruff, Alembic migration validation and 32 tests. This is evidence for the implemented foundation, not a certification or independent security assessment.

Architecture direction

The intended platform separates a control plane from scanner execution. The control plane owns identity, organizations, assets, scope approvals, scan plans and findings. Customer-managed scanner nodes should connect outbound using short-lived credentials and execute bounded jobs in isolated workers. This supports a hosted service, customer-managed private nodes, or a fully self-hosted deployment.

What is not implemented yet

• OIDC login and token validation, account provisioning, organization invitations and membership authorization services.
• Authenticated API endpoints and a web dashboard.
• A PostgreSQL-backed finding lifecycle repository; the current lifecycle ledger remains a local SQLite adapter.
• Passive external attack-surface discovery, web/API assessments, cloud identity posture and active network checks.
• Distributed scanner-node enrollment, durable scan queue, quotas, retries and worker isolation.
• Attack-path analysis, threat-intelligence correlation, remediation assignment and verification.
• Enterprise SSO/SCIM, compliance reporting, high availability, disaster recovery and independent penetration testing.

These are roadmap items, not existing capabilities. VANTAGE is an active engineering foundation and is not ready to handle production customer assets or sensitive enterprise environments.

Why this project matters to me

VANTAGE brings together the areas I want to work in: security engineering, infrastructure, evidence quality, backend architecture and secure multi-tenant systems. The goal is to make security results actionable and verifiable, not simply produce more alerts.

Read the source, architecture, threat model, tenancy notes and roadmap ↗