# scanclient  -  Internal Spec

> This file is gitignored. It exists for agents and internal development. Never committed to public repos.

## Identity
High-performance, observable HTTP client for security scanners.

## Purpose
Provides a specialized HTTP client wrapper (around `reqwest`) for security scanning, featuring unified rate-limiting, bounded response bodies, stealth profiles, and automatic retries.

## North Star
The ultimate security-focused HTTP client, capable of performing thousands of stealthy, rate-limited, and safe (SSRF-protected) probes per second while providing high-fidelity observation of server behavior.

## Role in Ecosystem
- **Depends on:** `proxywire`, `reqwest`, `secir`.
- **Depended on by:** `secmatch`, `scancoord`, `warpscan`, and all network-facing scanner modules.
- **Relationship to warpscan:** The primary network interface for all scan operations.
- **Standalone value:** YES  -  A modular and high-performance security-focused HTTP client for Rust.

## Invariants
- Redirect handling must strictly prevent SSRF (internal IP access) unless explicitly allowed.
- Response bodies are always bounded to prevent resource exhaustion.
- Stealth profiles (camouflage, TLS profiles) must be correctly applied to avoid fingerprinting.

## Boundaries
- Does not implement its own HTTP stack (uses `reqwest`).
- Does not handle finding reporting (managed by higher-level analyzers).

## Quality State
- Tests: >10 including unit and integration tests with `wiremock`.
- Lint preamble: yes (pedantic)
- #![forbid(unsafe_code)]: yes
- Doc coverage: ~95%
- Known issues: None.
