# scanclient  -  Technical Spec

## Overview

# scanclient  High-performance, connection-pooled, and observable HTTP client designed specifically for Santh security scanning tools.  This crate wraps `reqwest` to provide unified rate-limiting, bounded response bodies, automatic retries on scanner-relevant status codes, proxy support, redirect SSRF protections, and specific security scanning configurations.  `scanclient` is scanning-focused: rate limiting, target management, safe redirect handling, and finding-friendly response collection. `scanclient` is stealth-focused: fingerprint evasion, header rotation, and TLS profile mutation. They compose rather than compete.  ## Architecture - [`ScanClient`]: The main orchestration client. - [`HttpConfig`]: Configuration options for proxies, timeouts, and rate limits. - [`ScanResponse`]: A tailored response object capturing timing and status.  ## Quick Start  ```rust use scanclient::config::HttpConfig;  let config = HttpConfig::default(); assert_eq!(config.timeout_secs, 10); assert_eq!(config.max_retries, 3); assert!(config.tls_verify);  // Load from TOML let custom = HttpConfig::from_toml("timeout_secs = 30").unwrap(); assert_eq!(custom.timeout_secs, 30); ```

## Architecture

The crate is organized into the following public modules:

- `adaptive_rate`
- `auth`
- `camouflage`
- `client`
- `config`
- `dns_resolver`
- `error`
- `header_injection`
- `http_transport`
- `metrics`
- `pool`
- `request`
- `response`
- `retry`
- `smuggling`
- `tls_profiles`

## Guarantees

- `#![forbid(unsafe_code)]` where applicable; see `src/lib.rs` for the exact lint preamble.
- All public types have doc comments.
- Error messages are actionable where applicable.

## Public API Summary

Key entry points are exported from `src/lib.rs` via `pub mod` and `pub use` re-exports.
Consult the module-level documentation in each source file for function signatures and usage examples.

## Error Handling

- `Error`
