gdprscan

Static GDPR/privacy technical audit scanner. A single Go binary scans a domain from the outside, the way a data protection authority or a privacy-conscious visitor would see it, and produces a scored, client-ready report in minutes.

What it checks

1. Security headers, CSP, HSTS, X-Content-Type-Options, Referrer-Policy, Permissions-Policy and friends.
2. TLS and certificate, protocol versions, cipher configuration, certificate validity and coverage.
3. Third-party vendors, scripts, frames and resources loaded from external companies, matched against an embedded vendor database.
4. Cookies set before consent, what lands in the browser on first contact, before any banner interaction.
5. DNS, MX and hosting jurisdiction, where the site and its mail actually live, resolved offline against a local GeoIP database.
6. US data-transfer exposure, three-state classification of each third party against the EU-US Data Privacy Framework.
7. Legal pages, presence and reachability of privacy policy and legal notice pages.

Output

• Deterministic JSON (stable key order, sorted findings), suitable for diffing two scans of the same domain.
• A scored Markdown report with an A-F grade, per-finding severity (critical/high/medium/low/info) and an evidence appendix. Convert to PDF with pandoc if a client deliverable is needed.

Critical findings cap the grade: one critical caps at C, two or more cap at D.

Build and run

go build ./cmd/gdprscan
./gdprscan -domain example.com
./gdprscan -list domains.txt -out reports/

Flags: -domain, -list (one domain per line), -out, -config (JSON, includes report branding), -timeout, -user-agent, -geoip-country-db, -geoip-asn-db.

GeoIP attribution (check 5) is optional and fully offline. Download a free DB-IP Lite MMDB once and pass its path:

curl -fL -o dbip-country-lite.mmdb.gz \
    https://download.db-ip.com/free/dbip-country-lite-$(date +%Y-%m).mmdb.gz
gunzip dbip-country-lite.mmdb.gz
./gdprscan -domain example.com -geoip-country-db ./dbip-country-lite.mmdb

Without the flag the scan still runs; IP addresses are reported without country/organization attribution.

Design principles

• Go standard library first: exactly two dependencies (golang.org/x/net for HTML parsing and the public-suffix list, maxminddb-golang for offline GeoIP).
• Local CLI only: no daemon, no listening sockets, no telemetry, no stored credentials, nothing phones home.
• Polite scanning: sequential requests, at most 20 requests and 5 redirects per scan, GET/HEAD only, configurable User-Agent.
• The scanner's own HTTP client always uses modern TLS defaults; weak TLS on targets is inspected, never adopted.

ProofBundle provenance

Public Git snapshots of this repository are attested with ProofBundle.

ProofBundle binds a Git archive to a deterministic manifest, Merkle root, signed authorship/custody claim, and OpenTimestamps proof. For this project, the public author claim is signed with the OpenPGP Ed25519 key:

Gabriele Salati <gabriel1@gabrielesalati.eu>
08BBBF34E279618861E2897D03E8E3F46FBDC8AA

This is technical evidence of integrity, timestamping, and signed claim of authorship/custody; it is not copyright registration.

Published attestation:

• Commit: d5b544e
• Merkle root: 15f6abe28278fd1f58f21d23cd22915bf92c998d3861ac29dd368558d703118b
• Proof files: .proofbundle/2026-07-09/d5b544e/

License and commercial use

This repository is source-available for review; all rights reserved.

The tool is offered under white-label license to web agencies and GDPR/DPO consultancies that want a ready-made technical audit deliverable to complement their legal work. Live example of the audit service built on it: frozenstar.info.

Contact: info@ilion.info (Ilion Web Solutions).