cscan: the quick start says zero config, the env template says five secrets

Three files, three different answers about what a startup requires

The quick start in the Chinese front page is annotated as a zero configuration start that uses built-in default keys, and it is two commands long:

# 克隆项目
git clone https://github.com/tangxiaofeng7/cscan.git
cd cscan

# 启动（零配置，使用内置默认密钥）
cp .env.example .env
docker compose up -d

# 更新镜像
docker compose pull && docker compose up -d

The env template disagrees. Its first line says to copy the file and fill in the five items below before running docker compose up -d, and the header of docker-compose.yaml goes further, requiring a created .env with strong random values for every credential before startup. So one file invites you to boot with the shipped values, one asks for five replacements, and one treats the shipped values as a mistake. Nothing on the front page reconciles the three.

The five credentials in the template are the credentials you would deploy with

The template ships five filled-in values rather than five blanks: CSCAN_JWT_SECRET=cscan_admin_secret, CSCAN_MONGO_ROOT_USERNAME=cscan_admin, CSCAN_MONGO_ROOT_PASSWORD=cscan_admin_mongodb, CSCAN_REDIS_PASSWORD=cscan_admin_redis and CSCAN_WORKER_KEY=cscan_admin_worker. Every one is guessable from the project name, and a quick start that copies the file unchanged deploys exactly these values.

The template does say how to replace them, instructing the reader to run openssl rand -hex 32 once per secret and paste the output. It also records two constraints that are easy to miss. The JWT signing secret must stay identical across all API instances, or tokens stop validating between them. The Mongo root password takes effect only when the data volume is first created, so changing it later does not rotate it, it affects the existing data instead.

Redis and MongoDB arrive from a personal registry mirror, and the API is tagged latest

None of the three services in the compose file pulls from Docker Hub. Redis comes from registry.cn-hangzhou.aliyuncs.com/txf7/redis:7-alpine, MongoDB from registry.cn-hangzhou.aliyuncs.com/txf7/mongo:6, and the application from registry.cn-hangzhou.aliyuncs.com/txf7/cscan-api:latest. The databases are therefore third-party rebuilds of upstream software rather than the upstream images, and the API image carries a floating tag.

The documented upgrade path is docker compose pull followed by docker compose up -d, which combined with a latest tag means an unpinned upgrade on every pull, with no rollback target recorded anywhere in the repository. Logging is at least bounded: an x-logging anchor sets the json-file driver with max-size 50m and max-file 3 for every service. All three services set TZ=Asia/Shanghai, and ip2region appears in go.mod, so the deployment assumes a single regional frame.

The Redis healthcheck passes the password on the command line

The compose header states that Mongo and Redis ports are never published to the outside and stay reachable only inside cscan_network, while the API port still has to be protected by external access control. That part is disciplined. The Redis service also uses the strict interpolation form, writing requirepass with ${CSCAN_REDIS_PASSWORD:?CSCAN_REDIS_PASSWORD must be set}, so compose aborts rather than starting Redis unauthenticated.

The healthcheck undercuts it slightly. Its test array is ["CMD", "redis-cli", "-a", "${CSCAN_REDIS_PASSWORD:?...}", "ping"], which puts the password into redis-cli arguments on every 10 second probe with a 5 second timeout and 3 retries. A password passed as an argument is visible to anything that can list container processes, and it is recorded in the container configuration. MongoDB is checked differently, with mongosh and db.adminCommand('ping'), which needs no credential on the command line.

leased-task-v1 refuses to resume old work rather than bridging it

Distributed scanning is advertised as multi-Worker execution with a priority queue, task sharding, scheduled tasks and reconnect recovery. The upgrade note attached to the leased-task-v1 protocol is the most precise paragraph in the whole front page. For Workers that connect straight to Redis, every old Worker must be stopped first and in-flight tasks drained, then the API and the Workers are upgraded together. Rolling mixes of old direct Workers are forbidden.

The recovery rule is the interesting half. Execution records without an instanceId or a lease token will be refused rather than resumed, and the project states plainly that no compatibility bridge with an empty token is provided. That is a fail-closed design choice, and it means a skipped upgrade step costs you queued work instead of silently restoring tasks with no ownership. go.mod carries robfig/cron/v3 for the scheduling claim and redis/go-redis/v9 for the direct connection.

The fingerprint total adds up, and the POC total is a build-time snapshot

The two headline numbers behave differently, and the difference is disclosed on the same page. The fingerprint figure reads 41,537 or more, split into 7,523 Wappalyzer application fingerprints and 34,014 built-in custom rules, and those two add to 41,537 exactly. The rules/ directory at the repository root is where that data lives.

The POC figure reads 13,412 or more and is attributed to a mirror integration of the Nuclei Templates project, with the count sourced from the upstream TEMPLATES-STATS.json file. The same line states that the real number changes with the mirror build time and with custom templates. So one number is a committed asset count you can check out and diff, and the other is a property of whichever image tag the compose file last pulled. Treat the first as versioned data and the second as a moving target.

Five data backends in the manifest, two servers in the compose file

go.mod requires go-sql-driver/mysql, lib/pq, microsoft/go-mssqldb, sijms/go-ora for Oracle and go.mongodb.org/mongo-driver, alongside redis/go-redis. That is four SQL dialects plus MongoDB plus Redis. The shipped compose file provides only Redis and MongoDB, so no MySQL, Postgres, SQL Server or Oracle server exists anywhere in the provided deployment, and the four SQL drivers have nothing to talk to out of the box.

Two smaller signals sit in the same file. The module line reads module cscan rather than the repository path, so the project cannot be installed with go get from its URL, and go 1.26 sets the toolchain floor. The require block also lists miniredis, testify and gopter next to production dependencies instead of segregating them, and the Docker client sits at v28.3.3+incompatible, the suffix that marks a module shipping no go.mod file.

Empty badges, a blank screenshot row, and three more hostnames

The front page is the Chinese file, with a language switch pointing at README_EN.md in the root, and both the Chinese and English names appear in that switch. Its badge row is five anchors carrying no link text at all: one to golang.org, one to vuejs.org, two pointing at the same in-page anchor for the highlights section, one to LICENSE and one to VERSION. The feature table below them has six column headers and a second row of six empty cells, so the screenshot row is blank in the file.

The addresses spread further. The recorded homepage is http://cscan.txf7.cn:8080, plain HTTP on a non-standard port, while your own deployment is reached at https://ip:7777. The custom POC download is lasest-cscan-poc.zip, a misspelling of latest, served over plain HTTP from www.txf7.cn. With github.com, cscan.txf7.cn, www.txf7.cn and registry.cn-hangzhou.aliyuncs.com all in play, and a VERSION file tracked outside any release, there are no GitHub releases to fall back on.

Editorial conclusion

Read cscan as a product with a published deployment contract rather than a zero-setup demo, because that is what the three startup descriptions add up to. Anyone running it should overwrite all five credentials before the first compose up, keep the Mongo root password stable for the life of the data volume, and treat the leased-task-v1 rule as a hard stop rather than a rolling upgrade. Pin the API image yourself if the floating tag matters, and confirm your own network controls the exposed API port, since the compose file leaves that to you.

Frequently asked questions

Official sources

1. Official documentation
2. Official README
3. Project repository