A research platform built for clear, responsible security work.

Qustylex is a web-based security and research workspace. Its live API performs selected lookups against public DNS, RDAP/WHOIS, certificate-transparency, IP-intelligence, and HTTP sources; its URL assessment checks selected public-facing web properties; and its directory organizes 2,481 curated resource entries across security and OSINT topics. Directory entries are links and descriptions: Qustylex does not install or execute those third-party tools for you.

The platform is beyond an early prototype in breadth: it combines a substantial reference catalog with working DNS, domain, IP, HTTP, email-security, and web-assessment routes. Each result depends on the external data source, network conditions, and the target's configuration. Treat findings as leads to verify, not as guarantees or a substitute for professional review.

What you can do #

Quick start #

From zero to your first operational scan in under three minutes. No configuration, no CLI, no dependencies required.

Authentication #

Qustylex uses GitHub OAuth 2.0 as its only identity provider. This is a deliberate design decision. It removes password storage, eliminates email loops, and gives every account a verifiable identity backed by GitHub's security infrastructure.

Sign-in flow

Scopes requested

The current source requests read:user only. It does not request repository access or email access. Review GitHub's consent screen before approving access.

The Console #

The console at /console is the operations hub. Every module is reachable from the left sidebar, organized by purpose.

Navigation structure

URL Scanner #

The URL Scanner is a focused web-assessment workflow for a public URL that you own or have written permission to test. It combines selected checks through the Qustylex API and public data sources, then presents structured results. It is not a full penetration test, does not prove that a site is secure, and should not be run against third-party targets without authorization.

Features

API Call

The scanner is powered by the /api/tools endpoint. You can trigger the entire suite or specific checks programmatically.

curl -X GET "https://qustylex.vercel.app/api/tools?type=domain-full&q=example.com" \
  -H "Accept: application/json"

OSINT Arsenal #

The directory currently contains 2,481 curated resource entries across OSINT, network research, privacy, defensive security, forensics, and related categories. Entries are independently maintained links and descriptions, not software bundled with Qustylex. Opening one takes you to its provider; installation, accounts, pricing, availability, and terms are controlled by that provider. Qustylex does not run these resources in a hosted execution environment.

Categories

Network Intel #

The Network Intel module provides real-time reconnaissance on IP addresses, domains, and infrastructure. It bypasses the need for manual command-line tools by aggregating results from multiple sources.

Available Modules

Security Tools #

Beyond scanning, Qustylex provides access to a comprehensive suite of security tools for authorized professionals.

Tool Categories

Architecture Overview #

The repository is a static web application with serverless authentication and tool routes. Live results depend on the configured hosting environment and external data providers.

System diagram

Design principles

Threat model #

This is a list of risks relevant to the application, not a security certification or evidence that every listed mitigation is implemented. Validate the deployed service and its controls independently.

In scope

• Credential theft via XSS or CSRF
• Session hijacking via cookie theft
• Unauthorized data access via IDOR or authz bugs
• Injection attacks (SQL, command, template)
• Rate limit bypass and resource exhaustion
• OAuth flow attacks (CSRF, mix-up, code interception)

Out of scope

• Physical attacks on users or devices
• Legal compulsion of infrastructure providers
• Compromise of GitHub itself
• Endpoint compromise (malware on user device)

Data flow #

Understanding how data moves through Qustylex is essential for designing investigations that respect rate limits and preserve privacy.

Overview

API overview #

The Qustylex API is a JSON HTTP API served from the same domain. The Console page and /api/tools both require a valid, unexpired GitHub session. Authentication does not establish that a target is authorized or that a request is legally permitted.

Base URL

https://qustylex.vercel.app/api

Authentication

The Console and /api/tools require the same valid GitHub session cookie. Requests without a valid, unexpired session receive 401. The cookie is HttpOnly; same-origin browser requests send it automatically.

fetch('/api/auth/me', {
        credentials: 'same-origin',
        cache: 'no-store',
        headers: { Accept: 'application/json' }
      })

Auth endpoints #

GET /api/auth/me

Returns the authenticated user's profile. Used to verify session validity on the client.

GET /api/auth/me
Cookie: qstx_user=<signed>

Tool endpoints #

This endpoint routes a GET request to a supported lookup or assessment check. It currently accepts type and q query parameters without checking a session at the route handler. Several checks make outbound requests to the supplied public target or data providers. Use only assets in your written authorization scope; documentation and disclaimers do not replace server-side access controls.

GET /api/tools

Example: DNS Lookup

curl -X GET "https://qustylex.vercel.app/api/tools?type=dns-all&q=example.com"

Error codes #

Every error response has the same shape:

{
  "ok": false,
  "error": "Target unreachable",
}

Sessions #

The current implementation uses a signed cookie with a seven-day maximum age. The cookie payload contains the profile fields needed by the Console; the short-lived GitHub access token is discarded after profile lookup. The payload is base64-encoded and HMAC-signed, not encrypted. The server checks both the signature and expiry on protected requests.

Cookie structure

name:     qstx_user
value:    <base64(JSON payload)>.<hex(HMAC-SHA256)>
flags:    HttpOnly; Secure; SameSite=Lax
max-age:  604800

Flags explained

Encryption #

In transit

Browser and provider transport protections depend on the deployed hosting and each upstream service. This repository does not prove a platform-wide TLS version, HSTS preload, or cipher-suite guarantee; verify the live deployment before making such claims.

At rest

Do not assume application-level encryption at rest from this repository. Storage, logs, backups, and retention are controlled by the deployment platform and upstream providers and must be documented from their actual configuration.

Signing

Session cookies and payloads are signed with HMAC-SHA256. The verifier rejects invalid signatures, malformed payloads, and sessions older than seven days.

Responsible use #

Qustylex is a tool. It aggregates public data. It does not hack, does not bypass authentication, does not access private information. Everything it touches is already on the open internet.

Principles

• Authorization first. Assess only assets you own or have explicit written permission to test, and stay within the agreed scope and time window.
• Use low impact. Avoid repeated or high-volume requests, stop on instability, and follow the target's published rules and rate limits.
• Protect people and data. Do not use OSINT links or results to stalk, dox, harass, discriminate, or access accounts or data without permission.
• Handle findings responsibly. Minimize collection, protect any sensitive output, and disclose issues privately to the system owner.

Data we handle #

The source repository shows how the application currently handles some session data, but it does not establish hosting logs, backups, provider retention, or every production setting. The operator should publish and maintain a deployment-specific privacy notice for those details.

What we do NOT collect

• This source does not by itself establish what hosting, CDN, or upstream providers log.
• Review the live site's privacy notice and browser storage behavior before making assumptions about analytics, cookies, or retention.

Your rights #

You own your data. Full stop. Here's what you can do about it:

Acceptable use #

Qustylex is a neutral aggregation tool for public data. Using it is a privilege that comes with responsibilities.

You may

• Investigate your own infrastructure, domains, and accounts.
• Research publicly available information for lawful purposes.
• Publish findings as long as they respect applicable law and ethics.

You may not

• Use Qustylex to harass, stalk, threaten, or doxx any individual.
• Circumvent authentication, authorization, or rate limits.
• Bypass technical protections on targets you don't own.
• Scrape the platform itself (as opposed to using the API).

Frequently asked questions #

Search the documentation to find these prepared answers. The answers describe the current repository and should be checked against the live deployment, especially for privacy, legal, and security-sensitive decisions.

Glossary #

Changelog #

Repository capability snapshot — 2026-10

• GitHub OAuth sign-in and HMAC-signed session cookie
• URL assessment and selected DNS, RDAP, IP, HTTP, and email-security lookups
• Console directory with 2,481 external security and OSINT resource entries
• Searchable documentation and prepared FAQ answers
• API access controls and production privacy settings require deployment-level review