scanning-infrastructure-with-nessus

The code is a legitimate Nessus scanning and reporting utility with no evident malware, persistence, credential harvesting beyond intended Nessus authentication, or covert exfiltration. Security concerns include default-disabled TLS verification, suppression of TLS warnings, command-line credential exposure, unrestricted operator-selected scan destinations, and potential HTML injection from untrusted Nessus report fields. Credentials should be supplied through a protected mechanism, TLS verification should be enabled, and report values should be HTML-escaped.