What is tsunami-security-scanner?

Tsunami is an open-source network security scanner released by Google. Its job is to automatically check a network for serious security vulnerabilities, with a focus on finding real problems rather than generating large numbers of false alarms. The design goal is high confidence: when Tsunami reports a vulnerability, it is very likely to be a genuine issue. The scanner is built around a plugin system. The core of Tsunami handles the general work of scanning a network, while specific vulnerability checks are packaged as separate plugins. This means the scanner can be extended to detect new vulnerabilities by adding plugins without changing the core code. All publicly available plugins live in a companion repository on GitHub. The project is written in Java and released under the Apache 2.0 open-source license. Google notes that Tsunami is not an official Google product, meaning it is a research and engineering project shared with the community rather than a supported commercial offering. The README is sparse and points readers to the external documentation site for instructions on how to build, run, and contribute to the project. Details about specific vulnerability detections, plugin development, and deployment are covered there rather than in the repository itself.