George FloresandClaude Opus 5
af1ed2a563
Documentation pass over the README and supporting docs, incorporating the Aug 19 review with Parathan. README: - Dark/light banner and Discord/Keygraph buttons via <picture> - Add a Common Questions section at the bottom of the page - State one consistent position on model support and provider breadth - Name the OpenAI Responses API alongside Chat Completions - Frame local and self-hosted models as technically supported but not recommended, since capability varies once the harness opens every provider and model - Describe SARIF as machine-readable output rather than a CI feature Docs: - ai-providers: drop the Claude-preference claim; explain that capability varies and the model should be evaluated against your own targets - configuration: correct rating semantics stale since v2.2.0, since severity is now recorded in both exploitative and analysis-only runs - safety: reframe the model-support caveat in the same terms - worker: correct the stale rationale on the SARIF analysis-mode gate CI/CD documentation is intentionally omitted until the GitHub Marketplace action lands, so the README does not ship a hand-rolled npx wrapper that is about to be replaced. llms.txt and llms-full.txt regenerated from source, with one deliberate exception: the "Is Shannon free?" and "Is Shannon free for startups and nonprofits?" questions are kept in the llms-full.txt copy of the README but not in the README itself. That section exists for agents, so a naive regeneration of llms-full.txt would drop them; re-add them if you rebuild the file from source. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
2.4 KiB
Safety and Limitations
Read this before running Shannon in a new environment.
Authorized Use Only
Shannon is designed for legitimate security auditing. You must have explicit written authorization from the owner of the target system before running Shannon.
Unauthorized scanning or exploitation of systems you do not own is illegal. Keygraph is not responsible for misuse of Shannon.
Do Not Run on Production
Shannon is not a passive scanner. Exploitation agents actively execute attacks to confirm vulnerabilities. This can mutate application state and data.
Do not run Shannon against production systems. Use sandboxed, staging, or local development environments where data integrity is not a concern.
Potential mutative effects include:
- Creating new users
- Modifying or deleting data
- Compromising test accounts
- Triggering unintended side effects from injection attacks
- Generating unexpected outbound traffic
- Writing exploit artifacts to reports or deliverables
For maximum isolation, run Shannon inside a disposable virtual machine.
LLM and Automation Caveats
- Verification is required: Shannon uses a proof-by-exploitation methodology, but final reports can still contain weakly supported or incorrect details. Human review is essential.
- Model support: results vary by model. A model that does not follow Shannon's instructions or tool-use constraints reliably may produce incomplete, inaccurate, or unstable runs.
- Prompt injection risk: Do not point Shannon at untrusted or adversarial codebases. AI-powered tools that read source code can be influenced by malicious repository content.
Scope of Analysis
Shannon currently targets exploitable vulnerabilities in these classes:
- Broken Authentication
- Broken Authorization
- Injection
- Cross-Site Scripting
- Server-Side Request Forgery
Shannon's proof-by-exploitation model means it does not report issues it cannot actively exploit, such as many vulnerable dependency, insecure configuration, or broad policy findings.
For broader coverage, the Keygraph platform adds black-box and white-box agentic pentesting, graph-based static analysis, SCA reachability, secrets detection, business logic testing, remediation workflows, SLA tracking, and reporting dashboards.
Cost and Performance
A full test run typically takes roughly 1 to 1.5 hours. LLM API costs vary by model pricing, target complexity, selected provider, and concurrency.