mirror of
https://github.com/KeygraphHQ/shannon.git
synced 2026-08-24 04:02:35 +02:00
George FloresandClaude Opus 5
af1ed2a563
Documentation pass over the README and supporting docs, incorporating the Aug 19 review with Parathan. README: - Dark/light banner and Discord/Keygraph buttons via <picture> - Add a Common Questions section at the bottom of the page - State one consistent position on model support and provider breadth - Name the OpenAI Responses API alongside Chat Completions - Frame local and self-hosted models as technically supported but not recommended, since capability varies once the harness opens every provider and model - Describe SARIF as machine-readable output rather than a CI feature Docs: - ai-providers: drop the Claude-preference claim; explain that capability varies and the model should be evaluated against your own targets - configuration: correct rating semantics stale since v2.2.0, since severity is now recorded in both exploitative and analysis-only runs - safety: reframe the model-support caveat in the same terms - worker: correct the stale rationale on the SARIF analysis-mode gate CI/CD documentation is intentionally omitted until the GitHub Marketplace action lands, so the README does not ship a hand-rolled npx wrapper that is about to be replaced. llms.txt and llms-full.txt regenerated from source, with one deliberate exception: the "Is Shannon free?" and "Is Shannon free for startups and nonprofits?" questions are kept in the llms-full.txt copy of the README but not in the README itself. That section exists for agents, so a naive regeneration of llms-full.txt would drop them; re-add them if you rebuild the file from source. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
52 lines
2.4 KiB
Markdown
52 lines
2.4 KiB
Markdown
# Safety and Limitations
|
|
|
|
Read this before running Shannon in a new environment.
|
|
|
|
## Authorized Use Only
|
|
|
|
Shannon is designed for legitimate security auditing. You must have explicit written authorization from the owner of the target system before running Shannon.
|
|
|
|
Unauthorized scanning or exploitation of systems you do not own is illegal. Keygraph is not responsible for misuse of Shannon.
|
|
|
|
## Do Not Run on Production
|
|
|
|
Shannon is not a passive scanner. Exploitation agents actively execute attacks to confirm vulnerabilities. This can mutate application state and data.
|
|
|
|
Do not run Shannon against production systems. Use sandboxed, staging, or local development environments where data integrity is not a concern.
|
|
|
|
Potential mutative effects include:
|
|
|
|
- Creating new users
|
|
- Modifying or deleting data
|
|
- Compromising test accounts
|
|
- Triggering unintended side effects from injection attacks
|
|
- Generating unexpected outbound traffic
|
|
- Writing exploit artifacts to reports or deliverables
|
|
|
|
For maximum isolation, run Shannon inside a disposable virtual machine.
|
|
|
|
## LLM and Automation Caveats
|
|
|
|
- **Verification is required**: Shannon uses a proof-by-exploitation methodology, but final reports can still contain weakly supported or incorrect details. Human review is essential.
|
|
- **Model support**: results vary by model. A model that does not follow Shannon's instructions or tool-use constraints reliably may produce incomplete, inaccurate, or unstable runs.
|
|
- **Prompt injection risk**: Do not point Shannon at untrusted or adversarial codebases. AI-powered tools that read source code can be influenced by malicious repository content.
|
|
|
|
## Scope of Analysis
|
|
|
|
Shannon currently targets exploitable vulnerabilities in these classes:
|
|
|
|
- Broken Authentication
|
|
- Broken Authorization
|
|
- Injection
|
|
- Cross-Site Scripting
|
|
- Server-Side Request Forgery
|
|
|
|
Shannon's proof-by-exploitation model means it does not report issues it cannot actively exploit, such as many vulnerable dependency, insecure configuration, or broad policy findings.
|
|
|
|
For broader coverage, the Keygraph platform adds black-box and white-box agentic pentesting, graph-based static analysis, SCA reachability, secrets detection, business logic testing, remediation workflows, SLA tracking, and reporting dashboards.
|
|
|
|
## Cost and Performance
|
|
|
|
A full test run typically takes roughly 1 to 1.5 hours. LLM API costs vary by model pricing, target complexity, selected provider, and concurrency.
|
|
|