mirror of
https://github.com/KeygraphHQ/shannon.git
synced 2026-05-22 16:49:46 +02:00
ezl-keygraph
95998d1a44
* feat(steerability): add config-driven profile with code_path avoid enforcement * fix(steerability): write SDK deny rules once per workflow to avoid parallel-agent race * fix(steerability): reference guidance by pointer in report DROP rules * fix(steerability): tighten code_path avoid enforcement * chore(steerability): use shared ALL_VULN_CLASSES const and tighten RunScope type * fix(steerability): validate run scope before resume short-circuit * fix(steerability): emit only documented Read/Edit deny rules for code_path * fix(steerability): assemble report from analysis deliverables when exploit is disabled * feat(steerability): preflight check that code_path rules match at least one repo entry * fix(steerability): tag missing code_path entries with avoid/focus kind * revert(steerability): assemble report from analysis deliverables when exploit is disabled * feat(steerability): render per-class findings from queue JSON when exploit is disabled * refactor(steerability): trim findings renderer to common mappable rows * feat(steerability): allow report agent to rewrite category-label finding titles * docs(steerability): document new config fields in README and CLAUDE.md * docs(steerability): comment out optional config sections in examples
103 lines
3.5 KiB
YAML
103 lines
3.5 KiB
YAML
# Example configuration file for pentest-agent
|
|
# Copy this file and modify it for your specific testing needs
|
|
|
|
# Description of the target environment (optional, max 500 chars)
|
|
description: "Next.js e-commerce app on PostgreSQL. Local dev environment — .env files contain local-only credentials, not deployed to production."
|
|
|
|
# Limit which vulnerability classes run end-to-end (optional, default: all five)
|
|
# vuln_classes: [injection, xss, auth, authz, ssrf]
|
|
|
|
# Skip the exploitation phase (optional, default: "true")
|
|
# exploit: "false"
|
|
|
|
# Free-form engagement rules applied to analysis and exploitation agents (optional).
|
|
# Example below is illustrative; edit, remove, or add sections as needed.
|
|
# rules_of_engagement: |
|
|
# Forbidden techniques:
|
|
# - No password brute-force or credential stuffing. Cap login attempts at 5 per account.
|
|
# - ...
|
|
#
|
|
# Operational:
|
|
# - Throttle to under 5 requests per second per endpoint. Back off 60 seconds on any 429 response.
|
|
# - ...
|
|
#
|
|
# Data handling:
|
|
# - Do not include actual values in deliverables — use placeholders like [order_id] or [user_email].
|
|
# - ...
|
|
|
|
authentication:
|
|
login_type: form # Options: 'form' or 'sso'
|
|
login_url: "https://example.com/login"
|
|
credentials:
|
|
username: "testuser"
|
|
password: "testpassword"
|
|
totp_secret: "JBSWY3DPEHPK3PXP" # Optional TOTP secret for 2FA
|
|
|
|
# Natural language instructions for login flow
|
|
login_flow:
|
|
- "Type $username into the email field"
|
|
- "Type $password into the password field"
|
|
- "Click the 'Sign In' button"
|
|
- "Enter $totp in the verification code field"
|
|
- "Click 'Verify'"
|
|
|
|
success_condition:
|
|
type: url_contains # Options: 'url_contains' or 'element_present'
|
|
value: "/dashboard"
|
|
|
|
rules:
|
|
# Supported types: url_path, subdomain, domain, method, header, parameter, code_path
|
|
avoid:
|
|
- description: "Do not test the marketing site subdomain"
|
|
type: subdomain
|
|
value: "www"
|
|
|
|
- description: "Skip logout functionality"
|
|
type: url_path
|
|
value: "/logout"
|
|
|
|
- description: "No DELETE operations on user API"
|
|
type: url_path
|
|
value: "/api/v1/users/*"
|
|
|
|
# code_path values are repo-relative file paths or globs (e.g. "src/auth.ts", "test/**").
|
|
# - description: "Test fixtures and specs (not production code)"
|
|
# type: code_path
|
|
# value: "test/**"
|
|
#
|
|
# - description: "Generated migrations"
|
|
# type: code_path
|
|
# value: "db/migrations/**"
|
|
|
|
focus:
|
|
- description: "Prioritize beta admin panel subdomain"
|
|
type: subdomain
|
|
value: "beta-admin"
|
|
|
|
- description: "Focus on user profile updates"
|
|
type: url_path
|
|
value: "/api/v2/user-profile"
|
|
|
|
# code_path values are repo-relative file paths or globs (e.g. "src/auth.ts", "routes/*.ts").
|
|
# - description: "Express route handlers"
|
|
# type: code_path
|
|
# value: "routes/*.ts"
|
|
#
|
|
# - description: "Sequelize ORM model definitions"
|
|
# type: code_path
|
|
# value: "models/*.ts"
|
|
|
|
# Report filters applied by the report agent when assembling the final report (optional).
|
|
# Example below is illustrative; edit, remove, or add sections as needed.
|
|
# report:
|
|
# min_severity: low
|
|
# min_confidence: low
|
|
# guidance: |
|
|
# Drop findings about missing security headers and rate-limit gaps.
|
|
# ...
|
|
|
|
# Pipeline execution settings (optional)
|
|
# pipeline:
|
|
# retry_preset: subscription # 'default' or 'subscription' (6h max retry for rate limit recovery)
|
|
# max_concurrent_pipelines: 2 # 1-5, default: 5 (reduce to lower API usage spikes)
|