Skip to content

PermitProbe v0.2.0

Choose a tag to compare

View all tags
@Chorolee Chorolee released this 08 Oct 06:10
· 64 commits to main since this release
v0.2.0
563c83f
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

PermitProbe v0.2.0 release notes

PermitProbe v0.2.0 turns the original API boundary checker into a contract-driven one-shot
website assessment while retaining its explicit request and data boundaries.

Highlights

  • permitprobe scan runs the configured OpenAPI inventory, handoff inspection, bounded route
    discovery, declared GET checks and known-finding baseline as one verdict.
  • Public routes can enforce status, JSON shape, no-store, request variants and latency without
    requiring test accounts.
  • Authorization policies support bearer or cookie identities, complete caller/owner coverage,
    collection ownership, signed-file redirect shapes and private-cache headers.
  • Local OpenAPI documents expose uncovered or stale GET contracts without generating requests.
  • Fixed seed pages, /robots.txt and /sitemap.xml can produce sanitized route proposals. A
    discovered location is never fetched or promoted into executable policy automatically.
  • Known-finding baselines, evidence-linked retests and model-neutral bounded exploration preserve
    incomplete results and failed checks.

Upgrade notes

The policy format remains version 1, and a valid v0.1.1 policy remains valid. Object resources
now probe every declared victim by default, so an existing policy can produce more GET requests.
Set api.probe_victims to "one" only when representative coverage is intentional; max_cases
continues to reject an oversized plan before network delivery.

JSON reports move from schema version 1 to schema version 2. Integrations must accept the new
policy digest, evidence, coverage and grouped-finding fields. Prior schema-version-1 reports
cannot be used as retest inputs.

Proposal discovery is opt-in through api.discovery and is used only by scan. It performs
anonymous GETs to at most four configured seeds and the two optional known files. Reports omit
response bodies, raw discovered URLs and query values, and token-shaped path segments are
replaced with {value}.

Release verification

The release commit must pass the complete loopback test suite and Ruff on Python 3.11 and 3.14.
The wheel and source distribution must pass strict Twine validation. The built wheel is then
installed into a new virtual environment, where its version, generated policy schema and safe
synthetic demo are executed before any release assets are published.

PyPI publication remains a separate, manually invoked Trusted Publishing workflow. That workflow
downloads the already-published GitHub release assets, verifies their GitHub SHA256 digests and
package identity, and can validate without uploading.

Assets 4
Loading