Skip to content

v0.1.0 — M1 walking skeleton

Choose a tag to compare

View all tags
@SelfishCoconut SelfishCoconut released this 13 Jul 17:08
· 146 commits to main since this release
v0.1.0
73de8b3
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

First milestone: a thin, deterministic end-to-end slice proving the architecture — ingest → probe → verdict. No LLM and no frontend yet (those begin in M2).

Included

  • FR-02 — ingest DefectDojo-style JSON findings into SQLite via the API.
  • FR-06 — target-authorization allowlist: an unbypassable httpx transport that refuses any target not explicitly allowlisted (SSRF guard), built only from trusted config.
  • FR-07 — one verification-only HTTP probe (the OWASP Juice Shop SQLi login bypass), executed through the FR-06 guard, capturing full request/response/timing evidence.
  • FR-09 — evidence-backed verdicts (still_open / fixed / inconclusive) with machine-readable reason codes, persisted and exposed at POST /findings/{id}/retest and GET /verdicts.

Run it

make lab-up                  # OWASP Juice Shop (pinned v17.1.1), localhost only
make demo-walking-skeleton   # prints INGEST / PROBE / EVIDENCE / VERDICT
make test-system             # asserts still_open against the live lab
make lab-down

Quality

Lint, mypy --strict, xenon complexity gate, and 96 unit/integration tests pass; coverage ~98%. Security review of the retest executor and a codebase-sanity audit both came back clean (HEALTHY).

Closes milestone M1 (issues #7, #11, #12, #14).

Assets 2
Loading