summit v0.5.0 - authorization testing, hidden parameter mining, OpenAPI scanning

Fifth release. Three additions that used to live behind paid tooling - now free, scripted, and verified like everything else here.

New in v0.5.0

Broken access control testing (summit authorize)

The Autorize workflow: request each URL as a privileged role and as a low-privilege role, compare responses. Verdicts: enforced / broken (critical, confirmed) / partial (potential). Measured on the demo admin panel: served salaries to both roles, caught as confirmed.

Hidden parameter mining (summit mine)

The Param Miner approach: ~70 undocumented parameter names probed with unique markers. Reflection findings are confirmed; behavior changes are potential. Measured: the demo app's hidden debug switch found as confirmed, the other candidates silent - zero noise.

OpenAPI-driven scanning

summit scan --openapi spec.json turns a JSON OpenAPI document into scan targets - path params filled from examples and defaults, no crawling. Measured: the spec alone leads the engine to the seeded SQL injection and XSS.

Verified

• 53 tests, ruff clean
• evidence runner: 14/14 claims (three new: authorize, mining, openapi)
• CI runs pytest + smoke test + evidence on every push

Install

git clone https://github.com/pennacle-security/summit.git && cd summit && pip install -e .

Python 3.10+, requests is the only dependency.

Authorized testing only.