Skip to content

summit v0.9.4 - Finding model overhaul, severity capping

Choose a tag to compare

View all tags
@incr3d1ble incr3d1ble released this 17 Oct 23:52
· 7 commits to main since this release
v0.9.4
b65a29f

Finding model overhaul. Severity is now derived from confidence plus verified impact.

Finding model changes

  • Confidence levels: confirmed (observed fact) > likely (strong signal) > needs-manual (heuristic) > info (informational)
  • Severity capping: findings without working proof are automatically capped. A needs-manual finding can never exceed LOW severity. A likely finding can never exceed MEDIUM.
  • poc field: every finding carries a reproducible curl command or verification procedure
  • verification_steps field: human-readable steps to verify the finding manually
  • affected_urls field: all affected URLs for deduplicated findings

Module updates

  • csrf.py: confidence changed from potential to likely (CSRF token absence is a strong signal)

Tests

  • severity filter tests updated to use confirmed confidence
  • CSRF test updated to expect capped severity
  • 88 tests, all passing. Ruff clean. Evidence 22/22. CI green.
Assets 5
Loading