websec-validator 0.4.1__tar.gz → 0.4.2__tar.gz
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- {websec_validator-0.4.1/src/websec_validator.egg-info → websec_validator-0.4.2}/PKG-INFO +9 -3
- {websec_validator-0.4.1 → websec_validator-0.4.2}/README.md +8 -2
- {websec_validator-0.4.1 → websec_validator-0.4.2}/pyproject.toml +1 -1
- {websec_validator-0.4.1 → websec_validator-0.4.2/src/websec_validator.egg-info}/PKG-INFO +9 -3
- {websec_validator-0.4.1 → websec_validator-0.4.2}/LICENSE +0 -0
- {websec_validator-0.4.1 → websec_validator-0.4.2}/setup.cfg +0 -0
- {websec_validator-0.4.1 → websec_validator-0.4.2}/src/websec_validator/__init__.py +0 -0
- {websec_validator-0.4.1 → websec_validator-0.4.2}/src/websec_validator/briefing.py +0 -0
- {websec_validator-0.4.1 → websec_validator-0.4.2}/src/websec_validator/calibration.json +0 -0
- {websec_validator-0.4.1 → websec_validator-0.4.2}/src/websec_validator/calibration.py +0 -0
- {websec_validator-0.4.1 → websec_validator-0.4.2}/src/websec_validator/cli.py +0 -0
- {websec_validator-0.4.1 → websec_validator-0.4.2}/src/websec_validator/constitution.py +0 -0
- {websec_validator-0.4.1 → websec_validator-0.4.2}/src/websec_validator/corpus.json +0 -0
- {websec_validator-0.4.1 → websec_validator-0.4.2}/src/websec_validator/dynamic.py +0 -0
- {websec_validator-0.4.1 → websec_validator-0.4.2}/src/websec_validator/extractors/__init__.py +0 -0
- {websec_validator-0.4.1 → websec_validator-0.4.2}/src/websec_validator/extractors/auth.py +0 -0
- {websec_validator-0.4.1 → websec_validator-0.4.2}/src/websec_validator/extractors/authz.py +0 -0
- {websec_validator-0.4.1 → websec_validator-0.4.2}/src/websec_validator/extractors/base.py +0 -0
- {websec_validator-0.4.1 → websec_validator-0.4.2}/src/websec_validator/extractors/client_exposure.py +0 -0
- {websec_validator-0.4.1 → websec_validator-0.4.2}/src/websec_validator/extractors/client_integrity.py +0 -0
- {websec_validator-0.4.1 → websec_validator-0.4.2}/src/websec_validator/extractors/graphql.py +0 -0
- {websec_validator-0.4.1 → websec_validator-0.4.2}/src/websec_validator/extractors/iac_ci.py +0 -0
- {websec_validator-0.4.1 → websec_validator-0.4.2}/src/websec_validator/extractors/integrations.py +0 -0
- {websec_validator-0.4.1 → websec_validator-0.4.2}/src/websec_validator/extractors/pii_exposure.py +0 -0
- {websec_validator-0.4.1 → websec_validator-0.4.2}/src/websec_validator/extractors/policy_consistency.py +0 -0
- {websec_validator-0.4.1 → websec_validator-0.4.2}/src/websec_validator/extractors/routes.py +0 -0
- {websec_validator-0.4.1 → websec_validator-0.4.2}/src/websec_validator/extractors/schemas.py +0 -0
- {websec_validator-0.4.1 → websec_validator-0.4.2}/src/websec_validator/extractors/stack.py +0 -0
- {websec_validator-0.4.1 → websec_validator-0.4.2}/src/websec_validator/extractors/surface.py +0 -0
- {websec_validator-0.4.1 → websec_validator-0.4.2}/src/websec_validator/extractors/tenant.py +0 -0
- {websec_validator-0.4.1 → websec_validator-0.4.2}/src/websec_validator/extractors/upload_security.py +0 -0
- {websec_validator-0.4.1 → websec_validator-0.4.2}/src/websec_validator/findings.py +0 -0
- {websec_validator-0.4.1 → websec_validator-0.4.2}/src/websec_validator/probes.py +0 -0
- {websec_validator-0.4.1 → websec_validator-0.4.2}/src/websec_validator/proof.py +0 -0
- {websec_validator-0.4.1 → websec_validator-0.4.2}/src/websec_validator/recon.py +0 -0
- {websec_validator-0.4.1 → websec_validator-0.4.2}/src/websec_validator/report.py +0 -0
- {websec_validator-0.4.1 → websec_validator-0.4.2}/src/websec_validator/rules/error-stack-disclosure.yml +0 -0
- {websec_validator-0.4.1 → websec_validator-0.4.2}/src/websec_validator/rules/insecure-default-secret.yml +0 -0
- {websec_validator-0.4.1 → websec_validator-0.4.2}/src/websec_validator/scanners.py +0 -0
- {websec_validator-0.4.1 → websec_validator-0.4.2}/src/websec_validator/templates/probes/_lib.py +0 -0
- {websec_validator-0.4.1 → websec_validator-0.4.2}/src/websec_validator/templates/probes/appsync-cswsh.sh +0 -0
- {websec_validator-0.4.1 → websec_validator-0.4.2}/src/websec_validator/templates/probes/appsync-introspection.sh +0 -0
- {websec_validator-0.4.1 → websec_validator-0.4.2}/src/websec_validator/templates/probes/appsync-subscription-bola.sh +0 -0
- {websec_validator-0.4.1 → websec_validator-0.4.2}/src/websec_validator/templates/probes/bola-cross-tenant.sh +0 -0
- {websec_validator-0.4.1 → websec_validator-0.4.2}/src/websec_validator/templates/probes/bola-write-verbs.py +0 -0
- {websec_validator-0.4.1 → websec_validator-0.4.2}/src/websec_validator/templates/probes/client-integrity-checklist.sh +0 -0
- {websec_validator-0.4.1 → websec_validator-0.4.2}/src/websec_validator/templates/probes/compare-roles.sh +0 -0
- {websec_validator-0.4.1 → websec_validator-0.4.2}/src/websec_validator/templates/probes/dlp-bypass-offline.py +0 -0
- {websec_validator-0.4.1 → websec_validator-0.4.2}/src/websec_validator/templates/probes/error-disclosure-probe.sh +0 -0
- {websec_validator-0.4.1 → websec_validator-0.4.2}/src/websec_validator/templates/probes/forged-token.sh +0 -0
- {websec_validator-0.4.1 → websec_validator-0.4.2}/src/websec_validator/templates/probes/hs256-brute-force.py +0 -0
- {websec_validator-0.4.1 → websec_validator-0.4.2}/src/websec_validator/templates/probes/jwt-attacks.sh +0 -0
- {websec_validator-0.4.1 → websec_validator-0.4.2}/src/websec_validator/templates/probes/mass-assignment.py +0 -0
- {websec_validator-0.4.1 → websec_validator-0.4.2}/src/websec_validator/templates/probes/password-reuse.sh +0 -0
- {websec_validator-0.4.1 → websec_validator-0.4.2}/src/websec_validator/templates/probes/pii-output-diff.sh +0 -0
- {websec_validator-0.4.1 → websec_validator-0.4.2}/src/websec_validator/templates/probes/race-conditions.py +0 -0
- {websec_validator-0.4.1 → websec_validator-0.4.2}/src/websec_validator/templates/probes/rate-limit-burst.sh +0 -0
- {websec_validator-0.4.1 → websec_validator-0.4.2}/src/websec_validator/templates/probes/s3-assess.sh +0 -0
- {websec_validator-0.4.1 → websec_validator-0.4.2}/src/websec_validator/templates/probes/ssrf-probes.sh +0 -0
- {websec_validator-0.4.1 → websec_validator-0.4.2}/src/websec_validator/templates/probes/unauth-baseline.sh +0 -0
- {websec_validator-0.4.1 → websec_validator-0.4.2}/src/websec_validator/templates/probes/upload-matrix.sh +0 -0
- {websec_validator-0.4.1 → websec_validator-0.4.2}/src/websec_validator/templates/probes/webhook-forgery.py +0 -0
- {websec_validator-0.4.1 → websec_validator-0.4.2}/src/websec_validator/templates/reports/FINDINGS-SUMMARY.md.template +0 -0
- {websec_validator-0.4.1 → websec_validator-0.4.2}/src/websec_validator/templates/reports/access-control-matrix.md.template +0 -0
- {websec_validator-0.4.1 → websec_validator-0.4.2}/src/websec_validator/templates/reports/findings-triage.md.template +0 -0
- {websec_validator-0.4.1 → websec_validator-0.4.2}/src/websec_validator/templates/reports/pentest-handover-brief.md.template +0 -0
- {websec_validator-0.4.1 → websec_validator-0.4.2}/src/websec_validator/templates/reports/per-tool-FINDINGS.md.template +0 -0
- {websec_validator-0.4.1 → websec_validator-0.4.2}/src/websec_validator.egg-info/SOURCES.txt +0 -0
- {websec_validator-0.4.1 → websec_validator-0.4.2}/src/websec_validator.egg-info/dependency_links.txt +0 -0
- {websec_validator-0.4.1 → websec_validator-0.4.2}/src/websec_validator.egg-info/entry_points.txt +0 -0
- {websec_validator-0.4.1 → websec_validator-0.4.2}/src/websec_validator.egg-info/top_level.txt +0 -0
- {websec_validator-0.4.1 → websec_validator-0.4.2}/tests/test_hardening.py +0 -0
- {websec_validator-0.4.1 → websec_validator-0.4.2}/tests/test_pentest_regressions.py +0 -0
- {websec_validator-0.4.1 → websec_validator-0.4.2}/tests/test_recon.py +0 -0
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
Metadata-Version: 2.4
|
|
2
2
|
Name: websec-validator
|
|
3
|
-
Version: 0.4.
|
|
3
|
+
Version: 0.4.2
|
|
4
4
|
Summary: Local-first security recon that briefs your AI coding agent: facts + tailored probe scripts, code-in / artifacts-out. No LLM, no server, no running app.
|
|
5
5
|
Author: Ricardo Accioly
|
|
6
6
|
License: MIT
|
|
@@ -12,6 +12,8 @@ Dynamic: license-file
|
|
|
12
12
|
|
|
13
13
|
# websec-validator
|
|
14
14
|
|
|
15
|
+
<!-- docguard:quality negation-load off — "no LLM / no server / no running app / not a SaaS / never touches prod" is this tool's core positioning; defining it by contrast with the scanners-and-SaaS it deliberately is NOT is intentional, not a phrasing defect. -->
|
|
16
|
+
|
|
15
17
|
> Local-first security recon that **briefs your AI coding agent**. It does the deterministic
|
|
16
18
|
> half — read the repo, map the full attack surface, run + de-duplicate the static scanners, and
|
|
17
19
|
> stage a probe library tailored to what it found — then hands your agent (Claude Code, Codex,
|
|
@@ -69,7 +71,7 @@ docker run --rm --user "$(id -u):$(id -g)" -v "$PWD:/scan" websec-validator run
|
|
|
69
71
|
The image carries Noir + Trivy + Gitleaks + Semgrep + Checkov; mount your repo at `/scan` and the
|
|
70
72
|
artifacts land in `/scan/websec-out`.
|
|
71
73
|
|
|
72
|
-
##
|
|
74
|
+
## Usage
|
|
73
75
|
|
|
74
76
|
```bash
|
|
75
77
|
websec run ./my-app # ← the one command: recon + stage tailored probes + emit the briefing
|
|
@@ -182,7 +184,7 @@ upload, cross-tenant BOLA, role/authz gaps).
|
|
|
182
184
|
## Tests
|
|
183
185
|
|
|
184
186
|
```bash
|
|
185
|
-
python3 -m unittest discover -s tests # stdlib only, no Noir/network —
|
|
187
|
+
python3 -m unittest discover -s tests # stdlib only, no Noir/network — 103 tests
|
|
186
188
|
```
|
|
187
189
|
|
|
188
190
|
## Releasing (maintainer)
|
|
@@ -259,3 +261,7 @@ works the findings with you. For other agents the universal interface is unchang
|
|
|
259
261
|
|
|
260
262
|
Methodology + probe library are distilled from a real authenticated penetration-testing pass.
|
|
261
263
|
This tool productizes that hand-written methodology into something an AI agent can run on any repo.
|
|
264
|
+
|
|
265
|
+
## License
|
|
266
|
+
|
|
267
|
+
[MIT](LICENSE) © Ricardo Accioly
|
|
@@ -1,5 +1,7 @@
|
|
|
1
1
|
# websec-validator
|
|
2
2
|
|
|
3
|
+
<!-- docguard:quality negation-load off — "no LLM / no server / no running app / not a SaaS / never touches prod" is this tool's core positioning; defining it by contrast with the scanners-and-SaaS it deliberately is NOT is intentional, not a phrasing defect. -->
|
|
4
|
+
|
|
3
5
|
> Local-first security recon that **briefs your AI coding agent**. It does the deterministic
|
|
4
6
|
> half — read the repo, map the full attack surface, run + de-duplicate the static scanners, and
|
|
5
7
|
> stage a probe library tailored to what it found — then hands your agent (Claude Code, Codex,
|
|
@@ -57,7 +59,7 @@ docker run --rm --user "$(id -u):$(id -g)" -v "$PWD:/scan" websec-validator run
|
|
|
57
59
|
The image carries Noir + Trivy + Gitleaks + Semgrep + Checkov; mount your repo at `/scan` and the
|
|
58
60
|
artifacts land in `/scan/websec-out`.
|
|
59
61
|
|
|
60
|
-
##
|
|
62
|
+
## Usage
|
|
61
63
|
|
|
62
64
|
```bash
|
|
63
65
|
websec run ./my-app # ← the one command: recon + stage tailored probes + emit the briefing
|
|
@@ -170,7 +172,7 @@ upload, cross-tenant BOLA, role/authz gaps).
|
|
|
170
172
|
## Tests
|
|
171
173
|
|
|
172
174
|
```bash
|
|
173
|
-
python3 -m unittest discover -s tests # stdlib only, no Noir/network —
|
|
175
|
+
python3 -m unittest discover -s tests # stdlib only, no Noir/network — 103 tests
|
|
174
176
|
```
|
|
175
177
|
|
|
176
178
|
## Releasing (maintainer)
|
|
@@ -247,3 +249,7 @@ works the findings with you. For other agents the universal interface is unchang
|
|
|
247
249
|
|
|
248
250
|
Methodology + probe library are distilled from a real authenticated penetration-testing pass.
|
|
249
251
|
This tool productizes that hand-written methodology into something an AI agent can run on any repo.
|
|
252
|
+
|
|
253
|
+
## License
|
|
254
|
+
|
|
255
|
+
[MIT](LICENSE) © Ricardo Accioly
|
|
@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
|
|
|
4
4
|
|
|
5
5
|
[project]
|
|
6
6
|
name = "websec-validator"
|
|
7
|
-
version = "0.4.
|
|
7
|
+
version = "0.4.2"
|
|
8
8
|
description = "Local-first security recon that briefs your AI coding agent: facts + tailored probe scripts, code-in / artifacts-out. No LLM, no server, no running app."
|
|
9
9
|
readme = "README.md"
|
|
10
10
|
requires-python = ">=3.11"
|
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
Metadata-Version: 2.4
|
|
2
2
|
Name: websec-validator
|
|
3
|
-
Version: 0.4.
|
|
3
|
+
Version: 0.4.2
|
|
4
4
|
Summary: Local-first security recon that briefs your AI coding agent: facts + tailored probe scripts, code-in / artifacts-out. No LLM, no server, no running app.
|
|
5
5
|
Author: Ricardo Accioly
|
|
6
6
|
License: MIT
|
|
@@ -12,6 +12,8 @@ Dynamic: license-file
|
|
|
12
12
|
|
|
13
13
|
# websec-validator
|
|
14
14
|
|
|
15
|
+
<!-- docguard:quality negation-load off — "no LLM / no server / no running app / not a SaaS / never touches prod" is this tool's core positioning; defining it by contrast with the scanners-and-SaaS it deliberately is NOT is intentional, not a phrasing defect. -->
|
|
16
|
+
|
|
15
17
|
> Local-first security recon that **briefs your AI coding agent**. It does the deterministic
|
|
16
18
|
> half — read the repo, map the full attack surface, run + de-duplicate the static scanners, and
|
|
17
19
|
> stage a probe library tailored to what it found — then hands your agent (Claude Code, Codex,
|
|
@@ -69,7 +71,7 @@ docker run --rm --user "$(id -u):$(id -g)" -v "$PWD:/scan" websec-validator run
|
|
|
69
71
|
The image carries Noir + Trivy + Gitleaks + Semgrep + Checkov; mount your repo at `/scan` and the
|
|
70
72
|
artifacts land in `/scan/websec-out`.
|
|
71
73
|
|
|
72
|
-
##
|
|
74
|
+
## Usage
|
|
73
75
|
|
|
74
76
|
```bash
|
|
75
77
|
websec run ./my-app # ← the one command: recon + stage tailored probes + emit the briefing
|
|
@@ -182,7 +184,7 @@ upload, cross-tenant BOLA, role/authz gaps).
|
|
|
182
184
|
## Tests
|
|
183
185
|
|
|
184
186
|
```bash
|
|
185
|
-
python3 -m unittest discover -s tests # stdlib only, no Noir/network —
|
|
187
|
+
python3 -m unittest discover -s tests # stdlib only, no Noir/network — 103 tests
|
|
186
188
|
```
|
|
187
189
|
|
|
188
190
|
## Releasing (maintainer)
|
|
@@ -259,3 +261,7 @@ works the findings with you. For other agents the universal interface is unchang
|
|
|
259
261
|
|
|
260
262
|
Methodology + probe library are distilled from a real authenticated penetration-testing pass.
|
|
261
263
|
This tool productizes that hand-written methodology into something an AI agent can run on any repo.
|
|
264
|
+
|
|
265
|
+
## License
|
|
266
|
+
|
|
267
|
+
[MIT](LICENSE) © Ricardo Accioly
|
|
File without changes
|
|
File without changes
|
|
File without changes
|
|
File without changes
|
|
File without changes
|
|
File without changes
|
|
File without changes
|
|
File without changes
|
|
File without changes
|
|
File without changes
|
{websec_validator-0.4.1 → websec_validator-0.4.2}/src/websec_validator/extractors/__init__.py
RENAMED
|
File without changes
|
|
File without changes
|
|
File without changes
|
|
File without changes
|
{websec_validator-0.4.1 → websec_validator-0.4.2}/src/websec_validator/extractors/client_exposure.py
RENAMED
|
File without changes
|
|
File without changes
|
{websec_validator-0.4.1 → websec_validator-0.4.2}/src/websec_validator/extractors/graphql.py
RENAMED
|
File without changes
|
|
File without changes
|
{websec_validator-0.4.1 → websec_validator-0.4.2}/src/websec_validator/extractors/integrations.py
RENAMED
|
File without changes
|
{websec_validator-0.4.1 → websec_validator-0.4.2}/src/websec_validator/extractors/pii_exposure.py
RENAMED
|
File without changes
|
|
File without changes
|
|
File without changes
|
{websec_validator-0.4.1 → websec_validator-0.4.2}/src/websec_validator/extractors/schemas.py
RENAMED
|
File without changes
|
|
File without changes
|
{websec_validator-0.4.1 → websec_validator-0.4.2}/src/websec_validator/extractors/surface.py
RENAMED
|
File without changes
|
|
File without changes
|
{websec_validator-0.4.1 → websec_validator-0.4.2}/src/websec_validator/extractors/upload_security.py
RENAMED
|
File without changes
|
|
File without changes
|
|
File without changes
|
|
File without changes
|
|
File without changes
|
|
File without changes
|
|
File without changes
|
|
File without changes
|
|
File without changes
|
{websec_validator-0.4.1 → websec_validator-0.4.2}/src/websec_validator/templates/probes/_lib.py
RENAMED
|
File without changes
|
|
File without changes
|
|
File without changes
|
|
File without changes
|
|
File without changes
|
|
File without changes
|
|
File without changes
|
|
File without changes
|
|
File without changes
|
|
File without changes
|
|
File without changes
|
|
File without changes
|
|
File without changes
|
|
File without changes
|
|
File without changes
|
|
File without changes
|
|
File without changes
|
|
File without changes
|
{websec_validator-0.4.1 → websec_validator-0.4.2}/src/websec_validator/templates/probes/s3-assess.sh
RENAMED
|
File without changes
|
|
File without changes
|
|
File without changes
|
|
File without changes
|
|
File without changes
|
|
File without changes
|
|
File without changes
|
|
File without changes
|
|
File without changes
|
|
File without changes
|
|
File without changes
|
{websec_validator-0.4.1 → websec_validator-0.4.2}/src/websec_validator.egg-info/dependency_links.txt
RENAMED
|
File without changes
|
{websec_validator-0.4.1 → websec_validator-0.4.2}/src/websec_validator.egg-info/entry_points.txt
RENAMED
|
File without changes
|
{websec_validator-0.4.1 → websec_validator-0.4.2}/src/websec_validator.egg-info/top_level.txt
RENAMED
|
File without changes
|
|
File without changes
|
|
File without changes
|
|
File without changes
|