UNPKG

paqad-ai

Version:

Spec-driven development framework — AI agents that think before they type

github.com/Eliyce/paqad-ai

Eliyce/paqad-ai

62 lines (41 loc) • 2.52 kB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
# Runtime Surface Checks verified: 2026-11-02 Always confirm base reachability first. Treat blocked runtime access as a coverage gap, not a clean result. ## Security Headers (OWASP 2025 A02) - `Strict-Transport-Security`: missing or short `max-age` - `X-Frame-Options` or CSP `frame-ancestors`: clickjacking protection - `X-Content-Type-Options: nosniff`: MIME sniffing prevention - `Content-Security-Policy`: present and non-trivial (not `default-src *`) - `Referrer-Policy`, `Permissions-Policy` - `X-Powered-By` / `Server`: information disclosure via server identity headers ## CORS Misconfiguration - `Access-Control-Allow-Origin: *` on authenticated or state-changing endpoints? - Server reflects `Origin` header value without validation? - `Access-Control-Allow-Credentials: true` combined with a wildcard or reflected origin? ## Error Disclosure - Do 500 errors return stack traces, file paths, SQL queries, or environment variables? - Debug pages reachable: `/debug`, `/_debugbar`, `/telescope`, `/horizon`, `/__profiler`, `/actuator` - GraphQL errors expose internal resolver names, DB table names, or stack traces? ## Open Redirect - Test `?redirect=https://evil.com`, `?next=//@evil.com`, `?return_url=//evil.com%2F..` - Protocol-relative bypass to an external host: `//evil.com` - URL-encoded bypass: `%2F%2Fevil.com` ## Sensitive File Exposure - `.env`, `.env.local`, `.env.production`, `.env.example` (may contain real secrets) - `.git/config`, `.git/HEAD` - `phpinfo.php`, `info.php`, `wp-config.php`, `debug.log`, `error.log` - `composer.json`, `package.json` (version/dependency disclosure) - `/server-status`, `/server-info` (Apache) - `robots.txt`, `sitemap.xml` (hidden path information gathering) ## Directory Listing - Check if the target's external URL paths `/uploads/`, `/storage/`, `/public/`, `/media/`, `/static/` serve directory listings. ## SSRF Surface - Identify endpoints accepting a URL, IP, or hostname parameter, probe with: `127.0.0.1`, `0x7f000001`, `[::1]`, `169.254.169.254` (AWS metadata) ## API Documentation Exposure - External endpoints `/swagger`, `/api-docs`, `/openapi.json`, `/graphql` (run introspection: `{ __schema { types { name } } }`), `/redoc` ## TLS / Cryptographic Surface (OWASP 2025 A04) - TLS version: reject connections on TLS 1.0/1.1; accept only TLS 1.2+ (prefer 1.3) - Weak cipher suites: RC4, DES, 3DES, NULL, EXPORT, anonymous ciphers - Certificate validity: expired, self-signed, or mismatched CN/SAN - HSTS preload eligibility