Built Secure by Default

All judge inference runs via local Ollama. No calls to OpenAI, Anthropic, or any cloud API. Suitable for air-gapped environments and sensitive targets.

--api-key is sent as a Bearer header only. It is never stored to disk, logged to terminal, or printed in error messages.

Jinja2 autoescape=True is mandatory. Attack payloads containing <script> render as escaped text in the HTML report - never executed.

Unbounded Consumption probes require an explicit --include-dos-tests flag. They are never fired by default to protect targets from accidental stress testing.

All payload files are read with yaml.safe_load(). The yaml.load() call with arbitrary Loader is banned by Ruff S506 enforced in CI.

The judge model must be different from the target model. Using the same model as both target and judge creates a conflict of interest - blocked at startup.

Every push and PR to this project's own codebase runs pip-audit (dependency scanning), gitleaks (secret scanning), and CodeQL (static analysis).

This project publishes its own STRIDE threat model, analysing the scanner's own attack surface.