whitehat-security/targets/platform-pg-e3.json

{
  "schema_version": "whitehat-target/v1",
  "target_id": "platform-pg",
  "posture_claim": "E3",
  "attacker_model": "E3-A omitted-predicate accident; E3-B documented SQL-compromise limit",
  "applicability": "not_applicable",
  "applicability_reason": "rapp-postgres 8d4106f, still present at 0374403, grants SELECT on isolation_probe.rls_conformance to isolation_probe_app and keeps that role NOLOGIN, NOBYPASSRLS, and NOSUPERUSER. The change is file-only. No authorized promotion and no ordinary runtime LOGIN receipt exist, so no connectable identity can exercise the view. Do not open a database connection.",
  "approval_classes": ["e3"],
  "routes": [],
  "identities": {
    "count": 1,
    "role": "ordinary runtime database role without BYPASSRLS or superuser",
    "ttl_seconds": 900,
    "broker_audience": "whitehat-e3/platform-pg"
  },
  "abort_telemetry": [
    "statement_timeout",
    "unexpected_or_non_fixture_data",
    "missing_attribution",
    "privilege_escalation"
  ]
}