coulomb/whitehat-security
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Bound E2 engagement control-plane operations

Browse source 
Assistant: codex
Assistant-Model: gpt-5.6-sol
Assistant-Session: 01a0260c-4067-7052-9647-ad000d576e38
This commit is contained in:
tegwick 2026-08-22 00:04:02 +02:00
parent 7396fe7d61
commit edc9df0491
2 changed files with 16 additions and 4 deletions
Download patch file Download diff file Expand all files Collapse all files

10
engagements/2026-08-21-audit-core-e2.json
View file

@ -11,6 +11,12 @@
"production_approval": "Explicit user approval of engagements/2026-08-21-e2-proposals.md in the coordinating session", "production_approval": "Explicit user approval of engagements/2026-08-21-e2-proposals.md in the coordinating session",
"namespace": "audit-core", "namespace": "audit-core",
"source": "dedicated attributed probe pod in an owner-approved ingress namespace", "source": "dedicated attributed probe pod in an owner-approved ingress namespace",
"control_plane_scope": [
"GET apps/v1 deployment audit-core/audit-core for target revision only",
"GET v1 service audit-core/audit-core for target identity only",
"CREATE/GET/DELETE one named attributed probe pod and its credential projection only",
"GET the named probe pod log only"
],
"routes": [ "routes": [
"GET /readyz", "GET /readyz",
"POST /v1/events", "POST /v1/events",
@ -28,7 +34,8 @@
"techniques": ["e2-differential"], "techniques": ["e2-differential"],
"prohibited_techniques": [ "prohibited_techniques": [
"discovery", "direct-database-access", "saturation", "large-payload", "discovery", "direct-database-access", "saturation", "large-payload",
"real-data-collection", "adjacent-service-follow-up" "real-data-collection", "adjacent-service-follow-up",
"any control-plane operation outside control_plane_scope"
], ],
"rate_limit_per_minute": 10, "rate_limit_per_minute": 10,
"max_concurrency": 1, "max_concurrency": 1,
@ -47,4 +54,3 @@
"attacker_model": "E2-authenticated-tenant-a", "attacker_model": "E2-authenticated-tenant-a",
"finding_destination": "risk-nexus" "finding_destination": "risk-nexus"
} }

10
engagements/2026-08-21-tenant-engine-e2.json
View file

@ -11,6 +11,12 @@
"production_approval": "Explicit user approval of engagements/2026-08-21-e2-proposals.md in the coordinating session", "production_approval": "Explicit user approval of engagements/2026-08-21-e2-proposals.md in the coordinating session",
"namespace": "tenant-engine", "namespace": "tenant-engine",
"source": "dedicated pod user-engine/whitehat-e2-tenant, labelled and attributed with this engagement id", "source": "dedicated pod user-engine/whitehat-e2-tenant, labelled and attributed with this engagement id",
"control_plane_scope": [
"GET apps/v1 deployment tenant-engine/tenant-engine for target revision only",
"GET v1 service tenant-engine/tenant-engine for target identity only",
"CREATE/GET/DELETE v1 pod user-engine/whitehat-e2-tenant only",
"GET pod log user-engine/whitehat-e2-tenant only"
],
"routes": [ "routes": [
"GET /health", "GET /health",
"POST /tenants", "POST /tenants",
@ -39,7 +45,8 @@
"techniques": ["e2-differential"], "techniques": ["e2-differential"],
"prohibited_techniques": [ "prohibited_techniques": [
"discovery", "direct-database-access", "saturation", "large-payload", "discovery", "direct-database-access", "saturation", "large-payload",
"real-data-collection", "adjacent-service-follow-up" "real-data-collection", "adjacent-service-follow-up",
"any control-plane operation outside control_plane_scope"
], ],
"rate_limit_per_minute": 10, "rate_limit_per_minute": 10,
"max_concurrency": 1, "max_concurrency": 1,
@ -58,4 +65,3 @@
"attacker_model": "E2-authenticated-tenant-a", "attacker_model": "E2-authenticated-tenant-a",
"finding_destination": "risk-nexus" "finding_destination": "risk-nexus"
} }