coulomb/whitehat-security
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
whitehat-security/docs/reporting.md
tegwick 95129d7a35 Add governed test plane and close T04/T08 
Encode fail-closed admission, target registrations, and a credential
broker that never returns secret values. Calibrate audit-core shaped
probes in-process. Send no packets and request no live credentials.

Assistant: grok
Assistant-Session: 01a02670-3345-76f2-a014-70fde8e2a2bb
2026-08-22 00:44:21 +02:00

1.1 KiB
Raw Permalink Blame History

Reporting contract

Every target run—pass, finding, inconclusive or abort—uses schemas/run-report.schema.json. Reports include authorization and engagement ids, target revision, posture/model, timestamps, sanitized observations, cleanup and credential disposition. They never include response bodies, credentials or severity.

A finding is routed to risk-nexus with supported facts and provenance. A passing report is routed too because its date and target revision define the freshness of the limited assurance. Generate the message body with:

PYTHONPATH=src python3 -m whitehat_security.cli risk-message evidence/<run>.json

The reporter does not edit risk-nexus grading fields. risk-nexus decides whether an observation is a finding or note, and owns severity, disclosure, review cadence and escalation.

Queue a target report without assigning severity:

PYTHONPATH=src python3 -m whitehat_security.cli deliver evidence/<run>.json --outbox outbox

Offline calibration stays in this repository and is plainly labeled evidence_class: fixture; it is not sent as if it were a target result. The deliver command refuses fixture evidence.