coulomb/whitehat-security
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
Automated white hat it-security, pen-testing and isolation-probing.
7 commits 1 branch 0 tags 770 KiB
Find a file
tegwick 25a07d16f7 Approve rules of engagement and define attacker models 
Assistant: codex
Assistant-Model: gpt-5.6-sol
Assistant-Session: 01a0260c-4067-7052-9647-ad000d576e38
2026-08-21 23:09:22 +02:00
docs Approve rules of engagement and define attacker models 2026-08-21 23:09:22 +02:00
workplans Approve rules of engagement and define attacker models 2026-08-21 23:09:22 +02:00
.custodian-brief.md chore(consistency): sync task status from DB [auto] 2026-08-21 22:54:29 +02:00
.gitignore Register whitehat-security and align operating boundaries 2026-08-21 22:52:37 +02:00
.repo-classification.yaml Register whitehat-security and align operating boundaries 2026-08-21 22:52:37 +02:00
AGENTS.md Approve rules of engagement and define attacker models 2026-08-21 23:09:22 +02:00
INTENT.md Register whitehat-security and align operating boundaries 2026-08-21 22:52:37 +02:00
README.md Approve rules of engagement and define attacker models 2026-08-21 23:09:22 +02:00
SCOPE.md Approve rules of engagement and define attacker models 2026-08-21 23:09:22 +02:00
WORK-RECORDS.md Approve rules of engagement and define attacker models 2026-08-21 23:09:22 +02:00

README.md

whitehat-security

NetKingdom's offensive security facility. Automated white hat IT-security, pen-testing and isolation-probing — pointed at infrastructure we choose, including our own.

The estate's adversarial evidence facility: it attacks our own systems, on a schedule, to find out whether the security properties they claim are actually true.

It exists because a repo testing its own boundary grades its own homework. The probes most worth having are the ones an author would not think to write.

  • Independent in operation. It does not take a declared posture as true. NetKingdom owns both the security canon and this facility, so findings leave through risk-nexus under separate ownership rather than being resolved here.

  • It finds; it does not fix. Findings route to risk-nexus, which owns severity and disclosure. The repo that owns the defect owns the repair.

  • A pass means the attacks we tried did not work — not that the boundary holds. Reports say so.

  • Intent: INTENT.md

  • Scope: SCOPE.md

  • Workplans: workplans/

  • Attacker model: docs/attacker-model.md

  • Rules of engagement (accepted; live targets still require engagement approval): docs/rules-of-engagement.md