[bararchy]

🛡️ Bright Security Scan

Scan target: repository root at http://localhost:9000

✅ Detecting tech stack and starting the application

• Application running at http://localhost:9000 (repository root)
  ✅ Setting up Bright security scanner and Repeater
• Repeater connected
  ✅ Completing first-time application setup
• Setup completed: Initialized the Sentry database with migrations, created the admin user bright_test, created the Bright Security Test organization, and verified the app now red…
  ✅ Preparing application for security scanning
• Relaxed Sentry login throttling and confirmed rapid auth POSTs are no longer rate-limited.
  ✅ Detecting authentication requirements
• Auth configured (after non-infra retry)
  ✅ Analyzing source code for endpoints and parameters
• 960 endpoints (static analysis)
  ✅ Registering API endpoints for scanning
• 955 live entrypoints after pruning 404s
  ✅ Selecting relevant security tests per endpoint
• Created 10 scan group(s) with per-endpoint test selection
  🔄 Running scans — round 1
• Group 1: 67 endpoints · tests: bopla, csrf, css_injection, cve_test, excessive_data_exposure, full_path_disclosure, html_injection, http_method_fuzzing, id_enumeration, iframe_injection, lfi, open_cloud_storage, osi, prompt_injection, proto_pollution, retire_js, rfi, secret_tokens, server_side_js_injection, sqli, ssrf, ssti, stored_xss, unvalidated_redirect, version_control_systems, xpathi, xss, xxe, email_injection, insecure_output_handling, brute_force_login, common_files, directory_listing, jwt, improper_asset_management
• Group 2: 70 endpoints · tests: bopla, csrf, cve_test, full_path_disclosure, http_method_fuzzing, open_cloud_storage, proto_pollution, retire_js, secret_tokens, server_side_js_injection, sqli, ssti, version_control_systems, xpathi, xxe
• Group 3: 94 endpoints · tests: bopla, brute_force_login, csrf, cve_test, full_path_disclosure, http_method_fuzzing, jwt, open_cloud_storage, proto_pollution, retire_js, secret_tokens, server_side_js_injection, sqli, ssti, version_control_systems, xpathi, xxe, file_upload, lfi, rfi, css_injection, html_injection, iframe_injection, osi, prompt_injection, ssrf, stored_xss, unvalidated_redirect, xss, email_injection, excessive_data_exposure, id_enumeration, improper_asset_management, common_files, directory_listing
• Group 4: 100 endpoints · tests: bopla, csrf, css_injection, cve_test, email_injection, full_path_disclosure, html_injection, http_method_fuzzing, iframe_injection, lfi, open_cloud_storage, osi, prompt_injection, proto_pollution, retire_js, rfi, secret_tokens, server_side_js_injection, sqli, ssrf, ssti, stored_xss, unvalidated_redirect, version_control_systems, xpathi, xss, xxe
• Group 5: 100 endpoints · tests: csrf, cve_test, full_path_disclosure, http_method_fuzzing, open_cloud_storage, proto_pollution, retire_js, secret_tokens, server_side_js_injection, sqli, ssti, version_control_systems, xpathi, xxe
• Group 6: 100 endpoints · tests: bopla, csrf, cve_test, full_path_disclosure, http_method_fuzzing, open_cloud_storage, proto_pollution, retire_js, secret_tokens, server_side_js_injection, sqli, ssti, version_control_systems, xpathi, xxe
• Group 7: 100 endpoints · tests: bopla, csrf, cve_test, excessive_data_exposure, full_path_disclosure, http_method_fuzzing, id_enumeration, open_cloud_storage, proto_pollution, retire_js, secret_tokens, server_side_js_injection, sqli, ssti, version_control_systems, xpathi, xxe
• Group 8: 100 endpoints · tests: bopla, csrf, cve_test, excessive_data_exposure, full_path_disclosure, http_method_fuzzing, id_enumeration, open_cloud_storage, proto_pollution, retire_js, secret_tokens, server_side_js_injection, sqli, ssti, version_control_systems, xpathi, xxe
• Group 9: 108 endpoints · tests: bopla, common_files, csrf, cve_test, directory_listing, excessive_data_exposure, full_path_disclosure, http_method_fuzzing, id_enumeration, open_cloud_storage, proto_pollution, retire_js, secret_tokens, server_side_js_injection, sqli, ssti, version_control_systems, xpathi, xxe, css_injection, email_injection, html_injection, iframe_injection, lfi, osi, prompt_injection, rfi, ssrf, stored_xss, unvalidated_redirect, xss, file_upload, brute_force_login, jwt
• Group 10: 116 endpoints · tests: csrf, cve_test, full_path_disclosure, http_method_fuzzing, open_cloud_storage, proto_pollution, retire_js, secret_tokens, server_side_js_injection, sqli, ssti, version_control_systems, xpathi, xxe, bopla, excessive_data_exposure, id_enumeration, improper_asset_management, business_constraint_bypass, common_files, css_injection, directory_listing, email_injection, html_injection, iframe_injection, lfi, osi, prompt_injection, rfi, ssrf, stored_xss, unvalidated_redirect, xss, brute_force_login, jwt, insecure_output_handling, file_upload, date_manipulation