Metadata-Version: 2.4
Name: ersec
Version: 29.1.2
Summary: Evidence-driven application security platform with Security Behavior Graphs, contracts, control plane, and runtime Shield
Author: ERSEC Project
License-Expression: MIT
Project-URL: Homepage, https://github.com/ermitr/ersec
Project-URL: Repository, https://github.com/ermitr/ersec.git
Project-URL: Documentation, https://github.com/ermitr/ersec#readme
Project-URL: Issues, https://github.com/ermitr/ersec/issues
Project-URL: Changelog, https://github.com/ermitr/ersec/blob/main/CHANGELOG.md
Project-URL: Security, https://github.com/ermitr/ersec/security/policy
Keywords: application-security,appsec,web-security,api-security,waf,security-testing,authorization,business-logic,devsecops,scanner
Classifier: Development Status :: 4 - Beta
Classifier: Environment :: Console
Classifier: Intended Audience :: Information Technology
Classifier: Intended Audience :: System Administrators
Classifier: Intended Audience :: Developers
Classifier: Operating System :: POSIX
Classifier: Programming Language :: Python :: 3
Classifier: Programming Language :: Python :: 3 :: Only
Classifier: Programming Language :: Python :: 3.11
Classifier: Programming Language :: Python :: 3.12
Classifier: Programming Language :: Python :: 3.13
Classifier: Programming Language :: Python :: 3.14
Classifier: Topic :: Security
Requires-Python: >=3.11
Description-Content-Type: text/markdown
License-File: LICENSE
Requires-Dist: requests<3,>=2.31
Requires-Dist: urllib3<3,>=2.0
Requires-Dist: beautifulsoup4<5,>=4.12
Requires-Dist: PyYAML<7,>=6
Requires-Dist: defusedxml<1,>=0.7.1
Provides-Extra: rich
Requires-Dist: rich<15,>=13; extra == "rich"
Provides-Extra: browser
Requires-Dist: playwright<2,>=1.40; extra == "browser"
Provides-Extra: llm
Requires-Dist: llama-cpp-python<1,>=0.2; extra == "llm"
Provides-Extra: dev
Requires-Dist: build<3,>=1; extra == "dev"
Requires-Dist: twine<7,>=6; extra == "dev"
Requires-Dist: pytest<9,>=8; extra == "dev"
Dynamic: license-file

# ERSEC 29.1.2 — Professional Security Assessment Platform

ERSEC is a defensive application-security platform designed for authorized web and API assessments. It transforms traditional scanning into a mature, evidence-driven assurance process: **reviewed security intent $\rightarrow$ bounded multi-principal assurance $\rightarrow$ semantic evidence $\rightarrow$ explicit uncertainty $\rightarrow$ regression contract $\rightarrow$ release decision**.

## 🚀 What's New in 29.1.2 (Production Ready)

This release marks the transition to a professional, Kali-ready platform with a focus on reliability, discoverability, and deterministic proof.

### 🛠️ Professional Command Center
The CLI has been redesigned from a flat flag-based system to a modular subcommand architecture:
- `ersec scan`: Perform target scans (including the new `--all` max-intensity profile).
- `ersec discover`: Build attack-surface inventory.
- `ersec policy`: Manage and validate security policies.
- `ersec assure`: Run authorization and workflow assurance tests.
- `ersec agent`: Inspect AI agents and MCP posture.
- `ersec report`: Generate and regenerate professional evidence dashboards.
- `ersec benchmark`: Run reproducible evaluation suites.
- `ersec doctor`: Diagnose installation and environment health.

### ⚡ Max-Intensity Scanning (`--all`)
The new `ScanProfile.MAX` profile activates "Deep" detectors for high-impact vulnerabilities, including:
- **Deep SQLi**: Time-based blind injection across multiple DB engines.
- **Deep SSRF**: Out-of-band callback detection.
- **Deep RCE**: Command injection across OS boundaries.
- **Deep LFI**: Local file inclusion checks for sensitive system artifacts.
- **Deep XSS**: Blind XSS via callback triggers.

### 📊 Evidence-First Dashboard
A professional, multi-tab HTML dashboard replaces the flat report, providing a SOC-style overview:
- **Executive Overview**: Posture grade, risk distribution, and business impact.
- **Risk & Findings**: Filterable ledger with AI-powered remediation analysis.
- **Attack Surface**: Detailed inventory of discovered pages, forms, and endpoints.
- **Evidence Explorer**: Integrated visual proof via automated screenshots.

### 📸 Automated Visual Proof
ERSEC now integrates headless browser automation to capture high-fidelity screenshots of critical findings. Evidence is linked directly in the dashboard, providing deterministic proof of a vulnerability's existence.

---

## 🏛️ Core Architecture

ERSEC is built on the principle that a finding is not a claim, but a proven observation.

### 1. Security Behavior Graph
Instead of a flat list of bugs, ERSEC builds a semantic map of your application:
`Identity` $\rightarrow$ `Resource/Route` $\rightarrow$ `Finding` $\rightarrow$ `Invariant Violation`

### 2. Security Behavior Assurance
Move from inferred behavior to operator-declared models. Define your identities, roles, and expected access patterns in a YAML policy, and let ERSEC prove the reality.

### 3. The Assurance Kernel
A deterministic engine that compiles a "Security Constitution" into proof obligations. Release decisions are based on explicit evidence, not the absence of a finding.

### 4. ERSEC Shield
A professional application-layer enforcement point (reverse proxy) that allows you to apply virtual patches and positive-security envelopes based on the evidence discovered during scans.

---

## 📖 Quick Start

### Installation
```bash
python3 -m venv .venv
source .venv/bin/activate
pip install ersec
# Optional: Install browser automation for screenshots
pip install "ersec[browser]"
playwright install chromium
```

### Basic Scan
```bash
ersec scan -t https://example.com
```

### High-Intensity Assessment
```bash
ersec scan -t https://example.com --profile max --html report.html
```

### Authorization Benchmark
```bash
ersec benchmark --authorization-benchmark result.json
```

---

## 🛡️ Safety & Ethics

ERSEC is designed for **authorized, bounded, and non-destructive testing**.
- **Scope Enforcement**: Strict host, port, and path boundaries.
- **Risk Budgeting**: Capped request counts to prevent DoS.
- **No Destructive Payloads**: Does not automate data exfiltration, persistence, or remote shell acquisition.

**Legal Notice:** Only scan systems you own or have explicit written authorization to test.

---

## 📈 Versioning & Maturity
ERSEC follows a conventional release model. Current stable version: **29.1.2**.
For a detailed list of changes, see [CHANGELOG.md](CHANGELOG.md).
