{"repo": "3zzzz-0x/bountycave", "files": {"cli/.env.example": {"93d5816abf110c92f259d24b3d873213132e8f24": {"t": 1786068542.408258, "n": 7666, "h": "240e4a2fbf5f59f1", "c": "################################################################################\n# BugTraceAI-CLI Environment Configuration\n# \n# LOCAL DEPLOYMENT ONLY - This is a private tool for your network\n# Copy this file to .env and configure for your setup:\n#   cp .env.example .env\n#   nano .env  # Add your API keys and customize\n#\n# ⚠️  WARNING: Do NOT expose this API to the internet without:\n#   - Authentication enabled\n#   - CORS restricted to known origins\n#   - Firewall rules limiting access\n################################################################################\n\n# ==============================================================================\n# SECTION 1: LLM PROVIDER CREDENTIALS (REQUIRED)\n# ==============================================================================\n\n# OpenRouter API Key (REQUIRED for scanning)\n# Get your key from: https://openrouter.ai/keys\n# Format: sk-or-v1-[64 hex characters]\n# Cost: Usage-based (pay per request via OpenRouter)\nOPENROUTER_API_KEY=sk-or-v1-your-api-key-here\n\n# GLM API Key (Optional - alternative LLM provider)\n# Get key from: https://open.bigmodel.cn/ (Zhipu AI)\n# Used as fallback if OpenRouter is unavailable\n# GLM_API_KEY=your-glm-api-key-here\n\n# ==============================================================================\n# SECTION 2: NETWORK & DEPLOYMENT (RECOMMENDED)\n# ==============================================================================\n\n# CORS Origins - Allowed frontend origins for API\n# Format: Comma-separated list of http://host:port\n# \n# LOCALHOST ONLY (Default - Recommended):\n#   BUGTRACE_CORS_ORIGINS=http://localhost:5173,http://localhost:3000\n#\n# LAN ACCESS (Within network only):\n#   BUGTRACE_CORS_ORIGINS=http://localhost:5173,http://192.168.1.50:5173,http://192.168.1.100:3000\n#\n# ⚠️  NEVER use wildcard (*) in production or LAN deployments\n# ⚠️  NEVER expose API port to internet without proxy authentication\n#\nBUGTRACE_CORS_ORIGINS=http://localhost:5173,http://localhost:3000,http://localhost:6869\n\n# API Server Binding\n# Set when using: python -m bugtrace serve\n# 127.0.0.1 = localhost only (most secure)\n# 0.0.0.0   = all interfaces (LAN access, less secure)\n#\n# API_HOST=127.0.0.1        # Localhost only\n# API_PORT=8000             # Default port\nAPI_HOST=127.0.0.1\nAPI_PORT=8000\n\n# ==============================================================================\n# SECTION 3: LLM MODEL SELECTION (OPTIONAL)\n# ==============================================================================\n\n# Format: provider/model-name (must use OpenRouter-compatible models)\n# OpenRouter supports: Qwen, Claude, DeepSeek, Gemini, Grok, etc.\n# See: https://openrouter.ai/docs#models\n\n# Main model for analysis & reasoning (default: Qwen)\n# DEFAULT_MODEL=qwen/qwen3-coder\n# CODE_MODEL=qwen/qwen3-coder\n# ANALYSIS_MODEL=qwen/qwen3-coder\n\n# Vision model for XSS screenshot validation (default: Gemini)\n# VISION_MODEL=google/gemini-3-flash-preview\n\n# Mutation model for payload generation (default: Grok - fewer safety restrictions)\n# MUTATION_MODEL=x-ai/grok-4-fast\n\n# Skeptical review model (quick review agent)\n# SKEPTICAL_MODEL=anthropic/claude-haiku-4.5\n\n# Reporting model (PoC generation, CVSS scoring)\n# REPORTING_MODEL=anthropic/claude-haiku-4.5\n\n# ==============================================================================\n# SECTION 4: RUNTIME BEHAVIOR (OPTIONAL)\n# ==============================================================================\n\n# Environment: development, staging, production\n# ENV=production\n\n# Debug mode (verbose logging)\n# DEBUG=false\n\n# Safe mode (limit aggressive payloads)\n# SAFE_MODE=false\n\n# Stop scanning after finding a critical vulnerability\n# STOP_ON_CRITICAL=true\n\n# Early exit when finding vulnerability on first parameter\n# EARLY_EXIT_ON_FINDING=false\n\n# ==============================================================================\n# SECTION 5: PARALLELIZATION & PERFORMANCE (OPTIONAL)\n# ==============================================================================\n\n# Max concurrent DAST analysis per discovery phase\n# Higher = faster but more resource usage\n# MAX_CONCURRENT_DISCOVERY=5\n\n# Max concurrent specialist agents (XSS/SQLi/etc)\n# MAX_CONCURRENT_SPECIALISTS=10\n\n# Worker pool size per agent\n# WORKER_POOL_DEFAULT_SIZE=5\n# WORKER_POOL_XSS_SIZE=8\n\n# ==============================================================================\n# SECTION 6: VALIDATION & FILTERING (OPTIONAL)\n# ==============================================================================\n\n# Enable vision-based XSS validation (requires VISION_MODEL)\n# VALIDATION_VISION_ENABLED=true\n\n# Use Chrome DevTools Protocol for XSS validation\n# CDP_ENABLED=true\n\n# False positive confidence threshold (0.0-1.0)\n# Lower = more findings (more false positives)\n# Higher = fewer findings (may miss true issues)\n# FP_CONFIDENCE_THRESHOLD=0.5\n\n# Consensus votes required for finding acceptance\n# 1 = Fastest, 2-3 = More accurate\n# CONSENSUS_VOTES=2\n\n# ==============================================================================\n# SECTION 7: SECURITY SCANNING BEHAVIOR (OPTIONAL)\n# ==============================================================================\n\n# Mandatory SQLMap validation (always test SQL injection)\n# MANDATORY_SQLMAP_VALIDATION=true\n\n# Skip already-validated parameters in same scan\n# SKIP_VALIDATED_PARAMS=true\n\n# Scan depth: quick, standard, thorough\n# SCAN_DEPTH=standard\n\n# Allow self-signed SSL certificates\n# ALLOW_SELF_SIGNED_CERTS=false\n\n# Verify SSL certificates\n# VERIFY_SSL_CERTIFICATES=true\n\n# ==============================================================================\n# SECTION 8: OUT-OF-BAND (OOB) CALLBACKS (OPTIONAL)\n# ==============================================================================\n\n# OOB platform for SSRF/XXE/etc callbacks\n# interactsh.com (default), oast.fun, etc.\n# INTERACTSH_SERVER=oast.fun\n\n# Poll interval for OOB callbacks (seconds)\n# INTERACTSH_POLL_INTERVAL=60\n\n# ==============================================================================\n# SECTION 9: ADVANCED / INTERNAL (RARELY CHANGED)\n# ==============================================================================\n\n# Queue persistence mode: memory (default) or redis (future)\n# QUEUE_PERSISTENCE_MODE=memory\n\n# Max queue depth per specialist\n# QUEUE_DEFAULT_MAX_DEPTH=1000\n\n# Request rate limit per queue (items/second)\n# 0 = unlimited\n# QUEUE_DEFAULT_RATE_LIMIT=100.0\n\n# Thinking mode: streaming (default) or batch\n# THINKING_MODE=streaming\n\n# Batch processing concurrency\n# BATCH_DAST_CONCURRENCY=5\n\n################################################################################\n# QUICK START CHECKLISTS\n################################################################################\n\n# ✅ Minimal Setup (Just scan):\n#   1. Add OPENROUTER_API_KEY\n#   2. Leave rest as default\n#   3. Run: python -m bugtrace scan https://example.com\n\n# ✅ Local Dev with Web UI:\n#   1. Add OPENROUTER_API_KEY\n#   2. Set BUGTRACE_CORS_ORIGINS to your frontend ports\n#   3. Run API: python -m bugtrace serve\n#   4. Access: http://localhost:8000/docs\n\n# ✅ LAN-Only Deployment:\n#   1. Add OPENROUTER_API_KEY\n#   2. Set API_HOST=0.0.0.0 (enable LAN)\n#   3. Set BUGTRACE_CORS_ORIGINS with all LAN IPs\n#   4. Run API: python -m bugtrace serve --host 0.0.0.0\n#   5. Access from other machines: http://HOST_IP:8000\n\n# ⚠️  SECURITY REMINDERS:\n#   - Keep API keys private (never commit .env)\n#   - Don't expose API to internet without authentication\n#   - Use HTTPS in production (requires reverse proxy)\n#   - Rotate API keys regularly\n#   - Monitor resource usage (agents consume CPU)\n\n################################################################################\n"}}}}