{"repo": "btr4k/bugbounty-agent", "files": {"config.yaml": {"b25b64ac6467e86a8b25a1a44557a4640ad6cfcf": {"t": 1785745200.6771472, "n": 4812, "h": "08e42a33f86b1e25", "c": "# Bug Bounty AI Agent Configuration\n\n# ═══════════════════════════════════════════════════════\n# AI Provider Configuration\n# Supported: claude | deepseek | openai | openrouter | custom\n# ═══════════════════════════════════════════════════════\nai:\n  provider: \"auto\"                  # auto = detect from .env (claude/deepseek/openai/openrouter)\n  api_key: \"\"                       # Leave empty — key is read from .env automatically\n  model: \"\"                         # Leave empty for provider default\n  max_tokens: 2000\n  base_url: \"\"                     # Only needed for openrouter/custom\n  timeout: 300                      # Per-request HTTP timeout (seconds). Raise for slow providers/large JS batches\n\n# Provider presets (just change 'provider' and 'api_key'):\n# ┌─────────────┬──────────────────────────┬────────────────────────────┬──────────────┐\n# │ Provider    │ Model (default)          │ Env Variable               │ Cost/1M tok  │\n# ├─────────────┼──────────────────────────┼────────────────────────────┼──────────────┤\n# │ claude      │ claude-sonnet-4-20250514 │ ANTHROPIC_API_KEY          │ $3/$15       │\n# │ deepseek    │ deepseek-chat            │ DEEPSEEK_API_KEY           │ $0.28/$0.42  │\n# │ openai      │ gpt-4o-mini              │ OPENAI_API_KEY             │ $0.15/$0.60  │\n# │ openrouter  │ deepseek/deepseek-chat   │ OPENROUTER_API_KEY         │ varies       │\n# │ custom      │ (must specify)           │ AI_API_KEY                 │ varies       │\n# └─────────────┴──────────────────────────┴────────────────────────────┴──────────────┘\n\n# Legacy Claude config (backward compatibility - used if ai.api_key is empty)\nclaude:\n  api_key: \"${ANTHROPIC_API_KEY}\"\n  model: \"claude-sonnet-4-20250514\"\n  max_tokens: 2000\n\n# C99.nl API Intelligence\nc99:\n  api_key: \"${C99_API_KEY}\"\n  enabled: true\n\n# Target Configuration\ntarget:\n  domains: []\n  excluded_subdomains: []\n\n# Optional authenticated testing. Use only accounts and sessions you own.\n# Values are expanded from environment variables and redacted from AI prompts\n# and reports. Avoid placing literal credentials in this file.\nauthentication:\n  # Required when headers or cookies are configured. Credentials are injected\n  # only when every target in a tool invocation matches this allowlist.\n  allowed_hosts: []\n  # Example:\n  #   - \"app.example.com\"\n  #   - \"*.api.example.com\"\n  headers: {}\n  # Example:\n  #   Authorization: \"Bearer ${TARGET_TOKEN}\"\n  cookies: {}\n  # Example:\n  #   session: \"${TARGET_SESSION}\"\n\n# Reconnaissance Settings\nrecon:\n  enabled: true\n  timeout: 300 # seconds\n  max_subdomains: 1000\n  max_wayback_urls: 10000 # prevent OOM for large domains\n  tools:\n    subfinder: true\n    assetfinder: true\n    wayback: true\n    katana: true  # JS file extraction crawler\n    cert_transparency: true\n\n# Scanning Settings\n#\n# Active scanners run SEQUENTIALLY (nuclei → dalfox), never in parallel. Running\n# several heavy scanners at once on a modest host exhausts memory and the OOM\n# killer terminates them mid-scan. One scanner at a time finishes reliably.\nscanning:\n  enabled: true\n  threads: 40  # Balanced default for reliable scans on modest servers\n  timeout: 1200  # 20-minute budget for the nuclei high-value scan (runs alone)\n  # Requests/sec ceiling. At 50 a full scan of ~1300 templates × dozens of hosts\n  # could not finish inside the budget (≈57 min of requests). 150 is Nuclei's own\n  # default and completes the scan with margin. Lower it for strict programs.\n  rate_limit: 150\n  tools:\n    nuclei:\n      enabled: true\n      severity: []  # Empty runs actionable severities: critical, high, medium, low\n      # High-signal profile. \"misconfig\" (≈800 templates) was dropped: it nearly\n      # doubled request volume without producing confirmed findings here. Add it\n      # back if your host and the program's rate limits allow a longer scan.\n      tags: [\"exposure\", \"takeover\", \"default-login\"]\n      templates_path: \"\" # Empty uses Nuclei's installed templates\n    httpx:\n      enabled: true\n      follow_redirects: true\n      status_code: true\n    dalfox:\n      enabled: true\n      blind_url: \"\"  # Optional: blind XSS callback URL (e.g. https://your-burp-collaborator)\n      max_urls: 75   # Parameterized URLs to fuzz for reflected XSS\n    nmap:\n      enabled: false # Open ports alone are reconnaissance, not confirmed vulnerabilities\n      ports: \"21,22,25,53,80,110,143,443,445,993,995,3000,3306,5432,6379,8000,8080,8443,8888,9090,9200,27017\"\n      fast_scan: true\n# AI Analysis\nanalysis:\n  min_confidence: 0.85 # Findings below this require manual confirmation and are not reported\n  js_analysis: true  # AI-powered JS file analysis\n\n# Reporting\nreporting:\n  include_poc: true\n  severity_filter: []  # Optional actionable severities: critical, high, medium, low\n  output_dir: \"./reports\"\n"}, "bad05863b51bea22ca612fd10fa2588e7059e51a": {"t": 1785748579.658009, "n": 4812, "h": "08e42a33f86b1e25", "c": "# Bug Bounty AI Agent Configuration\n\n# ═══════════════════════════════════════════════════════\n# AI Provider Configuration\n# Supported: claude | deepseek | openai | openrouter | custom\n# ═══════════════════════════════════════════════════════\nai:\n  provider: \"auto\"                  # auto = detect from .env (claude/deepseek/openai/openrouter)\n  api_key: \"\"                       # Leave empty — key is read from .env automatically\n  model: \"\"                         # Leave empty for provider default\n  max_tokens: 2000\n  base_url: \"\"                     # Only needed for openrouter/custom\n  timeout: 300                      # Per-request HTTP timeout (seconds). Raise for slow providers/large JS batches\n\n# Provider presets (just change 'provider' and 'api_key'):\n# ┌─────────────┬──────────────────────────┬────────────────────────────┬──────────────┐\n# │ Provider    │ Model (default)          │ Env Variable               │ Cost/1M tok  │\n# ├─────────────┼──────────────────────────┼────────────────────────────┼──────────────┤\n# │ claude      │ claude-sonnet-4-20250514 │ ANTHROPIC_API_KEY          │ $3/$15       │\n# │ deepseek    │ deepseek-chat            │ DEEPSEEK_API_KEY           │ $0.28/$0.42  │\n# │ openai      │ gpt-4o-mini              │ OPENAI_API_KEY             │ $0.15/$0.60  │\n# │ openrouter  │ deepseek/deepseek-chat   │ OPENROUTER_API_KEY         │ varies       │\n# │ custom      │ (must specify)           │ AI_API_KEY                 │ varies       │\n# └─────────────┴──────────────────────────┴────────────────────────────┴──────────────┘\n\n# Legacy Claude config (backward compatibility - used if ai.api_key is empty)\nclaude:\n  api_key: \"${ANTHROPIC_API_KEY}\"\n  model: \"claude-sonnet-4-20250514\"\n  max_tokens: 2000\n\n# C99.nl API Intelligence\nc99:\n  api_key: \"${C99_API_KEY}\"\n  enabled: true\n\n# Target Configuration\ntarget:\n  domains: []\n  excluded_subdomains: []\n\n# Optional authenticated testing. Use only accounts and sessions you own.\n# Values are expanded from environment variables and redacted from AI prompts\n# and reports. Avoid placing literal credentials in this file.\nauthentication:\n  # Required when headers or cookies are configured. Credentials are injected\n  # only when every target in a tool invocation matches this allowlist.\n  allowed_hosts: []\n  # Example:\n  #   - \"app.example.com\"\n  #   - \"*.api.example.com\"\n  headers: {}\n  # Example:\n  #   Authorization: \"Bearer ${TARGET_TOKEN}\"\n  cookies: {}\n  # Example:\n  #   session: \"${TARGET_SESSION}\"\n\n# Reconnaissance Settings\nrecon:\n  enabled: true\n  timeout: 300 # seconds\n  max_subdomains: 1000\n  max_wayback_urls: 10000 # prevent OOM for large domains\n  tools:\n    subfinder: true\n    assetfinder: true\n    wayback: true\n    katana: true  # JS file extraction crawler\n    cert_transparency: true\n\n# Scanning Settings\n#\n# Active scanners run SEQUENTIALLY (nuclei → dalfox), never in parallel. Running\n# several heavy scanners at once on a modest host exhausts memory and the OOM\n# killer terminates them mid-scan. One scanner at a time finishes reliably.\nscanning:\n  enabled: true\n  threads: 40  # Balanced default for reliable scans on modest servers\n  timeout: 1200  # 20-minute budget for the nuclei high-value scan (runs alone)\n  # Requests/sec ceiling. At 50 a full scan of ~1300 templates × dozens of hosts\n  # could not finish inside the budget (≈57 min of requests). 150 is Nuclei's own\n  # default and completes the scan with margin. Lower it for strict programs.\n  rate_limit: 150\n  tools:\n    nuclei:\n      enabled: true\n      severity: []  # Empty runs actionable severities: critical, high, medium, low\n      # High-signal profile. \"misconfig\" (≈800 templates) was dropped: it nearly\n      # doubled request volume without producing confirmed findings here. Add it\n      # back if your host and the program's rate limits allow a longer scan.\n      tags: [\"exposure\", \"takeover\", \"default-login\"]\n      templates_path: \"\" # Empty uses Nuclei's installed templates\n    httpx:\n      enabled: true\n      follow_redirects: true\n      status_code: true\n    dalfox:\n      enabled: true\n      blind_url: \"\"  # Optional: blind XSS callback URL (e.g. https://your-burp-collaborator)\n      max_urls: 75   # Parameterized URLs to fuzz for reflected XSS\n    nmap:\n      enabled: false # Open ports alone are reconnaissance, not confirmed vulnerabilities\n      ports: \"21,22,25,53,80,110,143,443,445,993,995,3000,3306,5432,6379,8000,8080,8443,8888,9090,9200,27017\"\n      fast_scan: true\n# AI Analysis\nanalysis:\n  min_confidence: 0.85 # Findings below this require manual confirmation and are not reported\n  js_analysis: true  # AI-powered JS file analysis\n\n# Reporting\nreporting:\n  include_poc: true\n  severity_filter: []  # Optional actionable severities: critical, high, medium, low\n  output_dir: \"./reports\"\n"}, "50ae59b7a87199dc974a3d1dfc63b3e7ef9c66be": {"t": 1785748580.7584336, "n": 5095, "h": "46f485ad1b209075", "c": "# Bug Bounty AI Agent Configuration\n\n# ═══════════════════════════════════════════════════════\n# AI Provider Configuration\n# Supported: claude | deepseek | openai | openrouter | custom\n# ═══════════════════════════════════════════════════════\nai:\n  provider: \"auto\"                  # auto = detect from .env (claude/deepseek/openai/openrouter)\n  api_key: \"\"                       # Leave empty — key is read from .env automatically\n  model: \"\"                         # Leave empty for provider default\n  max_tokens: 2000\n  base_url: \"\"                     # Only needed for openrouter/custom\n  timeout: 300                      # Per-request HTTP timeout (seconds). Raise for slow providers/large JS batches\n\n# Provider presets (just change 'provider' and 'api_key'):\n# ┌─────────────┬──────────────────────────┬────────────────────────────┬──────────────┐\n# │ Provider    │ Model (default)          │ Env Variable               │ Cost/1M tok  │\n# ├─────────────┼──────────────────────────┼────────────────────────────┼──────────────┤\n# │ claude      │ claude-sonnet-4-20250514 │ ANTHROPIC_API_KEY          │ $3/$15       │\n# │ deepseek    │ deepseek-chat            │ DEEPSEEK_API_KEY           │ $0.28/$0.42  │\n# │ openai      │ gpt-4o-mini              │ OPENAI_API_KEY             │ $0.15/$0.60  │\n# │ openrouter  │ deepseek/deepseek-chat   │ OPENROUTER_API_KEY         │ varies       │\n# │ custom      │ (must specify)           │ AI_API_KEY                 │ varies       │\n# └─────────────┴──────────────────────────┴────────────────────────────┴──────────────┘\n\n# Legacy Claude config (backward compatibility - used if ai.api_key is empty)\nclaude:\n  api_key: \"${ANTHROPIC_API_KEY}\"\n  model: \"claude-sonnet-4-20250514\"\n  max_tokens: 2000\n\n# C99.nl API Intelligence\nc99:\n  api_key: \"${C99_API_KEY}\"\n  enabled: true\n\n# Target Configuration\ntarget:\n  domains: []\n  excluded_subdomains: []\n\n# Optional authenticated testing. Use only accounts and sessions you own.\n# Values are expanded from environment variables and redacted from AI prompts\n# and reports. Avoid placing literal credentials in this file.\nauthentication:\n  # Required when headers or cookies are configured. Credentials are injected\n  # only when every target in a tool invocation matches this allowlist.\n  allowed_hosts: []\n  # Example:\n  #   - \"app.example.com\"\n  #   - \"*.api.example.com\"\n  headers: {}\n  # Example:\n  #   Authorization: \"Bearer ${TARGET_TOKEN}\"\n  cookies: {}\n  # Example:\n  #   session: \"${TARGET_SESSION}\"\n\n# Reconnaissance Settings\nrecon:\n  enabled: true\n  timeout: 300 # seconds\n  max_subdomains: 1000\n  max_wayback_urls: 10000 # prevent OOM for large domains\n  tools:\n    subfinder: true\n    assetfinder: true\n    wayback: true\n    katana: true  # JS file extraction crawler\n    cert_transparency: true\n\n# Scanning Settings\nscanning:\n  enabled: true\n  threads: 40  # Balanced default for reliable scans on modest servers\n  timeout: 1200  # 20 minutes for high-priority templates\n  rate_limit: 50 # Per-tool ceiling; lower this to match program rules\n  tools:\n    nuclei:\n      enabled: true\n      severity: []  # Empty runs actionable severities: critical, high, medium, low\n      tags: [\"exposure\", \"misconfig\", \"takeover\", \"default-login\"] # High-signal default profile\n      templates_path: \"\" # Empty uses Nuclei's installed templates\n    httpx:\n      enabled: true\n      follow_redirects: true\n      status_code: true\n    nmap:\n      enabled: false # Open ports alone are reconnaissance, not confirmed vulnerabilities\n      ports: \"21,22,25,53,80,110,143,443,445,993,995,3000,3306,5432,6379,8000,8080,8443,8888,9090,9200,27017\"\n      fast_scan: true\n    dalfox:\n      enabled: true\n      blind_url: \"\"  # Optional: blind XSS callback URL (e.g. https://your-burp-collaborator)\n      max_urls: 100  # Increased for better XSS coverage\n    ffuf:\n      enabled: true\n      # Wordlist search order (first found wins):\n      #   1. This value (if set)\n      #   2. /usr/share/seclists/Discovery/Web-Content/common.txt\n      #   3. /usr/share/wordlists/dirb/common.txt\n      #   4. /opt/SecLists/Discovery/Web-Content/common.txt\n      #   5. Built-in ~130 high-value paths (fallback — limited coverage)\n      # Recommended: apt install seclists  OR  set full path below\n      wordlist_path: \"\"\n      max_targets: 20    # Top N hosts to path-bruteforce (scored by importance)\n      vhost_fuzzing: false # Discovery-only; enable manually when needed\n    sqli:\n      enabled: true      # Uses focused Nuclei SQLi templates and parameter filtering\n      max_urls: 50       # Max gf-filtered param URLs to test\n    arjun:\n      enabled: true      # Hidden parameter discovery — feeds discovered params into dalfox\n      max_targets: 15    # Top N hosts to discover hidden params on\n# AI Analysis\nanalysis:\n  min_confidence: 0.85 # Findings below this require manual confirmation and are not reported\n  js_analysis: true  # AI-powered JS file analysis\n\n# Reporting\nreporting:\n  include_poc: true\n  severity_filter: []  # Optional actionable severities: critical, high, medium, low\n  output_dir: \"./reports\"\n"}, "75aa7cb5a117cd4a2c2a5864086b4fc3bd0aee5f": {"t": 1785748581.8288908, "n": 4998, "h": "f3732ae3b54f189a", "c": "# Bug Bounty AI Agent Configuration\n\n# ═══════════════════════════════════════════════════════\n# AI Provider Configuration\n# Supported: claude | deepseek | openai | openrouter | custom\n# ═══════════════════════════════════════════════════════\nai:\n  provider: \"auto\"                  # auto = detect from .env (claude/deepseek/openai/openrouter)\n  api_key: \"\"                       # Leave empty — key is read from .env automatically\n  model: \"\"                         # Leave empty for provider default\n  max_tokens: 2000\n  base_url: \"\"                     # Only needed for openrouter/custom\n  timeout: 300                      # Per-request HTTP timeout (seconds). Raise for slow providers/large JS batches\n\n# Provider presets (just change 'provider' and 'api_key'):\n# ┌─────────────┬──────────────────────────┬────────────────────────────┬──────────────┐\n# │ Provider    │ Model (default)          │ Env Variable               │ Cost/1M tok  │\n# ├─────────────┼──────────────────────────┼────────────────────────────┼──────────────┤\n# │ claude      │ claude-sonnet-4-20250514 │ ANTHROPIC_API_KEY          │ $3/$15       │\n# │ deepseek    │ deepseek-chat            │ DEEPSEEK_API_KEY           │ $0.28/$0.42  │\n# │ openai      │ gpt-4o-mini              │ OPENAI_API_KEY             │ $0.15/$0.60  │\n# │ openrouter  │ deepseek/deepseek-chat   │ OPENROUTER_API_KEY         │ varies       │\n# │ custom      │ (must specify)           │ AI_API_KEY                 │ varies       │\n# └─────────────┴──────────────────────────┴────────────────────────────┴──────────────┘\n\n# Legacy Claude config (backward compatibility - used if ai.api_key is empty)\nclaude:\n  api_key: \"${ANTHROPIC_API_KEY}\"\n  model: \"claude-sonnet-4-20250514\"\n  max_tokens: 2000\n\n# C99.nl API Intelligence\nc99:\n  api_key: \"${C99_API_KEY}\"\n  enabled: true\n\n# Target Configuration\ntarget:\n  domains: []\n  excluded_subdomains: []\n\n# Optional authenticated testing. Use only accounts and sessions you own.\n# Values are expanded from environment variables and redacted from AI prompts\n# and reports. Avoid placing literal credentials in this file.\nauthentication:\n  # Required when headers or cookies are configured. Credentials are injected\n  # only when every target in a tool invocation matches this allowlist.\n  allowed_hosts: []\n  # Example:\n  #   - \"app.example.com\"\n  #   - \"*.api.example.com\"\n  headers: {}\n  # Example:\n  #   Authorization: \"Bearer ${TARGET_TOKEN}\"\n  cookies: {}\n  # Example:\n  #   session: \"${TARGET_SESSION}\"\n\n# Reconnaissance Settings\nrecon:\n  enabled: true\n  timeout: 300 # seconds\n  max_subdomains: 1000\n  max_wayback_urls: 10000 # prevent OOM for large domains\n  tools:\n    subfinder: true\n    assetfinder: true\n    wayback: true\n    katana: true  # JS file extraction crawler\n    cert_transparency: true\n\n# Scanning Settings\nscanning:\n  enabled: true\n  threads: 40  # Balanced default for reliable scans on modest servers\n  timeout: 1200  # 20 minutes for high-priority templates\n  rate_limit: 50 # Per-tool ceiling; lower this to match program rules\n  tools:\n    nuclei:\n      enabled: true\n      severity: []  # Empty runs actionable severities: critical, high, medium, low\n      templates_path: \"\" # Empty uses Nuclei's installed templates\n    httpx:\n      enabled: true\n      follow_redirects: true\n      status_code: true\n    nmap:\n      enabled: false # Open ports alone are reconnaissance, not confirmed vulnerabilities\n      ports: \"21,22,25,53,80,110,143,443,445,993,995,3000,3306,5432,6379,8000,8080,8443,8888,9090,9200,27017\"\n      fast_scan: true\n    dalfox:\n      enabled: true\n      blind_url: \"\"  # Optional: blind XSS callback URL (e.g. https://your-burp-collaborator)\n      max_urls: 100  # Increased for better XSS coverage\n    ffuf:\n      enabled: true\n      # Wordlist search order (first found wins):\n      #   1. This value (if set)\n      #   2. /usr/share/seclists/Discovery/Web-Content/common.txt\n      #   3. /usr/share/wordlists/dirb/common.txt\n      #   4. /opt/SecLists/Discovery/Web-Content/common.txt\n      #   5. Built-in ~130 high-value paths (fallback — limited coverage)\n      # Recommended: apt install seclists  OR  set full path below\n      wordlist_path: \"\"\n      max_targets: 20    # Top N hosts to path-bruteforce (scored by importance)\n      vhost_fuzzing: false # Discovery-only; enable manually when needed\n    sqli:\n      enabled: true      # Uses focused Nuclei SQLi templates and parameter filtering\n      max_urls: 50       # Max gf-filtered param URLs to test\n    arjun:\n      enabled: true      # Hidden parameter discovery — feeds discovered params into dalfox\n      max_targets: 15    # Top N hosts to discover hidden params on\n# AI Analysis\nanalysis:\n  min_confidence: 0.85 # Findings below this require manual confirmation and are not reported\n  js_analysis: true  # AI-powered JS file analysis\n\n# Reporting\nreporting:\n  include_poc: true\n  severity_filter: []  # Optional actionable severities: critical, high, medium, low\n  output_dir: \"./reports\"\n"}, "72391219d44962305c54cc3acf8087c2cb28c73f": {"t": 1785748582.9020936, "n": 5001, "h": "d2a23fcd9d614232", "c": "# Bug Bounty AI Agent Configuration\n\n# ═══════════════════════════════════════════════════════\n# AI Provider Configuration\n# Supported: claude | deepseek | openai | openrouter | custom\n# ═══════════════════════════════════════════════════════\nai:\n  provider: \"auto\"                  # auto = detect from .env (claude/deepseek/openai/openrouter)\n  api_key: \"\"                       # Leave empty — key is read from .env automatically\n  model: \"\"                         # Leave empty for provider default\n  max_tokens: 2000\n  base_url: \"\"                     # Only needed for openrouter/custom\n  timeout: 300                      # Per-request HTTP timeout (seconds). Raise for slow providers/large JS batches\n\n# Provider presets (just change 'provider' and 'api_key'):\n# ┌─────────────┬──────────────────────────┬────────────────────────────┬──────────────┐\n# │ Provider    │ Model (default)          │ Env Variable               │ Cost/1M tok  │\n# ├─────────────┼──────────────────────────┼────────────────────────────┼──────────────┤\n# │ claude      │ claude-sonnet-4-20250514 │ ANTHROPIC_API_KEY          │ $3/$15       │\n# │ deepseek    │ deepseek-chat            │ DEEPSEEK_API_KEY           │ $0.28/$0.42  │\n# │ openai      │ gpt-4o-mini              │ OPENAI_API_KEY             │ $0.15/$0.60  │\n# │ openrouter  │ deepseek/deepseek-chat   │ OPENROUTER_API_KEY         │ varies       │\n# │ custom      │ (must specify)           │ AI_API_KEY                 │ varies       │\n# └─────────────┴──────────────────────────┴────────────────────────────┴──────────────┘\n\n# Legacy Claude config (backward compatibility - used if ai.api_key is empty)\nclaude:\n  api_key: \"${ANTHROPIC_API_KEY}\"\n  model: \"claude-sonnet-4-20250514\"\n  max_tokens: 2000\n\n# C99.nl API Intelligence\nc99:\n  api_key: \"${C99_API_KEY}\"\n  enabled: true\n\n# Target Configuration\ntarget:\n  domains: []\n  excluded_subdomains: []\n\n# Optional authenticated testing. Use only accounts and sessions you own.\n# Values are expanded from environment variables and redacted from AI prompts\n# and reports. Avoid placing literal credentials in this file.\nauthentication:\n  # Required when headers or cookies are configured. Credentials are injected\n  # only when every target in a tool invocation matches this allowlist.\n  allowed_hosts: []\n  # Example:\n  #   - \"app.example.com\"\n  #   - \"*.api.example.com\"\n  headers: {}\n  # Example:\n  #   Authorization: \"Bearer ${TARGET_TOKEN}\"\n  cookies: {}\n  # Example:\n  #   session: \"${TARGET_SESSION}\"\n\n# Reconnaissance Settings\nrecon:\n  enabled: true\n  timeout: 300 # seconds\n  max_subdomains: 1000\n  max_wayback_urls: 10000 # prevent OOM for large domains\n  tools:\n    subfinder: true\n    assetfinder: true\n    wayback: true\n    katana: true  # JS file extraction crawler\n    cert_transparency: true\n\n# Scanning Settings\nscanning:\n  enabled: true\n  threads: 40  # Balanced default for reliable scans on modest servers\n  timeout: 1200  # 20 minutes for high-priority templates\n  rate_limit: 50 # Per-tool ceiling; lower this to match program rules\n  tools:\n    nuclei:\n      enabled: true\n      severity: []  # No filter - run all templates, findings keep their real severity\n      templates_path: \"\" # Empty uses Nuclei's installed templates\n    httpx:\n      enabled: true\n      follow_redirects: true\n      status_code: true\n    nmap:\n      enabled: false # Open ports alone are reconnaissance, not confirmed vulnerabilities\n      ports: \"21,22,25,53,80,110,143,443,445,993,995,3000,3306,5432,6379,8000,8080,8443,8888,9090,9200,27017\"\n      fast_scan: true\n    dalfox:\n      enabled: true\n      blind_url: \"\"  # Optional: blind XSS callback URL (e.g. https://your-burp-collaborator)\n      max_urls: 100  # Increased for better XSS coverage\n    ffuf:\n      enabled: true\n      # Wordlist search order (first found wins):\n      #   1. This value (if set)\n      #   2. /usr/share/seclists/Discovery/Web-Content/common.txt\n      #   3. /usr/share/wordlists/dirb/common.txt\n      #   4. /opt/SecLists/Discovery/Web-Content/common.txt\n      #   5. Built-in ~130 high-value paths (fallback — limited coverage)\n      # Recommended: apt install seclists  OR  set full path below\n      wordlist_path: \"\"\n      max_targets: 20    # Top N hosts to path-bruteforce (scored by importance)\n      vhost_fuzzing: false # Discovery-only; enable manually when needed\n    sqli:\n      enabled: true      # Uses focused Nuclei SQLi templates and parameter filtering\n      max_urls: 50       # Max gf-filtered param URLs to test\n    arjun:\n      enabled: true      # Hidden parameter discovery — feeds discovered params into dalfox\n      max_targets: 15    # Top N hosts to discover hidden params on\n# AI Analysis\nanalysis:\n  min_confidence: 0.85 # Findings below this require manual confirmation and are not reported\n  js_analysis: true  # AI-powered JS file analysis\n\n# Reporting\nreporting:\n  include_poc: true\n  severity_filter: []  # Optional actionable severities: critical, high, medium, low\n  output_dir: \"./reports\"\n"}, "602d8ee4148fdf98d37603a3df7da8086f4509b4": {"t": 1785748585.0039482, "n": 4984, "h": "6a1be5cc01dd948a", "c": "# Bug Bounty AI Agent Configuration\n\n# ═══════════════════════════════════════════════════════\n# AI Provider Configuration\n# Supported: claude | deepseek | openai | openrouter | custom\n# ═══════════════════════════════════════════════════════\nai:\n  provider: \"auto\"                  # auto = detect from .env (claude/deepseek/openai/openrouter)\n  api_key: \"\"                       # Leave empty — key is read from .env automatically\n  model: \"\"                         # Leave empty for provider default\n  max_tokens: 2000\n  base_url: \"\"                     # Only needed for openrouter/custom\n  timeout: 300                      # Per-request HTTP timeout (seconds). Raise for slow providers/large JS batches\n\n# Provider presets (just change 'provider' and 'api_key'):\n# ┌─────────────┬──────────────────────────┬────────────────────────────┬──────────────┐\n# │ Provider    │ Model (default)          │ Env Variable               │ Cost/1M tok  │\n# ├─────────────┼──────────────────────────┼────────────────────────────┼──────────────┤\n# │ claude      │ claude-sonnet-4-20250514 │ ANTHROPIC_API_KEY          │ $3/$15       │\n# │ deepseek    │ deepseek-chat            │ DEEPSEEK_API_KEY           │ $0.28/$0.42  │\n# │ openai      │ gpt-4o-mini              │ OPENAI_API_KEY             │ $0.15/$0.60  │\n# │ openrouter  │ deepseek/deepseek-chat   │ OPENROUTER_API_KEY         │ varies       │\n# │ custom      │ (must specify)           │ AI_API_KEY                 │ varies       │\n# └─────────────┴──────────────────────────┴────────────────────────────┴──────────────┘\n\n# Legacy Claude config (backward compatibility - used if ai.api_key is empty)\nclaude:\n  api_key: \"${ANTHROPIC_API_KEY}\"\n  model: \"claude-sonnet-4-20250514\"\n  max_tokens: 2000\n\n# C99.nl API Intelligence\nc99:\n  api_key: \"${C99_API_KEY}\"\n  enabled: true\n\n# Target Configuration\ntarget:\n  domains: []\n  excluded_subdomains: []\n\n# Optional authenticated testing. Use only accounts and sessions you own.\n# Values are expanded from environment variables and redacted from AI prompts\n# and reports. Avoid placing literal credentials in this file.\nauthentication:\n  # Required when headers or cookies are configured. Credentials are injected\n  # only when every target in a tool invocation matches this allowlist.\n  allowed_hosts: []\n  # Example:\n  #   - \"app.example.com\"\n  #   - \"*.api.example.com\"\n  headers: {}\n  # Example:\n  #   Authorization: \"Bearer ${TARGET_TOKEN}\"\n  cookies: {}\n  # Example:\n  #   session: \"${TARGET_SESSION}\"\n\n# Reconnaissance Settings\nrecon:\n  enabled: true\n  timeout: 300 # seconds\n  max_subdomains: 1000\n  max_wayback_urls: 10000 # prevent OOM for large domains\n  tools:\n    subfinder: true\n    assetfinder: true\n    wayback: true\n    katana: true  # JS file extraction crawler\n    cert_transparency: true\n\n# Scanning Settings\nscanning:\n  enabled: true\n  threads: 75  # Increased for better performance\n  timeout: 1200  # 20 minutes for high-priority templates\n  rate_limit: 100 # requests per second; lower this to match program rules\n  tools:\n    nuclei:\n      enabled: true\n      severity: []  # No filter - run all templates, findings keep their real severity\n      templates_path: \"\" # Empty uses Nuclei's installed templates\n    httpx:\n      enabled: true\n      follow_redirects: true\n      status_code: true\n    nmap:\n      enabled: false # Open ports alone are reconnaissance, not confirmed vulnerabilities\n      ports: \"21,22,25,53,80,110,143,443,445,993,995,3000,3306,5432,6379,8000,8080,8443,8888,9090,9200,27017\"\n      fast_scan: true\n    dalfox:\n      enabled: true\n      blind_url: \"\"  # Optional: blind XSS callback URL (e.g. https://your-burp-collaborator)\n      max_urls: 100  # Increased for better XSS coverage\n    ffuf:\n      enabled: true\n      # Wordlist search order (first found wins):\n      #   1. This value (if set)\n      #   2. /usr/share/seclists/Discovery/Web-Content/common.txt\n      #   3. /usr/share/wordlists/dirb/common.txt\n      #   4. /opt/SecLists/Discovery/Web-Content/common.txt\n      #   5. Built-in ~130 high-value paths (fallback — limited coverage)\n      # Recommended: apt install seclists  OR  set full path below\n      wordlist_path: \"\"\n      max_targets: 20    # Top N hosts to path-bruteforce (scored by importance)\n      vhost_fuzzing: false # Discovery-only; enable manually when needed\n    sqli:\n      enabled: true      # Uses focused Nuclei SQLi templates and parameter filtering\n      max_urls: 50       # Max gf-filtered param URLs to test\n    arjun:\n      enabled: true      # Hidden parameter discovery — feeds discovered params into dalfox\n      max_targets: 15    # Top N hosts to discover hidden params on\n# AI Analysis\nanalysis:\n  min_confidence: 0.85 # Findings below this require manual confirmation and are not reported\n  js_analysis: true  # AI-powered JS file analysis\n\n# Reporting\nreporting:\n  include_poc: true\n  severity_filter: []  # Optional actionable severities: critical, high, medium, low\n  output_dir: \"./reports\"\n"}, "0d87d52a9211ef11b1474ce0da97726a60d5e212": {"t": 1785748586.0964358, "n": 4868, "h": "4d5df6581de33af9", "c": "# Bug Bounty AI Agent Configuration\n\n# ═══════════════════════════════════════════════════════\n# AI Provider Configuration\n# Supported: claude | deepseek | openai | openrouter | custom\n# ═══════════════════════════════════════════════════════\nai:\n  provider: \"auto\"                  # auto = detect from .env (claude/deepseek/openai/openrouter)\n  api_key: \"\"                       # Leave empty — key is read from .env automatically\n  model: \"\"                         # Leave empty for provider default\n  max_tokens: 2000\n  base_url: \"\"                     # Only needed for openrouter/custom\n\n# Provider presets (just change 'provider' and 'api_key'):\n# ┌─────────────┬──────────────────────────┬────────────────────────────┬──────────────┐\n# │ Provider    │ Model (default)          │ Env Variable               │ Cost/1M tok  │\n# ├─────────────┼──────────────────────────┼────────────────────────────┼──────────────┤\n# │ claude      │ claude-sonnet-4-20250514 │ ANTHROPIC_API_KEY          │ $3/$15       │\n# │ deepseek    │ deepseek-chat            │ DEEPSEEK_API_KEY           │ $0.28/$0.42  │\n# │ openai      │ gpt-4o-mini              │ OPENAI_API_KEY             │ $0.15/$0.60  │\n# │ openrouter  │ deepseek/deepseek-chat   │ OPENROUTER_API_KEY         │ varies       │\n# │ custom      │ (must specify)           │ AI_API_KEY                 │ varies       │\n# └─────────────┴──────────────────────────┴────────────────────────────┴──────────────┘\n\n# Legacy Claude config (backward compatibility - used if ai.api_key is empty)\nclaude:\n  api_key: \"${ANTHROPIC_API_KEY}\"\n  model: \"claude-sonnet-4-20250514\"\n  max_tokens: 2000\n\n# C99.nl API Intelligence\nc99:\n  api_key: \"${C99_API_KEY}\"\n  enabled: true\n\n# Target Configuration\ntarget:\n  domains: []\n  excluded_subdomains: []\n\n# Optional authenticated testing. Use only accounts and sessions you own.\n# Values are expanded from environment variables and redacted from AI prompts\n# and reports. Avoid placing literal credentials in this file.\nauthentication:\n  # Required when headers or cookies are configured. Credentials are injected\n  # only when every target in a tool invocation matches this allowlist.\n  allowed_hosts: []\n  # Example:\n  #   - \"app.example.com\"\n  #   - \"*.api.example.com\"\n  headers: {}\n  # Example:\n  #   Authorization: \"Bearer ${TARGET_TOKEN}\"\n  cookies: {}\n  # Example:\n  #   session: \"${TARGET_SESSION}\"\n\n# Reconnaissance Settings\nrecon:\n  enabled: true\n  timeout: 300 # seconds\n  max_subdomains: 1000\n  max_wayback_urls: 10000 # prevent OOM for large domains\n  tools:\n    subfinder: true\n    assetfinder: true\n    wayback: true\n    katana: true  # JS file extraction crawler\n    cert_transparency: true\n\n# Scanning Settings\nscanning:\n  enabled: true\n  threads: 75  # Increased for better performance\n  timeout: 1200  # 20 minutes for high-priority templates\n  rate_limit: 100 # requests per second; lower this to match program rules\n  tools:\n    nuclei:\n      enabled: true\n      severity: []  # No filter - run all templates, findings keep their real severity\n      templates_path: \"\" # Empty uses Nuclei's installed templates\n    httpx:\n      enabled: true\n      follow_redirects: true\n      status_code: true\n    nmap:\n      enabled: false # Open ports alone are reconnaissance, not confirmed vulnerabilities\n      ports: \"21,22,25,53,80,110,143,443,445,993,995,3000,3306,5432,6379,8000,8080,8443,8888,9090,9200,27017\"\n      fast_scan: true\n    dalfox:\n      enabled: true\n      blind_url: \"\"  # Optional: blind XSS callback URL (e.g. https://your-burp-collaborator)\n      max_urls: 100  # Increased for better XSS coverage\n    ffuf:\n      enabled: true\n      # Wordlist search order (first found wins):\n      #   1. This value (if set)\n      #   2. /usr/share/seclists/Discovery/Web-Content/common.txt\n      #   3. /usr/share/wordlists/dirb/common.txt\n      #   4. /opt/SecLists/Discovery/Web-Content/common.txt\n      #   5. Built-in ~130 high-value paths (fallback — limited coverage)\n      # Recommended: apt install seclists  OR  set full path below\n      wordlist_path: \"\"\n      max_targets: 20    # Top N hosts to path-bruteforce (scored by importance)\n      vhost_fuzzing: false # Discovery-only; enable manually when needed\n    sqli:\n      enabled: true      # Uses focused Nuclei SQLi templates and parameter filtering\n      max_urls: 50       # Max gf-filtered param URLs to test\n    arjun:\n      enabled: true      # Hidden parameter discovery — feeds discovered params into dalfox\n      max_targets: 15    # Top N hosts to discover hidden params on\n# AI Analysis\nanalysis:\n  min_confidence: 0.85 # Findings below this require manual confirmation and are not reported\n  js_analysis: true  # AI-powered JS file analysis\n\n# Reporting\nreporting:\n  include_poc: true\n  severity_filter: []  # Optional actionable severities: critical, high, medium, low\n  output_dir: \"./reports\"\n"}, "40c6b6a0f17cb90474d6a29d027c4e1c8db363a7": {"t": 1785748587.1757324, "n": 4264, "h": "8b4c2def2e615b21", "c": "# Bug Bounty AI Agent Configuration\n\n# ═══════════════════════════════════════════════════════\n# AI Provider Configuration\n# Supported: claude | deepseek | openai | openrouter | custom\n# ═══════════════════════════════════════════════════════\nai:\n  provider: \"auto\"                  # auto = detect from .env (claude/deepseek/openai/openrouter)\n  api_key: \"\"                       # Leave empty — key is read from .env automatically\n  model: \"\"                         # Leave empty for provider default\n  max_tokens: 2000\n  base_url: \"\"                     # Only needed for openrouter/custom\n\n# Provider presets (just change 'provider' and 'api_key'):\n# ┌─────────────┬──────────────────────────┬────────────────────────────┬──────────────┐\n# │ Provider    │ Model (default)          │ Env Variable               │ Cost/1M tok  │\n# ├─────────────┼──────────────────────────┼────────────────────────────┼──────────────┤\n# │ claude      │ claude-sonnet-4-20250514 │ ANTHROPIC_API_KEY          │ $3/$15       │\n# │ deepseek    │ deepseek-chat            │ DEEPSEEK_API_KEY           │ $0.28/$0.42  │\n# │ openai      │ gpt-4o-mini              │ OPENAI_API_KEY             │ $0.15/$0.60  │\n# │ openrouter  │ deepseek/deepseek-chat   │ OPENROUTER_API_KEY         │ varies       │\n# │ custom      │ (must specify)           │ AI_API_KEY                 │ varies       │\n# └─────────────┴──────────────────────────┴────────────────────────────┴──────────────┘\n\n# Legacy Claude config (backward compatibility - used if ai.api_key is empty)\nclaude:\n  api_key: \"${ANTHROPIC_API_KEY}\"\n  model: \"claude-sonnet-4-20250514\"\n  max_tokens: 2000\n\n# C99.nl API Intelligence\nc99:\n  api_key: \"${C99_API_KEY}\"\n  enabled: true\n\n# Target Configuration\ntarget:\n  domains: []\n  excluded_subdomains: []\n\n# Reconnaissance Settings\nrecon:\n  enabled: true\n  timeout: 300 # seconds\n  max_subdomains: 1000\n  max_wayback_urls: 10000 # prevent OOM for large domains\n  tools:\n    subfinder: true\n    assetfinder: true\n    wayback: true\n    katana: true  # JS file extraction crawler\n    cert_transparency: true\n\n# Scanning Settings\nscanning:\n  enabled: true\n  threads: 75  # Increased for better performance\n  timeout: 1200  # 20 minutes for high-priority templates\n  rate_limit: 100 # requests per second; lower this to match program rules\n  tools:\n    nuclei:\n      enabled: true\n      severity: []  # No filter - run all templates, findings keep their real severity\n      templates_path: \"\" # Empty uses Nuclei's installed templates\n    httpx:\n      enabled: true\n      follow_redirects: true\n      status_code: true\n    nmap:\n      enabled: false # Open ports alone are reconnaissance, not confirmed vulnerabilities\n      ports: \"21,22,25,53,80,110,143,443,445,993,995,3000,3306,5432,6379,8000,8080,8443,8888,9090,9200,27017\"\n      fast_scan: true\n    dalfox:\n      enabled: true\n      blind_url: \"\"  # Optional: blind XSS callback URL (e.g. https://your-burp-collaborator)\n      max_urls: 100  # Increased for better XSS coverage\n    ffuf:\n      enabled: true\n      # Wordlist search order (first found wins):\n      #   1. This value (if set)\n      #   2. /usr/share/seclists/Discovery/Web-Content/common.txt\n      #   3. /usr/share/wordlists/dirb/common.txt\n      #   4. /opt/SecLists/Discovery/Web-Content/common.txt\n      #   5. Built-in ~130 high-value paths (fallback — limited coverage)\n      # Recommended: apt install seclists  OR  set full path below\n      wordlist_path: \"\"\n      max_targets: 20    # Top N hosts to path-bruteforce (scored by importance)\n      vhost_fuzzing: false # Discovery-only; enable manually when needed\n    sqli:\n      enabled: true      # Uses focused Nuclei SQLi templates and parameter filtering\n      max_urls: 50       # Max gf-filtered param URLs to test\n    arjun:\n      enabled: true      # Hidden parameter discovery — feeds discovered params into dalfox\n      max_targets: 15    # Top N hosts to discover hidden params on\n# AI Analysis\nanalysis:\n  min_confidence: 0.85 # Findings below this require manual confirmation and are not reported\n  js_analysis: true  # AI-powered JS file analysis\n\n# Reporting\nreporting:\n  include_poc: true\n  severity_filter: []  # Optional actionable severities: critical, high, medium, low\n  output_dir: \"./reports\"\n"}, "ae7e4472b35fd48887c5cba7ad804a154354f441": {"t": 1785748588.5480673, "n": 4856, "h": "b7f4636728b815b8", "c": "# Bug Bounty AI Agent Configuration\n\n# ═══════════════════════════════════════════════════════\n# AI Provider Configuration\n# Supported: claude | deepseek | openai | openrouter | custom\n# ═══════════════════════════════════════════════════════\nai:\n  provider: \"auto\"                  # auto = detect from .env (claude/deepseek/openai/openrouter)\n  api_key: \"\"                       # Leave empty — key is read from .env automatically\n  model: \"\"                         # Leave empty for provider default\n  max_tokens: 2000\n  base_url: \"\"                     # Only needed for openrouter/custom\n\n# Provider presets (just change 'provider' and 'api_key'):\n# ┌─────────────┬──────────────────────────┬────────────────────────────┬──────────────┐\n# │ Provider    │ Model (default)          │ Env Variable               │ Cost/1M tok  │\n# ├─────────────┼──────────────────────────┼────────────────────────────┼──────────────┤\n# │ claude      │ claude-sonnet-4-20250514 │ ANTHROPIC_API_KEY          │ $3/$15       │\n# │ deepseek    │ deepseek-chat            │ DEEPSEEK_API_KEY           │ $0.28/$0.42  │\n# │ openai      │ gpt-4o-mini              │ OPENAI_API_KEY             │ $0.15/$0.60  │\n# │ openrouter  │ deepseek/deepseek-chat   │ OPENROUTER_API_KEY         │ varies       │\n# │ custom      │ (must specify)           │ AI_API_KEY                 │ varies       │\n# └─────────────┴──────────────────────────┴────────────────────────────┴──────────────┘\n\n# Legacy Claude config (backward compatibility - used if ai.api_key is empty)\nclaude:\n  api_key: \"${ANTHROPIC_API_KEY}\"\n  model: \"claude-sonnet-4-20250514\"\n  max_tokens: 2000\n\n# C99.nl API Intelligence\nc99:\n  api_key: \"${C99_API_KEY}\"\n  enabled: true\n\n# Target Configuration\ntarget:\n  domains: []\n  excluded_subdomains: []\n  scope: \"in-scope-only\"\n\n# Reconnaissance Settings\nrecon:\n  enabled: true\n  timeout: 300 # seconds\n  max_subdomains: 1000\n  max_wayback_urls: 10000 # prevent OOM for large domains\n  tools:\n    subfinder: true\n    amass: false # Slower but comprehensive\n    assetfinder: true\n    github_dorking: true\n    wayback: true\n    katana: true  # JS file extraction crawler\n\n# Scanning Settings\nscanning:\n  enabled: true\n  threads: 75  # Increased for better performance\n  timeout: 1200  # 20 minutes for high-priority templates\n  rate_limit: 250 # requests per second (faster scanning)\n  tools:\n    nuclei:\n      enabled: true\n      severity: []  # No filter - run all templates, findings keep their real severity\n      templates_path: \"/root/nuclei-templates\"  # ALL templates for maximum coverage\n    httpx:\n      enabled: true\n      follow_redirects: true\n      status_code: true\n    nmap:\n      enabled: true\n      ports: \"21,22,25,53,80,110,143,443,445,993,995,3000,3306,5432,6379,8000,8080,8443,8888,9090,9200,27017\"\n      fast_scan: true\n    dalfox:\n      enabled: true\n      blind_url: \"\"  # Optional: blind XSS callback URL (e.g. https://your-burp-collaborator)\n      max_urls: 100  # Increased for better XSS coverage\n    ffuf:\n      enabled: true\n      # Wordlist search order (first found wins):\n      #   1. This value (if set)\n      #   2. /usr/share/seclists/Discovery/Web-Content/common.txt\n      #   3. /usr/share/wordlists/dirb/common.txt\n      #   4. /opt/SecLists/Discovery/Web-Content/common.txt\n      #   5. Built-in ~130 high-value paths (fallback — limited coverage)\n      # Recommended: apt install seclists  OR  set full path below\n      wordlist_path: \"\"\n      max_targets: 20    # Top N hosts to path-bruteforce (scored by importance)\n      vhost_fuzzing: true  # Also fuzz virtual hosts via Host header — finds hidden internal apps\n    sqli:\n      enabled: true      # SQLi via nuclei templates + gf-style param filtering (replaces sqlmap)\n      # NOTE: sqlmap config kept for backward compatibility — set enabled:true above to activate\n    sqlmap:\n      enabled: true      # Uses nuclei sqli templates internally (NOT blind sqlmap)\n      max_urls: 50       # Max gf-filtered param URLs to test\n    arjun:\n      enabled: true      # Hidden parameter discovery — feeds discovered params into dalfox\n      max_targets: 15    # Top N hosts to discover hidden params on\n    cors:\n      enabled: true      # CORS misconfiguration detection (fast, no external tools needed)\n\n# AI Analysis\nanalysis:\n  enabled: true\n  min_confidence: 0.7\n  auto_validate: true\n  false_positive_filter: true\n  js_analysis: true  # AI-powered JS file analysis\n\n# Reporting\nreporting:\n  format: \"markdown\"\n  language: \"ar\" # Arabic reports\n  include_poc: true\n  severity_filter: []  # No filter - include ALL severities (critical, high, medium, low, info)\n  output_dir: \"./reports\"\n\n# Notifications\nnotifications:\n  enabled: false\n  slack_webhook: \"\"\n  discord_webhook: \"\"\n\n# Logging\nlogging:\n  level: \"info\" # debug, info, warn, error\n  file: \"./logs/agent.log\"\n  max_size_mb: 100\n"}, "3f611357d566a2993518503fbca9e09289ab9a32": {"t": 1785748589.6094909, "n": 4813, "h": "9445ea1629bff72d", "c": "# Bug Bounty AI Agent Configuration\n\n# ═══════════════════════════════════════════════════════\n# AI Provider Configuration\n# Supported: claude | deepseek | openai | openrouter | custom\n# ═══════════════════════════════════════════════════════\nai:\n  provider: \"deepseek\"               # Choose your AI provider\n  api_key: \"${DEEPSEEK_API_KEY}\"  # API key (or use env vars below)\n  model: \"deepseek-chat\"                        # Leave empty for provider default\n  max_tokens: 2000\n  base_url: \"\"                     # Only needed for openrouter/custom\n\n# Provider presets (just change 'provider' and 'api_key'):\n# ┌─────────────┬──────────────────────────┬────────────────────────────┬──────────────┐\n# │ Provider    │ Model (default)          │ Env Variable               │ Cost/1M tok  │\n# ├─────────────┼──────────────────────────┼────────────────────────────┼──────────────┤\n# │ claude      │ claude-sonnet-4-20250514 │ ANTHROPIC_API_KEY          │ $3/$15       │\n# │ deepseek    │ deepseek-chat            │ DEEPSEEK_API_KEY           │ $0.28/$0.42  │\n# │ openai      │ gpt-4o-mini              │ OPENAI_API_KEY             │ $0.15/$0.60  │\n# │ openrouter  │ deepseek/deepseek-chat   │ OPENROUTER_API_KEY         │ varies       │\n# │ custom      │ (must specify)           │ AI_API_KEY                 │ varies       │\n# └─────────────┴──────────────────────────┴────────────────────────────┴──────────────┘\n\n# Legacy Claude config (backward compatibility - used if ai.api_key is empty)\nclaude:\n  api_key: \"${ANTHROPIC_API_KEY}\"\n  model: \"claude-sonnet-4-20250514\"\n  max_tokens: 2000\n\n# C99.nl API Intelligence\nc99:\n  api_key: \"${C99_API_KEY}\"\n  enabled: true\n\n# Target Configuration\ntarget:\n  domains: []\n  excluded_subdomains: []\n  scope: \"in-scope-only\"\n\n# Reconnaissance Settings\nrecon:\n  enabled: true\n  timeout: 300 # seconds\n  max_subdomains: 1000\n  max_wayback_urls: 10000 # prevent OOM for large domains\n  tools:\n    subfinder: true\n    amass: false # Slower but comprehensive\n    assetfinder: true\n    github_dorking: true\n    wayback: true\n    katana: true  # JS file extraction crawler\n\n# Scanning Settings\nscanning:\n  enabled: true\n  threads: 75  # Increased for better performance\n  timeout: 1200  # 20 minutes for high-priority templates\n  rate_limit: 250 # requests per second (faster scanning)\n  tools:\n    nuclei:\n      enabled: true\n      severity: []  # No filter - run all templates, findings keep their real severity\n      templates_path: \"/root/nuclei-templates\"  # ALL templates for maximum coverage\n    httpx:\n      enabled: true\n      follow_redirects: true\n      status_code: true\n    nmap:\n      enabled: true\n      ports: \"21,22,25,53,80,110,143,443,445,993,995,3000,3306,5432,6379,8000,8080,8443,8888,9090,9200,27017\"\n      fast_scan: true\n    dalfox:\n      enabled: true\n      blind_url: \"\"  # Optional: blind XSS callback URL (e.g. https://your-burp-collaborator)\n      max_urls: 100  # Increased for better XSS coverage\n    ffuf:\n      enabled: true\n      # Wordlist search order (first found wins):\n      #   1. This value (if set)\n      #   2. /usr/share/seclists/Discovery/Web-Content/common.txt\n      #   3. /usr/share/wordlists/dirb/common.txt\n      #   4. /opt/SecLists/Discovery/Web-Content/common.txt\n      #   5. Built-in ~130 high-value paths (fallback — limited coverage)\n      # Recommended: apt install seclists  OR  set full path below\n      wordlist_path: \"\"\n      max_targets: 20    # Top N hosts to path-bruteforce (scored by importance)\n      vhost_fuzzing: true  # Also fuzz virtual hosts via Host header — finds hidden internal apps\n    sqli:\n      enabled: true      # SQLi via nuclei templates + gf-style param filtering (replaces sqlmap)\n      # NOTE: sqlmap config kept for backward compatibility — set enabled:true above to activate\n    sqlmap:\n      enabled: true      # Uses nuclei sqli templates internally (NOT blind sqlmap)\n      max_urls: 50       # Max gf-filtered param URLs to test\n    arjun:\n      enabled: true      # Hidden parameter discovery — feeds discovered params into dalfox\n      max_targets: 15    # Top N hosts to discover hidden params on\n    cors:\n      enabled: true      # CORS misconfiguration detection (fast, no external tools needed)\n\n# AI Analysis\nanalysis:\n  enabled: true\n  min_confidence: 0.7\n  auto_validate: true\n  false_positive_filter: true\n  js_analysis: true  # AI-powered JS file analysis\n\n# Reporting\nreporting:\n  format: \"markdown\"\n  language: \"ar\" # Arabic reports\n  include_poc: true\n  severity_filter: []  # No filter - include ALL severities (critical, high, medium, low, info)\n  output_dir: \"./reports\"\n\n# Notifications\nnotifications:\n  enabled: false\n  slack_webhook: \"\"\n  discord_webhook: \"\"\n\n# Logging\nlogging:\n  level: \"info\" # debug, info, warn, error\n  file: \"./logs/agent.log\"\n  max_size_mb: 100\n"}, "670da535366057a5e27666335a03e5d83a09e546": {"t": 1785748590.6443946, "n": 4475, "h": "0bf7ea5d4b9b4db5", "c": "# Bug Bounty AI Agent Configuration\n\n# ═══════════════════════════════════════════════════════\n# AI Provider Configuration\n# Supported: claude | deepseek | openai | openrouter | custom\n# ═══════════════════════════════════════════════════════\nai:\n  provider: \"deepseek\"               # Choose your AI provider\n  api_key: \"${DEEPSEEK_API_KEY}\"  # API key (or use env vars below)\n  model: \"deepseek-chat\"                        # Leave empty for provider default\n  max_tokens: 2000\n  base_url: \"\"                     # Only needed for openrouter/custom\n\n# Provider presets (just change 'provider' and 'api_key'):\n# ┌─────────────┬──────────────────────────┬────────────────────────────┬──────────────┐\n# │ Provider    │ Model (default)          │ Env Variable               │ Cost/1M tok  │\n# ├─────────────┼──────────────────────────┼────────────────────────────┼──────────────┤\n# │ claude      │ claude-sonnet-4-20250514 │ ANTHROPIC_API_KEY          │ $3/$15       │\n# │ deepseek    │ deepseek-chat            │ DEEPSEEK_API_KEY           │ $0.28/$0.42  │\n# │ openai      │ gpt-4o-mini              │ OPENAI_API_KEY             │ $0.15/$0.60  │\n# │ openrouter  │ deepseek/deepseek-chat   │ OPENROUTER_API_KEY         │ varies       │\n# │ custom      │ (must specify)           │ AI_API_KEY                 │ varies       │\n# └─────────────┴──────────────────────────┴────────────────────────────┴──────────────┘\n\n# Legacy Claude config (backward compatibility - used if ai.api_key is empty)\nclaude:\n  api_key: \"${ANTHROPIC_API_KEY}\"\n  model: \"claude-sonnet-4-20250514\"\n  max_tokens: 2000\n\n# C99.nl API Intelligence\nc99:\n  api_key: \"${C99_API_KEY}\"\n  enabled: true\n\n# Target Configuration\ntarget:\n  domains: []\n  excluded_subdomains: []\n  scope: \"in-scope-only\"\n\n# Reconnaissance Settings\nrecon:\n  enabled: true\n  timeout: 300 # seconds\n  max_subdomains: 1000\n  max_wayback_urls: 10000 # prevent OOM for large domains\n  tools:\n    subfinder: true\n    amass: false # Slower but comprehensive\n    assetfinder: true\n    github_dorking: true\n    wayback: true\n    katana: true  # JS file extraction crawler\n\n# Scanning Settings\nscanning:\n  enabled: true\n  threads: 75  # Increased for better performance\n  timeout: 1200  # 20 minutes for high-priority templates\n  rate_limit: 250 # requests per second (faster scanning)\n  tools:\n    nuclei:\n      enabled: true\n      severity: []  # No filter - run all templates, findings keep their real severity\n      templates_path: \"/root/nuclei-templates\"  # ALL templates for maximum coverage\n    httpx:\n      enabled: true\n      follow_redirects: true\n      status_code: true\n    nmap:\n      enabled: true\n      ports: \"21,22,25,53,80,110,143,443,445,993,995,3000,3306,5432,6379,8000,8080,8443,8888,9090,9200,27017\"\n      fast_scan: true\n    dalfox:\n      enabled: true\n      blind_url: \"\"  # Optional: blind XSS callback URL (e.g. https://your-burp-collaborator)\n      max_urls: 100  # Increased for better XSS coverage\n    ffuf:\n      enabled: true\n      wordlist_path: \"\"  # Auto-detects SecLists/dirb/dirbuster, or specify full path\n      max_targets: 20    # Top N hosts to path-bruteforce (scored by importance)\n      vhost_fuzzing: true  # Also fuzz virtual hosts via Host header — finds hidden internal apps\n    sqli:\n      enabled: true      # SQLi via nuclei templates + gf-style param filtering (replaces sqlmap)\n      # NOTE: sqlmap config kept for backward compatibility — set enabled:true above to activate\n    sqlmap:\n      enabled: true      # Uses nuclei sqli templates internally (NOT blind sqlmap)\n      max_urls: 50       # Max gf-filtered param URLs to test\n    arjun:\n      enabled: true      # Hidden parameter discovery — feeds discovered params into dalfox\n      max_targets: 15    # Top N hosts to discover hidden params on\n    cors:\n      enabled: true      # CORS misconfiguration detection (fast, no external tools needed)\n\n# AI Analysis\nanalysis:\n  enabled: true\n  min_confidence: 0.7\n  auto_validate: true\n  false_positive_filter: true\n  js_analysis: true  # AI-powered JS file analysis\n\n# Reporting\nreporting:\n  format: \"markdown\"\n  language: \"ar\" # Arabic reports\n  include_poc: true\n  severity_filter: []  # No filter - include ALL severities (critical, high, medium, low, info)\n  output_dir: \"./reports\"\n\n# Notifications\nnotifications:\n  enabled: false\n  slack_webhook: \"\"\n  discord_webhook: \"\"\n\n# Logging\nlogging:\n  level: \"info\" # debug, info, warn, error\n  file: \"./logs/agent.log\"\n  max_size_mb: 100\n"}}}}