Build HackerOne scope workspace and ZAP passive scanner API

.gitignore

@@ -0,0 +1,8 @@
+__pycache__/
+.pytest_cache/
+*.pyc
+.env
+*.sqlite
+*.db
+results/
+node_modules/

Dockerfile

@@ -0,0 +1,11 @@
+FROM zaproxy/zap-stable
+USER root
+RUN python3 -m venv /opt/asfb-venv && /opt/asfb-venv/bin/pip install --no-cache-dir fastapi==0.115.12 uvicorn==0.34.2 python-multipart==0.0.20 httpx==0.28.1
+WORKDIR /app
+COPY --chown=zap:zap app /app/app
+COPY --chown=zap:zap start.sh /app/start.sh
+RUN chmod +x /app/start.sh
+USER zap
+ENV PATH="/opt/asfb-venv/bin:$PATH" PYTHONUNBUFFERED=1
+EXPOSE 7860
+CMD ["/app/start.sh"]

README.md

@@ -1 +1,83 @@
-# asfbb
+---
+title: ASFB Bug Bounty Scanner
+emoji: 🔎
+sdk: docker
+app_port: 7860
+---
+
+# ASFB — Bug bounty scope and ZAP workspace
+
+A self-hosted, API-driven workbench for importing HackerOne scope exports, prioritizing web targets, configuring testing identities, and running **rate-limited passive checks** using the standard OWASP ZAP daemon.
+
+> This is an initial working release, not a comprehensive automated vulnerability detector. It does not prove IDORs or RSA/JWT weaknesses, run Nuclei, or autonomously scan wildcards. Those are future modules.
+
+## Features
+- Upload CSV scope exports; recognizes common HackerOne column names (asset name/identifier, type, bounty, severity, resolved reports, last update, instructions).
+- API and web UI filtering by reward eligibility, severity, scanner compatibility, text and report volume.
+- Preserves non-web assets and wildcard entries for manual review instead of automatically treating them as HTTP scan targets.
+- Program-specific scan-policy approval, exact-host scope enforcement, SSRF checks, URL/path exclusions, and small default request budgets.
+- Request profiles with custom User-Agent and account-specific cookies/headers. Credentials exist **in process memory only** and are not serialized to files, databases or reports.
+- Sequential background jobs, stop/status endpoints, and ZAP passive alerts.
+- API-key authentication on the backend; API docs at `/docs`.
+
+## Deployment
+Create a **private** Hugging Face Docker Space from this repository (or run Docker locally). Set secrets:
+- `ASFB_API_KEY`: a long random API key **required on startup**.
+- `ZAP_API_KEY`: a separate random API key **required on startup**.
+
+Configure the frontend by opening the Space, entering `ASFB_API_KEY` into the UI. The browser keeps the key only in memory until the page is reloaded. Do not distribute this key publicly.
+
+```bash
+docker build -t asfbb .
+docker run --rm -p 7860:7860 -e ASFB_API_KEY=change-me-long-random-value -e ZAP_API_KEY=another-long-random-value asfbb
+```
+
+A free Hugging Face Space may sleep and its working disk is ephemeral. This release keeps all data in memory. Do not rely on it for durable findings/history. For public/multiuser deployment, add per-user authentication, a durable encrypted database and stricter queue isolation first.
+
+## Workflow
+1. Import a HackerOne CSV via the dashboard or `POST /api/import` multipart upload.
+2. Review the parsed assets, their eligibility and descriptions.
+3. Add a policy acknowledgement and verify the program permits the proposed automation.
+4. Choose an individual, unambiguous domain/URL row. Wildcards, category/group rows, mobile/source-code assets are not auto-scannable.
+5. Configure an optional account identity in the UI. Login credentials are not required for unauthenticated scans.
+6. Start a passive ZAP scan. The job makes up to the configured number of scoped GET requests; no active scanner payloads are sent.
+7. Review the findings and investigate manually.
+
+### API examples
+```bash
+curl -H "X-ASFB-Key: $ASFB_API_KEY" -F "file=@scope.csv" http://localhost:7860/api/import
+curl -H "X-ASFB-Key: $ASFB_API_KEY" http://localhost:7860/api/assets
+```
+
+`POST /api/scans` example (replace asset_id with an imported ID):
+```json
+{
+  "asset_id": "ASSET_ID",
+  "policy_confirmed": true,
+  "user_agent": "ASFB-research/0.1",
+  "max_requests": 3,
+  "delay_seconds": 1.5,
+  "account_id": null
+}
+```
+
+`POST /api/accounts` accepts `{ "name": "A", "host": "example.org", "cookie": "session=...", "headers": {"X-Testing": "yes"} }`. Accounts are stored only until the process restarts, not included in API responses, and restricted to their exact host.
+
+## Limitations and safety
+- Imported scope does not override a program's rules. Scope tables do not consistently include automation prohibitions; check them manually before confirming.
+- A listed source-code path or internal-service wildcard is not interpreted as authorization for external web scans.
+- DNS is checked before a job; network changes, redirects, proxy behavior and complex authorization still require hardened egress controls. The scan fetcher disallows redirects and rechecks resolved addresses. Deploy on isolated infrastructure for high-assurance SSRF control.
+- This MVP uses one backend, one ZAP daemon, one active job at a time; it is not a public SaaS or multi-tenant service.
+- Only HTTP(S) ports 80, 443, 8080 are supported by the default target validator (matching common HF egress ports).
+- Authentication profiles can become stale; do not use production customer credentials.
+- Findings from passive rules are signals, not verified vulnerabilities.
+- The ZAP upstream base image is tagged `stable`; pin it to a digest before production.
+
+## Tests
+```bash
+python -m pip install -r requirements.txt
+python -m pytest -q
+```
+
+## Next milestones
+OpenAPI discovery, per-program policy manifests, scoped crawling, differential two-account IDOR replay, verified JWT rule pack, vulnerability triage, persistence and scan-history diffing.

app/index.html

@@ -0,0 +1,28 @@
+<!doctype html>
+<html lang="en"><head><meta charset="utf-8"/><meta name="viewport" content="width=device-width,initial-scale=1"/>
+<title>ASFB — Scope & Scan Workspace</title>
+<style>
+:root{font-family:Inter,system-ui,Arial,sans-serif;color:#24223a;background:#f8f7fc}*{box-sizing:border-box}body{margin:0}.shell{max-width:1240px;margin:auto;padding:26px 18px}header{display:flex;justify-content:space-between;align-items:center;gap:16px;flex-wrap:wrap}h1{margin:0;font-size:27px;letter-spacing:-1px}h2{font-size:17px;margin:0 0 15px}small,.muted{color:#77738b}.tag{background:#ede8fb;color:#684ba9;border-radius:30px;padding:5px 10px;font-size:12px}.card{background:white;border:1px solid #e9e4f0;border-radius:16px;padding:20px;margin-top:18px;box-shadow:0 3px 20px #33265708}.grid{display:grid;grid-template-columns:1.1fr 1fr;gap:18px}.controls{display:flex;flex-wrap:wrap;gap:9px;align-items:center}button{background:#7959c8;color:#fff;border:0;border-radius:9px;padding:10px 15px;cursor:pointer;font-weight:650}button:disabled{opacity:.45;cursor:not-allowed}button.secondary{background:#f1edfa;color:#6545aa}input,select,textarea{padding:10px;border:1px solid #dcd5eb;border-radius:9px;font:inherit;background:white;max-width:100%}label{font-size:13px;color:#56506f}.field{display:flex;flex-direction:column;gap:5px;min-width:140px;flex:1}.field input{width:100%}table{border-collapse:collapse;width:100%;font-size:13px}th,td{text-align:left;padding:11px 9px;border-bottom:1px solid #eeebf2;vertical-align:top}th{color:#736e85;font-size:11px;text-transform:uppercase}table td:first-child{overflow-wrap:anywhere}tr:hover td{background:#faf8ff}.scroll{max-height:480px;overflow:auto}.stats{display:flex;gap:10px;flex-wrap:wrap}.stat{padding:13px 20px;background:#f6f2ff;border-radius:12px;min-width:120px}.stat b{font-size:22px;display:block}.notice{padding:12px 14px;border-radius:9px;background:#f8f4e8;font-size:13px;margin-top:12px}.error{color:#a3344c}.ok{color:#376c52}.topbar{display:flex;align-items:center;gap:8px}.results{white-space:pre-wrap;overflow-wrap:anywhere;font-size:12px;background:#f8f7fc;padding:12px;border-radius:8px;max-height:360px;overflow:auto}@media(max-width:780px){.grid{grid-template-columns:1fr}.shell{padding:14px}.card{padding:14px}table{font-size:12px}th,td{padding:7px 4px}}
+</style></head><body><main class="shell">
+<header><div><h1>ASFB <span class="tag">v0.1</span></h1><div class="muted">Bug bounty scope manager · OWASP ZAP passive analysis</div></div><div class="topbar"><input id="apiKey" type="password" placeholder="ASFB API key" autocomplete="off"/><button onclick="refresh()">Connect</button></div></header>
+<div class="notice">Importing scope is not approval to scan. Check each program's automation rules and test only accounts/assets you are authorized to use. Scanning is passive, one asset at a time, and disabled until you confirm policy.</div>
+<div class="grid"><section class="card"><h2>1. Import HackerOne scope</h2><div class="controls"><input id="file" type="file" accept=".csv,text/csv"/><button onclick="upload()">Import CSV</button></div><p class="muted">Headers supported: Asset name, Type, Coverage, Max. severity, Bounty, Last update, Resolved Reports, plus common API export variants.</p></section>
+<section class="card"><h2>2. Scan settings</h2><div class="controls"><div class="field"><label>Custom User-Agent</label><input id="agent" value="ASFB-Research/0.1"/></div><div class="field"><label>Requests (max 10)</label><input id="requests" type="number" min="1" max="10" value="1"/></div></div><div class="controls" style="margin-top:10px"><div class="field"><label>Identity</label><select id="account"><option value="">Anonymous</option></select></div><div class="field"><label>Delay, seconds</label><input id="delay" type="number" value="1.5" min="1" max="30" step=".5"/></div></div><div style="margin-top:15px"><label><input type="checkbox" id="policy"/> I have checked this program's rules and confirm this passive automated testing is permitted.</label></div><p id="selected" class="muted">Select a compatible asset below.</p><button id="start" disabled onclick="scan()">Start passive scan</button></section></div>
+<section class="card"><h2>Scope assets</h2><div class="controls"><div class="field"><label>Search</label><input id="search" placeholder="Hostname / description" oninput="render()"/></div><div class="field"><label>Minimum max. severity</label><select id="severity" onchange="render()"><option value="all">All</option><option value="medium">Medium+</option><option value="high">High+</option><option value="critical">Critical only</option></select></div><div class="field"><label>Maximum resolved reports</label><input id="reports" type="number" min="0" placeholder="Any" oninput="render()"/></div></div><div class="controls" style="margin-top:13px"><label><input id="bounty" type="checkbox" onchange="render()"/> Reward eligible only</label><label><input id="compatible" type="checkbox" onchange="render()"/> ZAP-compatible only</label></div><div class="stats" style="margin:15px 0"><div class="stat"><b id="total">0</b><small>Imported assets</small></div><div class="stat"><b id="filtered">0</b><small>Filtered assets</small></div></div><div class="scroll"><table><thead><tr><th>Choose</th><th>Asset / description</th><th>Type</th><th>Max. severity</th><th>Bounty</th><th>Resolved</th></tr></thead><tbody id="rows"></tbody></table></div></section>
+<div class="grid"><section class="card"><h2>Account profiles (session only)</h2><div class="controls"><div class="field"><label>Account label</label><input id="aname" placeholder="Test account A"/></div><div class="field"><label>Exact host</label><input id="ahost" placeholder="api.example.org"/></div></div><div class="field" style="margin-top:10px"><label>Cookie header (not persisted)</label><input id="acookie" type="password" autocomplete="off" placeholder="session=..."/></div><button style="margin-top:12px" onclick="addAccount()">Add account</button><p class="muted">Do not use other users' credentials. Cookies stay in backend process memory, not disk.</p></section>
+<section class="card"><h2>Scan queue and findings</h2><button class="secondary" onclick="loadScans()">Refresh scans</button><div id="scans" class="results">No scans yet.</div></section></div>
+<p id="message" class="muted"></p></main>
+<script>
+let assets=[],selectedId=null;
+const el=id=>document.getElementById(id);
+const esc=s=>String(s??"").replace(/[&<>"']/g,c=>({'&':'&amp;','<':'&lt;','>':'&gt;','"':'&quot;',"'":'&#39;'}[c]));
+async function api(path,options={}){const h={'X-ASFB-Key':el('apiKey').value,...(options.headers||{})};const r=await fetch('/api'+path,{...options,headers:h});const text=await r.text();let data;try{data=JSON.parse(text)}catch{data={detail:text}}if(!r.ok)throw Error(typeof data.detail==='string'?data.detail:JSON.stringify(data.detail||data));return data}
+function message(text,error=false){el('message').textContent=text;el('message').className=error?'error':'muted'}
+async function refresh(){try{const r=await api('/assets');assets=r.assets;render();await loadAccounts();await loadScans();message('Connected.')}catch(e){message(e.message,true)}}
+function render(){const ranks={unknown:-1,none:0,low:1,medium:2,high:3,critical:4}, min=el('severity').value, q=el('search').value.toLowerCase(),max=el('reports').value;const rows=assets.filter(a=>(!el('bounty').checked||a.bounty)&&(!el('compatible').checked||a.compatibility==='web')&&(min==='all'||ranks[a.max_severity]>=ranks[min])&&(max===''||a.resolved_reports!==null&&a.resolved_reports<=Number(max))&&((a.name+' '+a.description).toLowerCase().includes(q)));el('total').textContent=assets.length;el('filtered').textContent=rows.length;el('rows').innerHTML=rows.map(a=>'<tr><td><input type="radio" name="asset" '+(selectedId===a.id?'checked ':'')+(a.compatibility!=='web'?'disabled ':'')+'data-id="'+esc(a.id)+'"></td><td><b>'+esc(a.name)+'</b><br><small>'+esc(a.description)+'</small></td><td>'+esc(a.type)+'<br><small>'+esc(a.compatibility)+'</small></td><td>'+esc(a.max_severity)+'</td><td>'+(a.bounty?'Eligible':'No')+'</td><td>'+esc(a.resolved_reports??'—')+'</td></tr>').join('');document.querySelectorAll('[data-id]').forEach(n=>n.addEventListener('change',()=>{selectedId=n.dataset.id;el('selected').textContent=assets.find(a=>a.id===selectedId)?.name||'';el('start').disabled=false}))}
+async function upload(){const f=el('file').files[0];if(!f)return message('Choose a CSV file',true);const d=new FormData();d.append('file',f);try{const r=await api('/import',{method:'POST',body:d});message('Imported '+r.imported+' assets ('+r.web+' web-compatible).');await refresh()}catch(e){message(e.message,true)}}
+async function addAccount(){const body={name:el('aname').value,host:el('ahost').value,cookie:el('acookie').value};try{await api('/accounts',{method:'POST',headers:{'Content-Type':'application/json'},body:JSON.stringify(body)});el('acookie').value='';await loadAccounts();message('Account profile added (memory only).')}catch(e){message(e.message,true)}}
+async function loadAccounts(){const a=await api('/accounts');el('account').innerHTML='<option value="">Anonymous</option>'+a.map(v=>'<option value="'+esc(v.id)+'">'+esc(v.name+' — '+v.host)+'</option>').join('')}
+async function scan(){if(!selectedId)return;const body={asset_id:selectedId,policy_confirmed:el('policy').checked,user_agent:el('agent').value,max_requests:Number(el('requests').value),delay_seconds:Number(el('delay').value),account_id:el('account').value||null};try{const r=await api('/scans',{method:'POST',headers:{'Content-Type':'application/json'},body:JSON.stringify(body)});message('Scan queued: '+r.id);await loadScans()}catch(e){message(e.message,true)}}
+async function loadScans(){try{const r=await api('/scans');el('scans').textContent=JSON.stringify(r.map(x=>({id:x.id,status:x.status,target:x.target,requests:x.request_count,alerts:x.alerts,error:x.error})),null,2)}catch(e){message(e.message,true)}}
+</script></body></html>

app/main.py

@@ -0,0 +1,214 @@
+import asyncio
+import os
+import secrets
+import time
+import uuid
+from threading import Lock
+from urllib.parse import urlsplit
+
+import httpx
+from fastapi import FastAPI, File, Header, HTTPException, UploadFile, Depends
+from fastapi.responses import FileResponse
+from pydantic import BaseModel, Field
+
+from .scope import LEVELS, parse_csv, public_host, target_url
+
+API_KEY = os.environ.get("ASFB_API_KEY", "")
+ZAP_KEY = os.environ.get("ZAP_API_KEY", "")
+ZAP_URL = "http://127.0.0.1:8090"
+app = FastAPI(title="ASFB Scanner API", version="0.1.0", docs_url="/docs")
+assets = {}
+accounts = {}
+jobs = {}
+queue = asyncio.Queue()
+zap_lock = Lock()
+
+def authorize(x_asfb_key: str | None = Header(None)):
+    if not API_KEY or not secrets.compare_digest(x_asfb_key or "", API_KEY):
+        raise HTTPException(401, "Invalid API key")
+
+class Account(BaseModel):
+    name: str = Field(min_length=1, max_length=100)
+    host: str = Field(min_length=4, max_length=253)
+    cookie: str = Field(default="", max_length=8000)
+    headers: dict[str, str] = Field(default_factory=dict)
+
+class ScanRequest(BaseModel):
+    asset_id: str
+    policy_confirmed: bool = False
+    user_agent: str = Field(default="ASFB-Research/0.1", max_length=300)
+    max_requests: int = Field(default=1, ge=1, le=10)
+    delay_seconds: float = Field(default=1.5, ge=1, le=30)
+    account_id: str | None = None
+
+@app.on_event("startup")
+async def startup():
+    if not API_KEY or not ZAP_KEY:
+        raise RuntimeError("ASFB_API_KEY and ZAP_API_KEY are mandatory")
+    app.state.worker = asyncio.create_task(worker())
+
+@app.on_event("shutdown")
+async def shutdown():
+    app.state.worker.cancel()
+
+@app.get("/")
+async def index():
+    return FileResponse("/app/app/index.html")
+
+@app.get("/api/health")
+async def health():
+    return {"status": "ok", "zap": bool(ZAP_KEY)}
+
+@app.post("/api/import", dependencies=[Depends(authorize)])
+async def import_file(file: UploadFile = File(...)):
+    blob = await file.read(2_000_001)
+    try:
+        rows = parse_csv(blob)
+    except (UnicodeDecodeError, ValueError) as exc:
+        raise HTTPException(422, str(exc))
+    prefix = str(uuid.uuid4())[:8]
+    for r in rows:
+        r["id"] = prefix + "-" + r["id"]
+        assets[r["id"]] = r
+    return {"imported": len(rows), "web": sum(r["compatibility"] == "web" for r in rows)}
+
+@app.get("/api/assets", dependencies=[Depends(authorize)])
+def list_assets(bounty_only: bool = False, severity: str = "all", compatible_only: bool = False, search: str = "", max_reports: int | None = None):
+    rows = list(assets.values())
+    if bounty_only:
+        rows = [r for r in rows if r["bounty"]]
+    if severity != "all":
+        if severity not in LEVELS:
+            raise HTTPException(422, "Unsupported severity")
+        rows = [r for r in rows if LEVELS.get(r["max_severity"], -1) >= LEVELS[severity]]
+    if compatible_only:
+        rows = [r for r in rows if r["compatibility"] == "web"]
+    if search:
+        rows = [r for r in rows if search.lower() in r["name"].lower() or search.lower() in r["description"].lower()]
+    if max_reports is not None:
+        rows = [r for r in rows if r["resolved_reports"] is not None and r["resolved_reports"] <= max_reports]
+    return {"total": len(rows), "assets": rows}
+
+@app.post("/api/accounts", dependencies=[Depends(authorize)])
+def add_account(account: Account):
+    h = account.host.lower().rstrip(".")
+    if urlsplit("https://" + h).hostname != h or any(c in h for c in "/:@*"):
+        raise HTTPException(422, "Account must specify a single hostname")
+    public_host(h, os.environ.get("ALLOW_PRIVATE_TARGETS") == "1")
+    if any(k.lower() in {"host", "cookie", "content-length", "authorization", "proxy-authorization"} for k in account.headers):
+        raise HTTPException(422, "Use cookie field for cookies; protected headers cannot be overridden")
+    identifier = uuid.uuid4().hex
+    accounts[identifier] = account.model_dump() if hasattr(account, "model_dump") else account.dict()
+    accounts[identifier]["host"] = h
+    return {"id": identifier, "name": account.name, "host": h}
+
+@app.get("/api/accounts", dependencies=[Depends(authorize)])
+def list_accounts():
+    return [{"id": k, "name": v["name"], "host": v["host"]} for k, v in accounts.items()]
+
+@app.delete("/api/accounts/{account_id}", dependencies=[Depends(authorize)])
+def remove_account(account_id: str):
+    accounts.pop(account_id, None)
+    return {"removed": True}
+
+@app.post("/api/scans", dependencies=[Depends(authorize)])
+async def create_scan(spec: ScanRequest):
+    if not spec.policy_confirmed:
+        raise HTTPException(422, "You must explicitly confirm program automation policy")
+    item = assets.get(spec.asset_id)
+    if not item:
+        raise HTTPException(404, "Asset not found")
+    try:
+        url, host = target_url(item)
+        public_host(host, os.environ.get("ALLOW_PRIVATE_TARGETS") == "1")
+    except ValueError as exc:
+        raise HTTPException(422, str(exc))
+    if spec.account_id:
+        profile = accounts.get(spec.account_id)
+        if not profile or profile["host"] != host:
+            raise HTTPException(422, "Account profile not found or host mismatch")
+    identifier = uuid.uuid4().hex
+    jobs[identifier] = {"id": identifier, "asset_id": spec.asset_id, "target": url,
+                        "status": "queued", "alerts": [], "error": None, "created": time.time(),
+                        "request_count": 0, "cancelled": False}
+    await queue.put((identifier, spec))
+    return {"id": identifier, "status": "queued"}
+
+@app.get("/api/scans", dependencies=[Depends(authorize)])
+def scan_list():
+    return list(jobs.values())[-100:]
+
+@app.get("/api/scans/{scan_id}", dependencies=[Depends(authorize)])
+def scan_status(scan_id: str):
+    if scan_id not in jobs:
+        raise HTTPException(404, "Scan not found")
+    return jobs[scan_id]
+
+@app.post("/api/scans/{scan_id}/cancel", dependencies=[Depends(authorize)])
+def cancel_scan(scan_id: str):
+    if scan_id not in jobs:
+        raise HTTPException(404, "Scan not found")
+    jobs[scan_id]["cancelled"] = True
+    return {"cancel_requested": True}
+
+async def zap_call(client, component, action, params=None):
+    response = await client.get(f"{ZAP_URL}/JSON/{component}/{action}/", params={**(params or {}), "apikey": ZAP_KEY})
+    response.raise_for_status()
+    data = response.json()
+    if "code" in data:
+        raise RuntimeError(str(data.get("message") or data["code"]))
+    return data
+
+async def worker():
+    while True:
+        identifier, spec = await queue.get()
+        job = jobs[identifier]
+        try:
+            if job["cancelled"]:
+                job["status"] = "cancelled"
+                continue
+            job["status"] = "running"
+            url, host = target_url(assets[spec.asset_id])
+            profile = accounts.get(spec.account_id) if spec.account_id else None
+            headers = {"User-Agent": spec.user_agent}
+            if profile:
+                headers.update(profile["headers"])
+                if profile["cookie"]:
+                    headers["Cookie"] = profile["cookie"]
+            # Every job uses ZAP's HTTP proxy to populate passive alerts. No active scanning.
+            async with httpx.AsyncClient(timeout=15, follow_redirects=False, trust_env=False,
+                                         proxy=ZAP_URL, verify=False) as client:
+                for i in range(spec.max_requests):
+                    if job["cancelled"]:
+                        break
+                    # Re-check every request, including DNS answers. Egress firewall is still recommended.
+                    public_host(host, os.environ.get("ALLOW_PRIVATE_TARGETS") == "1")
+                    try:
+                        response = await client.get(url, headers=headers)
+                        job["request_count"] += 1
+                        job["last_status"] = response.status_code
+                    except httpx.HTTPError as exc:
+                        job["error"] = f"Target fetch failed: {exc.__class__.__name__}"
+                        break
+                    if i + 1 < spec.max_requests:
+                        await asyncio.sleep(spec.delay_seconds)
+            if job["cancelled"]:
+                job["status"] = "cancelled"
+                continue
+            async with httpx.AsyncClient(timeout=20, trust_env=False) as z:
+                await asyncio.sleep(2)
+                # Filter results strictly to the requested URL/host, because ZAP session is shared.
+                info = await zap_call(z, "core", "view/alerts", {"baseurl": url, "start": "0", "count": "100"})
+                alerts = info.get("alerts", [])
+                job["alerts"] = [{
+                    "name": a.get("name"), "risk": a.get("risk"),
+                    "confidence": a.get("confidence"), "url": a.get("url"),
+                    "description": (a.get("description") or "")[:1000]
+                } for a in alerts if urlsplit(a.get("url") or "").hostname == host]
+            job["status"] = "completed"
+        except Exception as exc:
+            job["status"] = "failed"
+            job["error"] = str(exc)[:250]
+        finally:
+            # Never retain authenticated headers in logs or job history.
+            queue.task_done()

app/scope.py

@@ -0,0 +1,103 @@
+import csv
+import io
+import ipaddress
+import re
+import socket
+from urllib.parse import urlsplit
+
+WEB_TYPES = {"domain", "url", "website", "web application", "api"}
+LEVELS = {"none": 0, "low": 1, "medium": 2, "high": 3, "critical": 4}
+
+def yes(value):
+    s = str(value or "").strip().lower()
+    return s in {"true", "yes", "eligible", "1", "y"}
+
+def field(row, *aliases):
+    normalized = {re.sub(r"[^a-z0-9]", "", str(k).lower()): v for k, v in row.items() if k is not None}
+    for alias in aliases:
+        key = re.sub(r"[^a-z0-9]", "", alias.lower())
+        if key in normalized:
+            return str(normalized[key] or "").strip()
+    return ""
+
+def classify(identifier, asset_type):
+    name = identifier.strip()
+    kind = asset_type.lower().strip()
+    if "*" in name or kind in {"other", "android", "android: play store", "ios", "source code", "executable", "hardware"}:
+        return "manual"
+    if kind and kind not in WEB_TYPES:
+        return "manual"
+    try:
+        p = urlsplit(name if "://" in name else "https://" + name)
+        host = (p.hostname or "").lower().rstrip(".")
+        if p.scheme not in {"http", "https"} or not host or p.username or p.password:
+            return "manual"
+        if not re.fullmatch(r"[a-z0-9.-]+", host) or "." not in host:
+            return "manual"
+        if p.port not in (None, 80, 443, 8080):
+            return "manual"
+        return "web"
+    except ValueError:
+        return "manual"
+
+def parse_csv(content):
+    if len(content) > 2_000_000:
+        raise ValueError("CSV too large (max 2 MB)")
+    decoded = content.decode("utf-8-sig")
+    reader = csv.DictReader(io.StringIO(decoded))
+    if not reader.fieldnames:
+        raise ValueError("CSV is empty")
+    assets = []
+    for i, row in enumerate(reader):
+        if i >= 3000:
+            raise ValueError("Scope contains over 3000 entries")
+        name = field(row, "asset_identifier", "asset name", "asset", "identifier")
+        if not name:
+            continue
+        kind = field(row, "asset_type", "type")
+        bounty = field(row, "eligible_for_bounty", "bounty", "bounty eligible")
+        submission = field(row, "eligible_for_submission")
+        severity = field(row, "max_severity", "max. severity", "maximum severity").lower()
+        reports = field(row, "resolved reports", "resolved_reports", "resolved_reports_count")
+        m = re.search(r"\d+", reports)
+        assets.append({
+            "id": "asset-" + str(i + 1),
+            "name": name[:1000],
+            "type": kind[:100],
+            "compatibility": classify(name, kind),
+            "bounty": yes(bounty),
+            "submission": yes(submission) if submission else None,
+            "max_severity": severity if severity in LEVELS else "unknown",
+            "last_update": field(row, "last update", "last_updated", "updated_at")[:80],
+            "resolved_reports": int(m.group()) if m else None,
+            "description": field(row, "description", "instruction", "instructions", "asset description")[:3000],
+            "coverage": field(row, "coverage")[:200]
+        })
+    if not assets:
+        raise ValueError("No recognized asset names. Expected asset_identifier or Asset name column")
+    return assets
+
+def target_url(asset):
+    if asset["compatibility"] != "web":
+        raise ValueError("Only explicit web assets are scannable")
+    raw = asset["name"].strip()
+    p = urlsplit(raw if "://" in raw else "https://" + raw)
+    if p.query or p.fragment:
+        raise ValueError("Scope URL with query/fragment requires manual review")
+    return p.geturl(), (p.hostname or "").lower().rstrip(".")
+
+def public_host(host, allow_private=False):
+    if not re.fullmatch(r"[a-z0-9.-]+", host):
+        raise ValueError("Invalid hostname")
+    try:
+        addresses = {x[4][0] for x in socket.getaddrinfo(host, None, proto=socket.IPPROTO_TCP)}
+    except socket.gaierror as exc:
+        raise ValueError("DNS resolution failed") from exc
+    if not addresses:
+        raise ValueError("No DNS results")
+    if not allow_private:
+        for address in addresses:
+            ip = ipaddress.ip_address(address)
+            if not ip.is_global:
+                raise ValueError("Private, reserved, or non-global address not allowed")
+    return addresses

requirements.txt

@@ -0,0 +1,5 @@
+fastapi==0.115.12
+uvicorn==0.34.2
+python-multipart==0.0.20
+httpx==0.28.1
+pytest==8.3.5

start.sh

@@ -0,0 +1,6 @@
+#!/bin/sh
+set -eu
+: "${ASFB_API_KEY:?Set ASFB_API_KEY in Space secrets}"
+: "${ZAP_API_KEY:?Set ZAP_API_KEY in Space secrets}"
+/zap/zap.sh -daemon -host 127.0.0.1 -port 8090 -config "api.key=${ZAP_API_KEY}" -config api.addrs.addr.name=127.0.0.1 -config api.addrs.addr.regex=false > /tmp/asfb-zap.log 2>&1 &
+exec uvicorn app.main:app --host 0.0.0.0 --port 7860

tests/test_scope.py

@@ -0,0 +1,25 @@
+from app.scope import parse_csv, classify, target_url
+import pytest
+
+def test_hackerone_table():
+    csv = b"Asset name,Type,Max. severity,Bounty,Resolved Reports,Description\nweb.example.org,Domain,Critical,Eligible,24 (3%),Main app\n*.example.org,Other,High,Eligible,7 (1%),internal services\ncom.example.android,Android: Play Store,Critical,Eligible,72,app\n"
+    a = parse_csv(csv)
+    assert a[0]["compatibility"] == "web"
+    assert a[0]["resolved_reports"] == 24
+    assert a[0]["bounty"] is True
+    assert a[1]["compatibility"] == "manual"
+    assert a[2]["compatibility"] == "manual"
+
+def test_url_and_credential_handling():
+    assert classify("https://api.example.org/v1/", "URL") == "web"
+    assert classify("https://name:pass@example.org", "URL") == "manual"
+    assert classify("localhost", "Domain") == "manual"
+    assert classify("*.example.org", "Domain") == "manual"
+    with pytest.raises(ValueError):
+        target_url({"name": "*.example.org", "compatibility": "manual"})
+
+def test_unknown_and_headers():
+    a = parse_csv(b"asset_identifier,asset_type,eligible_for_bounty,eligible_for_submission,max_severity\na.example.org,DOMAIN,true,false,high\n")
+    assert a[0]["bounty"] is True
+    assert a[0]["submission"] is False
+    assert a[0]["max_severity"] == "high"