# ---------------------------------------------------------------------------
# Website Security Assessment — example configuration.
# Copy to `.env` and adjust. NEVER commit a real .env with secrets.
# ---------------------------------------------------------------------------

# --- Server ---
HOST=127.0.0.1
PORT=8000
DEBUG=false
LOG_LEVEL=INFO

# --- Safety / scope ---
# Keep this FALSE except in an isolated lab you fully control. When false the
# scanner refuses private / loopback / link-local / reserved targets.
ALLOW_PRIVATE_TARGETS=false

# Network TCP port scanning. Off unless explicitly enabled by the operator.
ENABLE_PORT_SCAN=true
DEFAULT_PORTS=21,22,25,53,80,110,143,443,465,587,993,995,3306,3389,5432,6379,8080,8443
MAX_PORTS_PER_SCAN=128

# --- Timeouts & concurrency (seconds) ---
HTTP_TIMEOUT=10
TLS_TIMEOUT=10
DNS_TIMEOUT=5
PORT_CONNECT_TIMEOUT=2
TOTAL_SCAN_TIMEOUT=180
MAX_CONCURRENT_PORTS=16
MAX_CONCURRENT_SCANS=4
MAX_REDIRECTS=3

# --- Vulnerability intelligence ---
ENABLE_VULN_LOOKUP=true
OSV_ENABLED=true
NVD_ENABLED=true
GHSA_ENABLED=true
VULN_CACHE_TTL=86400
VULN_CACHE_DIR=.cache/vuln

# API keys are OPTIONAL. Only set them if you have them; they raise rate limits.
# NVD works without a key (5 req / 30s). With a key: 50 req / 30s.
NVD_API_KEY=
# GitHub token (optional) for GitHub Security Advisories, higher rate limits.
GITHUB_TOKEN=

# --- Scoring weights (normalized at load; need not sum to exactly 1.0) ---
WEIGHT_TLS=0.22
WEIGHT_HEADERS=0.18
WEIGHT_APPLICATION=0.14
WEIGHT_DNS=0.13
WEIGHT_PORTS=0.10
WEIGHT_VULNERABILITIES=0.18
WEIGHT_OTHER=0.05