.env.example

################################################################################
# BugTraceAI-CLI Environment Configuration
# 
# LOCAL DEPLOYMENT ONLY - This is a private tool for your network
# Copy this file to .env and configure for your setup:
#   cp .env.example .env
#   nano .env  # Add your API keys and customize
#
# ⚠️  WARNING: Do NOT expose this API to the internet without:
#   - Authentication enabled
#   - CORS restricted to known origins
#   - Firewall rules limiting access
################################################################################

# ==============================================================================
# SECTION 1: LLM PROVIDER CREDENTIALS (REQUIRED)
# ==============================================================================

# OpenRouter API Key (REQUIRED for scanning)
# Get your key from: https://openrouter.ai/keys
# Format: sk-or-v1-[64 hex characters]
# Cost: Usage-based (pay per request via OpenRouter)
OPENROUTER_API_KEY=sk-or-v1-your-api-key-here

# GLM API Key (Optional - alternative LLM provider)
# Get key from: https://open.bigmodel.cn/ (Zhipu AI)
# Used as fallback if OpenRouter is unavailable
# GLM_API_KEY=your-glm-api-key-here

# ==============================================================================
# SECTION 2: NETWORK & DEPLOYMENT (RECOMMENDED)
# ==============================================================================

# CORS Origins - Allowed frontend origins for API
# Format: Comma-separated list of http://host:port
# 
# LOCALHOST ONLY (Default - Recommended):
#   BUGTRACE_CORS_ORIGINS=http://localhost:5173,http://localhost:3000
#
# LAN ACCESS (Within network only):
#   BUGTRACE_CORS_ORIGINS=http://localhost:5173,http://192.168.1.50:5173,http://192.168.1.100:3000
#
# ⚠️  NEVER use wildcard (*) in production or LAN deployments
# ⚠️  NEVER expose API port to internet without proxy authentication
#
BUGTRACE_CORS_ORIGINS=http://localhost:5173,http://localhost:3000,http://localhost:6869

# API Server Binding
# Set when using: python -m bugtrace serve
# 127.0.0.1 = localhost only (most secure)
# 0.0.0.0   = all interfaces (LAN access, less secure)
#
# API_HOST=127.0.0.1        # Localhost only
# API_PORT=8000             # Default port
API_HOST=127.0.0.1
API_PORT=8000

# ==============================================================================
# SECTION 3: LLM MODEL SELECTION (OPTIONAL)
# ==============================================================================

# Format: provider/model-name (must use OpenRouter-compatible models)
# OpenRouter supports: Qwen, Claude, DeepSeek, Gemini, Grok, etc.
# See: https://openrouter.ai/docs#models

# Main model for analysis & reasoning (default: Qwen)
# DEFAULT_MODEL=qwen/qwen3-coder
# CODE_MODEL=qwen/qwen3-coder
# ANALYSIS_MODEL=qwen/qwen3-coder

# Vision model for XSS screenshot validation (default: Gemini)
# VISION_MODEL=google/gemini-3-flash-preview

# Mutation model for payload generation (default: Grok - fewer safety restrictions)
# MUTATION_MODEL=x-ai/grok-4-fast

# Skeptical review model (quick review agent)
# SKEPTICAL_MODEL=anthropic/claude-haiku-4.5

# Reporting model (PoC generation, CVSS scoring)
# REPORTING_MODEL=anthropic/claude-haiku-4.5

# ==============================================================================
# SECTION 4: RUNTIME BEHAVIOR (OPTIONAL)
# ==============================================================================

# Environment: development, staging, production
# ENV=production

# Debug mode (verbose logging)
# DEBUG=false

# Safe mode (limit aggressive payloads)
# SAFE_MODE=false

# Stop scanning after finding a critical vulnerability
# STOP_ON_CRITICAL=true

# Early exit when finding vulnerability on first parameter
# EARLY_EXIT_ON_FINDING=false

# ==============================================================================
# SECTION 5: PARALLELIZATION & PERFORMANCE (OPTIONAL)
# ==============================================================================

# Max concurrent DAST analysis per discovery phase
# Higher = faster but more resource usage
# MAX_CONCURRENT_DISCOVERY=5

# Max concurrent specialist agents (XSS/SQLi/etc)
# MAX_CONCURRENT_SPECIALISTS=10

# Worker pool size per agent
# WORKER_POOL_DEFAULT_SIZE=5
# WORKER_POOL_XSS_SIZE=8

# ==============================================================================
# SECTION 6: VALIDATION & FILTERING (OPTIONAL)
# ==============================================================================

# Enable vision-based XSS validation (requires VISION_MODEL)
# VALIDATION_VISION_ENABLED=true

# Use Chrome DevTools Protocol for XSS validation
# CDP_ENABLED=true

# False positive confidence threshold (0.0-1.0)
# Lower = more findings (more false positives)
# Higher = fewer findings (may miss true issues)
# FP_CONFIDENCE_THRESHOLD=0.5

# Consensus votes required for finding acceptance
# 1 = Fastest, 2-3 = More accurate
# CONSENSUS_VOTES=2

# ==============================================================================
# SECTION 7: SECURITY SCANNING BEHAVIOR (OPTIONAL)
# ==============================================================================

# Mandatory SQLMap validation (always test SQL injection)
# MANDATORY_SQLMAP_VALIDATION=true

# Skip already-validated parameters in same scan
# SKIP_VALIDATED_PARAMS=true

# Scan depth: quick, standard, thorough
# SCAN_DEPTH=standard

# Allow self-signed SSL certificates
# ALLOW_SELF_SIGNED_CERTS=false

# Verify SSL certificates
# VERIFY_SSL_CERTIFICATES=true

# ==============================================================================
# SECTION 8: OUT-OF-BAND (OOB) CALLBACKS (OPTIONAL)
# ==============================================================================

# OOB platform for SSRF/XXE/etc callbacks
# interactsh.com (default), oast.fun, etc.
# INTERACTSH_SERVER=oast.fun

# Poll interval for OOB callbacks (seconds)
# INTERACTSH_POLL_INTERVAL=60

# ==============================================================================
# SECTION 9: ADVANCED / INTERNAL (RARELY CHANGED)
# ==============================================================================

# Queue persistence mode: memory (default) or redis (future)
# QUEUE_PERSISTENCE_MODE=memory

# Max queue depth per specialist
# QUEUE_DEFAULT_MAX_DEPTH=1000

# Request rate limit per queue (items/second)
# 0 = unlimited
# QUEUE_DEFAULT_RATE_LIMIT=100.0

# Thinking mode: streaming (default) or batch
# THINKING_MODE=streaming

# Batch processing concurrency
# BATCH_DAST_CONCURRENCY=5

################################################################################
# QUICK START CHECKLISTS
################################################################################

# ✅ Minimal Setup (Just scan):
#   1. Add OPENROUTER_API_KEY
#   2. Leave rest as default
#   3. Run: python -m bugtrace scan https://example.com

# ✅ Local Dev with Web UI:
#   1. Add OPENROUTER_API_KEY
#   2. Set BUGTRACE_CORS_ORIGINS to your frontend ports
#   3. Run API: python -m bugtrace serve
#   4. Access: http://localhost:8000/docs

# ✅ LAN-Only Deployment:
#   1. Add OPENROUTER_API_KEY
#   2. Set API_HOST=0.0.0.0 (enable LAN)
#   3. Set BUGTRACE_CORS_ORIGINS with all LAN IPs
#   4. Run API: python -m bugtrace serve --host 0.0.0.0
#   5. Access from other machines: http://HOST_IP:8000

# ⚠️  SECURITY REMINDERS:
#   - Keep API keys private (never commit .env)
#   - Don't expose API to internet without authentication
#   - Use HTTPS in production (requires reverse proxy)
#   - Rotate API keys regularly
#   - Monitor resource usage (agents consume CPU)

################################################################################