aiptx scan https://example.com

aiptx scan https://app.example.com https://api.example.com

aiptx scan --config ./aiptx.yaml

# aiptx.yaml
target:
  urls:
    - https://app.example.com
    - https://api.example.com

scan:
  mode: standard
  type: full

authentication:
  type: bearer
  token: ${AIPTX_AUTH_TOKEN}  # Environment variable

scope:
  include:
    - /api/*
    - /app/*
  exclude:
    - /api/health
    - /api/metrics
    - /admin/*

headers:
  X-Custom-Header: "value"
  X-Request-ID: "aiptx-scan"

rate_limit:
  requests_per_second: 10
  concurrent_requests: 5

scope:
  include:
    - /api/v1/*
    - /api/v2/*
    - /users/*
    - /orders/*

scope:
  exclude:
    - /health
    - /metrics
    - /admin/*
    - /internal/*
    - *.pdf
    - *.css
    - *.js

scope:
  domains:
    - example.com
    - api.example.com
  exclude_domains:
    - analytics.example.com
    - cdn.example.com

authentication:
  type: bearer
  token: "eyJhbGciOiJIUzI1NiIs..."

authentication:
  type: basic
  username: "testuser"
  password: "${AIPTX_PASSWORD}"

authentication:
  type: cookie
  cookies:
    session_id: "abc123"
    csrf_token: "xyz789"

authentication:
  type: custom
  headers:
    Authorization: "Bearer ${TOKEN}"
    X-API-Key: "${API_KEY}"

authentication:
  type: login
  login_url: "https://example.com/login"
  credentials:
    username_field: "email"
    username: "[email protected]"
    password_field: "password"
    password: "${AIPTX_PASSWORD}"
  success_indicator: "Dashboard"

api:
  spec: ./openapi.yaml
  # or remote URL
  spec: https://api.example.com/openapi.json

api:
  type: graphql
  endpoint: https://api.example.com/graphql
  introspection: true

api:
  endpoints:
    - method: POST
      path: /api/users
      body:
        name: "{{fuzz}}"
        email: "{{fuzz}}@example.com"

    - method: GET
      path: /api/users/{{user_id}}
      params:
        user_id: ["1", "2", "admin"]

rate_limit:
  requests_per_second: 10
  concurrent_requests: 5
  delay_between_requests: 100  # milliseconds

  # Respect server rate limits
  respect_retry_after: true

  # Back off on errors
  backoff:
    enabled: true
    initial_delay: 1000
    max_delay: 30000
    multiplier: 2

# aiptx.dev.yaml
target:
  urls:
    - https://dev.example.com

scan:
  mode: quick

rate_limit:
  requests_per_second: 50

# aiptx.staging.yaml
target:
  urls:
    - https://staging.example.com

scan:
  mode: standard

# aiptx.prod.yaml
target:
  urls:
    - https://example.com

scan:
  mode: standard

rate_limit:
  requests_per_second: 5

schedule:
  time: "02:00"
  timezone: "UTC"

authentication:
  token: ${AIPTX_AUTH_TOKEN}

api:
  key: ${API_KEY}

export AIPTX_AUTH_TOKEN="your_token"
export API_KEY="your_api_key"
aiptx scan --config ./aiptx.yaml

aiptx config validate ./aiptx.yaml

Configuration validation results:
  Target URLs: 2 valid
  Authentication: Configured (bearer)
  Scope: 4 include patterns, 3 exclude patterns
  Rate Limit: 10 req/s, 5 concurrent

Configuration is valid.