ROADMAP.md

Roadmap

Phase 0 — Foundation (v1.0, this release)

• OpenAPI-driven resource detection
• Multi-identity ownership discovery
• Probes: BOLA, IDOR/enumeration, enumerable-ID, missing-auth, existence-oracle
• Console / JSON / Markdown / JUnit reporters + severity-gated exit code
• Vulnerable + secure demo targets, tests, CI, Docker
• Authorized-use guardrail for non-local targets

Phase 1 — Write coverage & auth flows (v1.1)

• Test object-level authz on write verbs (PUT/PATCH/DELETE), not just GET.
• Login flows (POST credentials, extract bearer/cookie) in addition to static headers.
• Nested/related-resource IDOR (e.g. /reqs/{r}/applications/{a}).

Phase 2 — Depth (v1.2)

• Function-level authorization (BFLA / API5) checks across roles.
• Enumeration rate-limit / throttling detection as an active probe.
• Configurable ownership assertions beyond id_field (response body matchers).

Phase 3 — Ecosystem (v1.3)

• GitHub Action wrapper and SARIF output for code-scanning UIs.
• Postman/HAR import as an alternative to OpenAPI.
• Baseline/diff mode to only fail on new findings.

Non-goals

• Exploitation beyond read-access proof; AuthProbe demonstrates a flaw, it does not weaponize it.
• Scanning targets without authorization.