ersec - # ERSEC ## Evidence-Driven Application Security

项目说明

ERSEC 29.1.1 — Security Behavior Assurance Platform

ERSEC 29.1.1 is the current release identity. The product is built around one core loop: re security intent → bounded multi-principal assurance → semantic/downstream e → explicit uncertainty → regression contract → release decision.

29.1.1 Assurance Compiler

Compile a re YAML policy without contacting a target:

Normalize API and behavior in:

E imported runtime-control e:

the plan:

The compiler ne missing e into PASS. not_tested, blocked, inconclusive, and obser remain explicit. Runtime gateway configuration is not treated as proof of downstream authorization.

29.1.1 research direction

The 29.1.1 roadmap focuses on Security Behavior Assurance: a unified API/behavior in, re authorization policy, disposable multi-principal fixtures, stateful business-flow , semantic and authoritati, metamorphic relations, mutation adequacy, runtime-control e, counterfactual e bundles, safe CI integration, reproducible benchmarks, and proof-carrying release decisions.

The defensible novelty is the integrated assurance workflow—not a claim that indi components such as authorization matrices or metamorphic testing were in by ERSEC.

ERSEC 29.1.1 — Semantic Authorization Assurance

This release begins the focused authorization-assurance wedge. With an explicit Security Behavior Model, ERSEC can e modeled identity/resource cells using expected status and bounded response-field semantics, calculate assurance co, and emit minimal counterexamples when a property is .

A deterministic loopback laboratory fixture is included for de and benchmark work. Export the starter ground-truth corpus with:

Write semantic assurance during a modeled run with:

Untested or unobservable cells are ne as secure. Response are not persisted by the semantic field observer; only bounded field paths are retained.

E application security and security-behavior

ERSEC is a defensi platform for authorized web and API assessments. It combines broad bounded discovery and detection with a Security Behavior Graph, e/proof records, multi-identity and workflow reasoning, a Security Control Plane, re security contracts, risk-budget planning, and the ERSEC Shield application-layer enforcement point.

The goal is not to ad the largest detector count. The goal is to make important security behavior observable, explainable, reproducible, and continuously testable.

> Current release: 29.1.1

ERSEC 29.1.1 — Security Reality Fabric

29.1.1 introduces the Security Reality Fabric: a deterministic claim graph that connects obser surface, security findings, beha in, contracts, and go. It computes a canonical reality digest, an explainable causal risk spine, and an Assurance Frontier that recommends the smallest safe next obser for the highest-impact unknowns. It also provides a conser semantic diff for longitudinal security regressions.

See docs/research-direction-29.0.md.

ERSEC 29.1.1 — Assurance Kernel & Proof-Carrying Release

29.1.1 now has a deterministic Assurance Kernel on top of the Security Reality Fabric. Instead of asking only whether a scanner found something, ERSEC can compile an explicit security constitution into proof obligations and produce a release artifact that says exactly what is proven, what failed, and what remains unknown.

Key properties:

Example:

A BLOCKED result is intentionally a release stop: it means ERSEC cannot prove a required obligation from the e a. It is not a claim that the application is compromised. Likewise, PASS means the configured obligations were proven to the configured e thresholds; it is not a uni proof of security.

> Testing model: authorized, bounded, non-destructive by default
> AI model: deterministic security analysis is the source of truth; optional local model assistance is not required for core operation

ERSEC 29.1.1

ERSEC 29.1.1 — Semantic Authorization Assurance

This release begins the focused authorization-assurance wedge. With an explicit Security Behavior Model, ERSEC can e modeled identity/resource cells using expected status and bounded response-field semantics, calculate assurance co, and emit minimal counterexamples when a property is .

A deterministic loopback laboratory fixture is included for de and benchmark work. Export the starter ground-truth corpus with:

Write semantic assurance during a modeled run with:

Untested or unobservable cells are ne as secure. Response are not persisted by the semantic field observer; only bounded field paths are retained.

29.1.1 focuses on the engineering foundation: atomic report serialization, controlled loopback integration fixtures, and safe artifact handling while preserving the existing security-assurance interfaces.

This release completes the next trust-focused engineering step: model findings share the common finding pipeline, benchmark quality is explicit, incomplete scans are to CI, request-budget exhaustion is reported cleanly, and failure-injection co is expanded.

---

What ERSEC is becoming

ERSEC 29.1.1 extends the platform from inferred behavior to an operator-declared security model when teams ha knowledge of their identities, tenants, resources and security policy.

A con scanner answers:

> “What suspicious responses did I observe?”

ERSEC 29.1.1 asks a wider set of security-behavior questions:

> “Which identities, resources, workflows and controls exist?”
> “What security behavior is in?”
> “Where does that behavior change?”
> “What e proves the change?”
> “Can the same property become a regression contract?”
> “What changed since the previous run?”
> “Can a narrowly scoped compensating control reduce exposure while the real fix is being de?”

This direction is consistent with the industry's focus on authorization, sensiti flows, resource consumption and API security rather than relying only on payload signatures. OWASP's API Security Top 10 emphasizes authorization heavily and explicitly includes unrestricted access to sensiti flows and unrestricted resource consumption. OWASP API Security Top 10

---

Architecture

---

Core capabilities

Discovery

ERSEC can disco surface through:

Missing optional browser tooling is handled as a fallback condition rather than being treated as proof of a clean application.

Detection

The current release contains the established ERSEC detector registry plus deeper beha/differential engines co areas such as authentication, authorization, injection signals, API exposure, caching, browser security, configuration, request normalization, and application-specific business-flow signals.

Detector count is deliberately not treated as the primary quality metric. A registered detector is not equi to a guaranteed true-positive rate or complete co.

Multi-identity authorization reasoning

ERSEC can compare explicitly supplied authorized identities across application resources and workflows.

Example identities:

Comparison dimensions include:

Timing is treated as supporting e, not standalone proof.

---

Security Behavior Graph

The flagship beha capability is a deterministic model of security-relevant application behavior.

The graph can represent:

The graph connects e to the resource or state where it was observed.

Conceptually:

The graph is not decorative. Its purpose is to gi teams a stable representation that can be compared, exported and turned into regression contracts.

---

Explicit Security Behavior Model

ERSEC 29.1.1 continues the strict, declarati for teams that want to encode known authorization policy rather than relying only on inference. The model is intentionally separate from credentials: it contains identity names, roles, tenants, resources, expected read-only outcomes, in, and workflow transitions. Runtime tokens remain in the operator's en.

a model without contacting a target:

Use a model during an authorized scan:

A minimal model looks like:

The built-in is deliberately read-only: only GET, HEAD, and OPTIONS can be modeled for execution. A missing identity credential becomes not_tested, not an implicit authorization decision.

Security in

ERSEC can represent statements such as:

These are security properties, not generic signatures.

---

Proof-carrying findings

Every important finding can be represented as a structured proof capsule using the ERSEC proof schema.

The record includes:

1. obser;
2. baseline a;
3. detector reasoning;
4. e score;
5. impact context;
6. limitations;
7. replay information;
8. remediation information;
9. integrity information.

Example shape:

ERSEC intentionally does not persist authentication credentials inside proof capsules.

---

Explicit result semantics

ERSEC distinguishes uncertainty rather than con it into a larger count.

| Classification | Meaning |
|---|---|
| confirmed | Controlled e established the stated behavior with strong e. |
| likely | E strongly supports the behavior, but an important condition requires review. |
| signal / possible | Suspicious behavior was obser sufficient proof. |
| inconclusive | Testing could not support a reliable determination. |
| not_tested | Required context was una. |

A clean scan is therefore not equi to “secure.”

---

Security contracts

ERSEC can compile obser and in into a machine-readable contract bundle.

Generated artifacts include:

Generated finding-regression tests are deliberately drafts. ERSEC does not invent an application-specific “safe response” predicate that the e ne.

Review and replace the draft predicate with the application's real security expectation before enabling it as a release gate.

This turns ERSEC from a point-in-time scanner into a source of repeatable security controls.

---

Risk-budget scheduler

Security testing is not only about the number of requests. It is also about information gained per unit of cost and risk.

ERSEC 29.1.1 exposes a bounded risk-budget planner that considers signals such as:

Run with:

The report records selected and skipped candidates so incomplete co is instead of silently appearing complete.

---

Authorization manifest

For higher-assurance engagements, create an explicit authorization manifest.

Example:

Use it with:

The manifest adds a second authorization layer abo scanner scope.

With a supplied manifest, requests are denied when they fall outside its hosts, ports, paths, methods, or authorized testing window. A pri deny policy also fails closed when a destination resolves to a private, loopback, link-local, multicast, or unspecified address.

This does not replace organizational authorization procedures. It is an additional technical guardrail.

---

Stateful test simulator

State-changing operations require more care than read-only obser.

ERSEC can produce a dry-run preview of stateful forms without submitting them:

The preview is not e that the state change occurred.

Safe automation should not invent rollback procedures for application-specific state transitions.

---

ERSEC Shield

ERSEC Shield is an application-layer reverse proxy / WAF-style enforcement point. It is not a replacement for a network firewall.

OWASP describes patching as a compensating enforcement layer for known and recommends positi models where the expected input characteristics can be established. It also emphasizes that patching is risk reduction and does not replace fixing the application itself. OWASP Patching Cheat Sheet

Shield supports:

Start it locally:

Compile a narrow policy from a report:

Rules generated from e carry go metadata including:

By default generated patches have a finite review horizon rather than pretending that a temporary control is a permanent code fix.

---

Positi direction

The long-term Shield strategy is to move from mostly negati toward selecti en where application behavior is stable enough to establish expected input and route characteristics.

That means learning statements such as:

rather than trying to maintain an e list of exploit strings.

This is intentionally incremental. A learned contract is only useful when its false-positive risk is understood.

---

Security Control Plane

The Security Control Plane turns a scan into persistent application-security state.

It provides:

Example SLO concepts:

These are operator policy examples, not uni compliance requirements.

Persist the control-plane state:

---

Cross-run security state

ERSEC can compare current and previous application-security state.

The output can identify:

This is what lets ERSEC behave like a continuous security control rather than a report generator that starts from zero each time.

---

Beha memory and drift

ERSEC maintains local beha memory and security behavior genome information where configured.

Longitudinal reasoning can help identify:

This complements rather than replaces code review and change management.

---

API security

ERSEC includes API-oriented discovery and reasoning for REST, GraphQL and gRPC-like surfaces.

The API layer is designed around the kinds of problems highlighted by OWASP's API Security Top 10, including object/function authorization, property-le, resource consumption, sensiti flows, SSRF, in, and unsafe API consumption. OWASP API Security Top 10

ERSEC can therefore reason about more than “did this payload generate an error?”

It can compare:

---

Business-flow security

Some of the hardest API security issues are business-specific.

ERSEC identifies review surfaces around things such as:

The goal is to establish an in and test whether alternate endpoints or identities it, not to automate harmful transactions.

OWASP explicitly identifies sensiti protection as a distinct API security concern because abuse can cause business harm even when a classic technical is not present. OWASP API Security Top 10

---

E remediation

The built-in advisor is local and deterministic by default.

It can:

Optional local GGUF model support can assist explanation/triage, but the model is not the source of truth.

ERSEC does not upload application e to a remote AI service as part of the default advisor path.

---

Policy as code

ERSEC can export security-oriented policy artifacts for de review, including Semgrep/OPA-oriented material.

The correct engineering pattern is:

not:

---

Benchmark and quality measurement

ERSEC includes benchmark plumbing for local benchmark reports and operator-supplied truth data.

The quality layer can calculate:

The metric is only meaningful when the benchmark oracle is trustworthy and representative.

A serious benchmark program should include:

The project roadmap explicitly treats benchmarked detector quality as more meaningful than detector count.

---

Safety model

ERSEC is designed around bounded authorized testing.

The HTTP client enforces controls such as:

ERSEC deliberately avoids general-purpose workflows for:

A finding is e for a security condition, not an in to weaponize it.

---

Installation

PyPI

Then:

From source

---

Basic usage

Deep assessment:

Maximum bounded co:

JSON/HTML report:

---

High-assurance scan example

---

CLI reference: assurance commands

Existing ERSEC scanning, reporting, re-, memory, policy, IDE, benchmark, browser, workflow and Shield options remain a.

Inspect the installed CLI for the authoritati set:

---

Security category registry

The canonical registry is exposed so integrations can consume a consistent security :

This registry associates supported categories with:

This is an important architectural control: detector semantics and runtime enforcement should not maintain separate incompatible copies of the taxonomy.

---

Re-

Re-run exact recorded e against an authorized target:

Audit the history:

---

Release engineering

The GitHub repository includes CI intended to :

1. Python compatibility;
2. source compilation;
3. ERSEC self-tests;
4. pytest smoke tests;
5. build distribution ;
6. installation of the actual built wheel;
7. release-/tag consistency;
8. GitHub artifact pro;
9. PyPI Trusted Publishing.

PyPI's current Trusted Publishing documentation recommends the PyPA publish action with job-level id-token: write permission and a dedicated en. PyPI Trusted Publishing

The PyPI publishing action also generates and uploads PyPI attestations by default when configured with Trusted Publishing. PyPI Trusted Publishers

GitHub artifact attestations provide an additional build-pro mechanism for release artifacts. GitHub Artifact Attestations

---

ERSEC follows a con major/minor/patch release model for the public project.

For every release, keep these aligned:

The CI release workflow checks the Git tag against the declared in pyproject.toml.

---

Project maturity rules

The project deliberately adopts the following rules:

A capability is not complete because a class exists.

Its output must reach a supported workflow and be tested.

A finding is not stronger because its se is higher.

E and confidence must justify the result.

A patch is not a source-code fix.

It is a compensating control with review and rollback metadata. OWASP explicitly frames patching as risk reduction rather than a substitute for fixing the application. OWASP Patching Cheat Sheet

A green scan is not proof of security.

Co limitations remain .

More detector names do not automatically mean a better product.

Benchmark precision, reproducibility, e quality and regression value matter more.

---

Limitations

ERSEC cannot guarantee absence of .

Important limitations include:

The Security Behavior Graph and contracts impro and e quality; they do not eliminate the need for human security engineering judgment.

---

Legal and authorization notice

Only use ERSEC against systems you own or systems for which you ha permission to perform security testing.

An authorization manifest is a technical guardrail, not legal authorization.

Do not use ERSEC to:

---

Contributing

See CONTRIBUTING.md.

Security-related contributions should include tests, e semantics, safety considerations, and documentation of blind spots.

---

Security reporting

See SECURITY.md for responsible disclosure guidance.

Do not place real secrets, credentials or private customer data in public issues or pull requests.

---

License

ERSEC is distributed under the MIT License. See LICENSE.

---

Research references

The research direction for ERSEC is intentionally centered on e, authorization behavior, safe enforcement, reproducible controls, and release integrity rather than AI branding or detector-count inflation.

ERSEC 29.1.1 — Release focus

This release packages the Security Behavior Graph, explicit Security Behavior Model, read-only authorization , counterexample paths, authorization matrix, go security contracts, release assurance, SBOM generation, benchmark scaffolding, and the application-layer Shield in one distribution.

Quality contract

ERSEC treats the following as first-class release requirements:

The public release is 29.1.1.

Authorization assurance (29.1.1)

Export a deterministic authorization matrix from a re security model with --authorization-matrix-v2. Credential inputs are opaque references, never raw secret . Remediation comparison requires an explicit later pass before a previous is considered resolved.

Research comparison benchmark

ERSEC 29.1.1 adds a comparison-ready authorization benchmark analysis that separates re policy truth from obser, reports false positi and uncertainty, and fingerprints the corpus and comparison rules. Run it only against the included loopback laboratory.

See docs/authorization-research-benchmark-v8.md.

Research benchmark starter

Run the deterministic local multi-tenant authorization benchmark with ersec --authorization-benchmark RESULT.json. The fixture is loopback-only, read-only, and uses operator-re ground truth.

Research review (2026-09)

ERSEC's current research position was re against official documentation from ZAP, Burp Scanner, Schemathesis, Nuclei and OWASP API Security. See docs/research-re.md. The review intentionally avoids claiming stateful scanning, authentication, workflows or access-control matrices as in; ERSEC focuses on semantic authorization properties, authoritati, co and longitudinal e.

Security Behavior Assurance v1

ERSEC 29.1.1 adds property-le lineage, an Oracle Trust Lattice, conser remediation deltas, and an Assurance Frontier. These are research/assurance mechanisms: they distinguish strong e from weak or una obser and never turn untested behavior into PASS.

ERSEC 29.1.1 — Assurance Execution & Release Hardening

29.1.1 hardens the shipped assurance boundary: runtime/package are aligned, loopback fixture lifecycle handling is corrected, and regression fixtures are included in source distributions. The trust rules from 29.1.1 remain unchanged: untested or unobservable behavior is ne as secure, and acti remains bounded and authorized.

ERSEC 29.1.1 — Assurance Intelligence

ERSEC 29.1.1 adds an additional deterministic assurance layer above the Security Reality Fabric and Assurance Kernel.

Reality Gap Engine

Compare a 29.1.1 Reality artifact against an operator declaration and identify declared-but-unobser surface or security claims. A gap is ne interpreted as a , and disappearance of an obser is ne as a fix.

Proof Debt

Claims with missing, weak, uncertain, or stale e accumulate measurable proof debt. This lets teams prioritize assurance work even when the raw finding count has not changed.

Next-Best Assurance

ERSEC 29.1.1 can rank bounded, non-destructi obser by expected uncertainty reduction, cost, and safety risk under an explicit obser budget.

Security Impact Cone

The model highlights high-impact claims with strong graph connectivity and uncertainty. This is an attention score, not exploit probability.

Compare assurance state

Recommended 29.1.1 workflow

The deterministic gate remains authoritative. AI is optional and ne the final security trust boundary.

ERSEC 29.1.1 reproducible assurance laboratory

ERSEC 29.1.1 now includes a loopback-only benchmark laboratory that separates public, release, and deterministic held-out authorization cases and records TP/FP/FN/TN, precision, recall, F1, false-positive rate, inconclusi, request/runtime cost, fixture cleanup, mutation adequacy, and reproducibility digests.

Run it with:

See docs/assurance-benchmark-lab-29.1.1.md for the methodology and e contract. The laboratory does not contact user-supplied targets.

ERSEC 29.1.1 — Continuous Assurance

29.1.1 now includes deterministic release-lineage snapshots and continuous assurance contracts that compare successi bundles. A PASS claim that becomes unknown, blocked, inconclusive, or not-tested is surfaced as a release regression; missing e is ne as remediation.

29.1.1 roadmap co audit

Run python ersec.py --roadmap-audit . --roadmap-audit-out roadmap-co.1.1.json to generate a deterministic implementation/test/e map for the ten core 29.1.1 roadmap features. The auditor deliberately reports PARTIAL while explicit gaps remain.

ERSEC 29.1.1 — concurrent security assurance

The 29.1.1 assurance boundary now includes ersec_concurrent_assurance.py, which compiles bounded race-sensiti scenarios for an authorized harness. Supported families include TOCTOU, double-submit, quota races, tenant-context races, and idempotency races. The planner is offline-only and ne targets or accepts credential material; target-side concurrency remains an explicit harness responsibility.

Example:

ERSEC 29.1.1 V18

Added deterministic stateful producer/link learning for OpenAPI Links, Location , producer fields, and authorized-harness deri, plus broader downstream authoritati adapters.

ERSEC 29.1.1 maturity closure

ERSEC 29.1.1 now includes deterministic build/package assurance, Debian source packaging assets, digest-pinned container construction, reproducibility manifests, and a public-e scorecard that refuses to fabricate external benchmark results.

Useful commands:

The 29.1.1 engineering roadmap is closed when these local gates pass. En (real container runtime, independent clean rebuild, and external public benchmark deployments) is explicitly represented as a gate rather than silently treated as completed.

ERSEC 29.1.1 publication

The controlled publication procedure is documented in docs/publish-github-pypi-29.1.1.md. Production PyPI publication uses GitHub OIDC/Trusted Publishing rather than a long-lived API token.

ERSEC 29.1.1 - Live

项目信息

开发语言：Python

Star 数：4

技术要点

该项目属于防护思路方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕# ERSEC ## Evidence-Driven Application Security Platform ERSEC is a defensive web and application-security platform designed to go beyond the traditional model of **crawl → probe → list vulnerabilities**.展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。