# Penetration-test scope

Hand this to an external tester on day one. It is a map, not a certificate.
There is **no independent pentest on file**. Completing this document does
not change that.

English only. No price, no duration, no firm names.

## In scope

| Surface | What to hit | Expected behaviour (violation = finding) |
|---|---|---|
| MCP stdio / HTTP | `query`, `list_tables`, `describe_table`, `search` | Denied table → deny + receipt. Write SQL → refuse. Multi-statement → refuse. Row cap applied. Masked columns never reach the model in the clear. |
| SQL gate | UNION, quoted identifiers, function calls, `; DROP`, comments | Parser + `guardQuery` reject writes and unknown shape. A query that returns a denied table's data is a finding. |
| Receipt chain | Edit a line, swap two lines, delete a middle line, delete the tail, strip `sig` | `conarium-verify --pubkey` exits 10/11/12/13 as documented in `docs/RECEIPT-SPEC.md`. Tail delete **without** `--expect-count` exiting 0 is documented, not a finding. Tail delete **with** `--expect-count` exiting 0 is a finding. |
| Console | Auth, CSRF, session cookie, rate limit, config save | No token → 401/403. CSRF missing on cookie POST → 403. Rate limit before auth. Half-written config after crash is a finding. Bind default is `127.0.0.1`; a default bind on `0.0.0.0` is a finding. |
| Config loader | Missing file, empty `allowConnectors`, broken JSON, ReDoS-shaped `customPatterns` | Missing file → gateway starts empty (documented; doctor must flag it). Empty `allowConnectors` → deny all / refuse boot. Broken pattern → config rejected. |
| HTTP sessions | Reuse `Mcp-Session-Id` with a *different* valid token | 403. Same token → proceed. `test/session_owner.test.mjs`. |
| OpenAPI connector | SSRF / private-range redirect | HTTPS required. Host must be on `allowedBaseUrls`. DNS rebinding TOCTOU is a **known accepted gap** — see `SECURITY.md`. Report it if you can exploit it without an operator-controlled hostname; that would upgrade the finding. |

## Out of scope

- The operator's Postgres (or other) server itself.
- OS / hypervisor / physical access.
- Social engineering of the one-person team.
- Denial-of-service against public OpenTimestamps calendars or `blockstream.info`.
- Asking the model to "ignore previous instructions" as a *product* finding
  unless it produces a policy bypass in the gateway (the model is not the gate).

## How to stand it up (first morning)

```bash
git clone https://github.com/dogrucanemek-alt/conarium.git
cd conarium
npm ci
npm run build
npx tsc --noEmit
```

Write a throwaway config with `npx conarium-init --out /tmp/cnr-pt`.
Point the Postgres URL at a **disposable** database you control.
Fill `policy.allowTables`. Export `CONARIUM_AUDIT_SIGNING_KEY`.

```bash
npx conarium-doctor --config /tmp/cnr-pt/conarium.config.json --no-net
# stdio MCP
npx conarium --config /tmp/cnr-pt/conarium.config.json
# console (loopback)
CONARIUM_CONSOLE_TOKEN='<≥24 chars>' npx conarium-console
# HTTP gateway
CONARIUM_MCP_TOKEN='<≥24 chars>' npx conarium --http --config /tmp/cnr-pt/conarium.config.json
```

Do not point this at a production ERP. The only production install this
project has is the author's company; it is not a test target.

## Tests already in the repo — do not redo from zero

| Suite | Command | What it already covers |
|---|---|---|
| Unit | `npx vitest run` | Governance, masking, receipts, sessions, rate limit, custom patterns |
| Adversarial checks | `npm run test:checks` | Doctor, console auth/CSRF/handoff, init, pack leak, connectors, lineage, hardening, OTS fixtures, vectors, HTTP e2e |
| Conformance vectors | `npm run test:vectors` | Frozen receipt cases + expected exit codes in `test-vectors/manifest.json` |
| Red team | `npx vitest run redteam` | Query-time and result-time attacks (`redteam/attacks/`) |
| Receipt spec | `docs/RECEIPT-SPEC.md` | Exit codes 0, 10–15, 20, 40, 50 |

A finding that is already asserted in one of those files is a **regression**,
not a new class. Cite the test.

## Known documented gaps (do not bill as discovery)

These are already written down. Confirm they are still true; do not invoice
the first hour spent rediscovering them.

1. No SOC 2, no ISO, no independent pentest. (`LIMITATIONS.md`)
2. Not 1.0. API can break.
3. SQL is Postgres, Microsoft SQL Server, and Oracle. MySQL is not implemented. Oracle synonyms and database links are not resolved.
4. Bare names and street addresses in free text are not detected.
5. One production install; 121,366 is that company's ERP and is not
   externally verifiable.
6. Bus factor 1. Cryptography not formally audited.
7. Receipt tail truncation is invisible without an external pin.
8. OpenAPI DNS rebinding TOCTOU, accepted (`SECURITY.md`).
9. OpenTimestamps pending ≠ Bitcoin-confirmed. Explorer unreachable → 15.

## Reporting

Email **e.dogru@conarium.dev**. Include a reproduction. There is no bounty.
A report that says "we found no issues" is not an audit substitute and will
not be quoted as one.