Fred BlaiseandFred Blaise
26fe8495b9
Enable authenticated scans across the HTTP arsenal while binding configured credentials to an exact target origin. Includes case-insensitive per-request overrides, cross-origin redirect containment, protected curl configuration, result redaction, documentation, and regression coverage. Co-authored-by: Fred Blaise <fred.blaise@protonmail.com>
33 lines
1.4 KiB
Bash
33 lines
1.4 KiB
Bash
# T3MP3ST environment — copy to `.env` and fill in. NEVER commit your real .env.
|
|
# At least one LLM provider key is required (OpenRouter is the default backbone).
|
|
|
|
# ── LLM providers (set the one(s) you use) ──
|
|
OPENROUTER_API_KEY=sk-or-v1-xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
|
|
VENICE_API_KEY=xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
|
|
ANTHROPIC_API_KEY=sk-ant-xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
|
|
OPENAI_API_KEY=sk-xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
|
|
GROQ_API_KEY=
|
|
TOGETHER_API_KEY=
|
|
HUGGINGFACE_TOKEN=
|
|
REPLICATE_API_TOKEN=
|
|
|
|
# ── Target authentication (both values are required) ──
|
|
# Exact origin that may receive the configured headers (scheme + host + optional port).
|
|
# TEMPEST_TARGET_ORIGIN=https://target.example
|
|
# JSON object of headers injected into HTTP requests to that exact origin.
|
|
# Explicit per-request headers override these defaults case-insensitively.
|
|
# Bearer token: TEMPEST_TARGET_HEADERS={"Authorization":"Bearer eyJhbGc..."}
|
|
# Cookie: TEMPEST_TARGET_HEADERS={"Cookie":"session=abc123"}
|
|
# Multiple: TEMPEST_TARGET_HEADERS={"Authorization":"Bearer token","X-Tenant":"acme"}
|
|
# TEMPEST_TARGET_HEADERS=
|
|
|
|
# ── GitHub (xbow-bench challenge fetch / gh operations) ──
|
|
GITHUB_TOKEN=
|
|
|
|
# ── optional: default backbone overrides ──
|
|
# LLM_PROVIDER=openrouter
|
|
# LLM_MODEL=claude-opus-4-8
|
|
|
|
# Optional: Venice uncensored inference (OpenAI-compatible). https://venice.ai
|
|
VENICE_API_KEY=
|