Web Application Baseline

Web Application Baseline

When to Use

Use this capability when reviewing an authorized website or staging service and you need bounded, low-impact evidence before deciding whether deeper active validation is justified.

Prerequisites

• Written authorization for the target.
• A reachable HTTP(S) URL.
• A clear rule of engagement for any optional active testing.

Workflow

1. Run ./agentsec web https://target.example --authorized --baseline-only.
2. Review headers, cookie attributes, CORS, robots/sitemap, security.txt, and bounded sensitive-path probes.
3. Treat missing controls as review-needed until application and provider configuration are confirmed.
4. Enable --active only when explicitly authorized and needed to validate a hypothesis.

Verification

Confirm the report records the target, authorization mode, baseline observations, raw responses, and any soft-404 handling. Ensure no destructive or credential-testing action was performed.