Hetaireia/janissary

Review signals: 4 known vulnerability.

Reviewed as expected for a test run: attempted writes that failed, so nothing was written.

OSV reports a known vulnerability in this dependency version. requests 4 findings.

OSV scanned supported lockfiles; unpinned dependencies and unsupported formats are outside this check.

A short run cannot establish that code is safe.

Connections show IP addresses; proxies can hide the final hostname.

Tracing covers dispatched commands and their children, not the whole OS; guest root can interfere with tracing.

Full safety evidence →

• Every finding carries raw_request and raw_response as HTTP/1.1 text (machine-readable JSONL): Real input produced the expected result: raw_request

  Source: Every finding carries `raw_request` and `raw_response` as HTTP/1.1 text

  Input: scan of local target http://127.0.0.1:5001/sqli?q=test with --jsonl

  Expected: JSONL output containing raw_request; exit code 1 because findings exist

  Command: <guest-path> scan -u 'http://127.0.0.1:5001/sqli?q=test' -p q --jsonl

  Observed: raw_request":"GET /sqli?q=%3Cscript%3Ealert%281%29%3C%2Fscript%3E HTTP/1.1\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36\r\nAccept-Encoding: identity\r\nAccept: text/html,application/json,*/*;q=0.8\r\nConnection: close\r\nHost: 127.0.0.1:5001\r\n\r\n","raw_response":"HTTP/1.0 200 OK\r\nServer: BaseHTTP/0.6 Python/3.12.3\r\nDate: Tue, 27 Oct 2026 13:56:07 GMT\r\nContent-Type: text/html\r\nContent-Length: 63\r\n\r\n<html><body>Results for <script>alert(1)</script></body></html>","signals":[],"timestamp":"2026-10-27T

• creds discovers credentials in a directory tree: Real input produced the expected result: [*] 0 finding(s)

  Source: Credential discovery in tree or Git history

  Input: clean directory <guest-path>

  Expected: 0 findings

  Command: <guest-path> creds <guest-path>

  Observed: [*] 0 finding(s)

• terms accept records Terms of Use acceptance: Real input produced the expected result: Terms version 1 accepted.

  Source: Accept the Terms of Use (required once before any network command):

  Input: janissary terms accept

  Expected: Terms version 1 accepted.

  Command: <guest-path> terms accept

  Observed: Terms version 1 accepted. Recorded at <guest-path>

• scan reports findings grouped by severity: Real input produced the expected result: Findings by severity:

  Source: Findings by severity:

  Input: scan of local target http://127.0.0.1:5001/sqli?q=test

  Expected: severity summary; exit code 1 because findings exist

  Command: <guest-path> scan -u 'http://127.0.0.1:5001/sqli?q=test' -p q

  Observed: Findings by severity: HIGH 2 [*] Probing for WAF... No WAF signatures observed [q] baseline is static - timing gates disabled [q] xss_script -> HIGH: reflected_xss | XSS payload reflected UNESCAPED in HTML [q] xss_img -> HIGH: reflected_xss | XSS payload reflected UNESCAPED in HTML

Examples

• Scan a directory for credentials (offline, clean fixture; README example uses a git repo): command completed successfully

  Source: README.md Quickstart: Scan a Git repository for leaked credentials

  Input: janissary creds <guest-path>

  Expected: 0 findings, exit code 0

  Command: <guest-path> creds <guest-path>

  Observed: [*] 0 finding(s)

• Show the Terms of Use required before network commands: command completed successfully

  Source: README.md Quickstart: Review with janissary terms show

  Input: janissary terms show

  Expected: Terms of Use text, exit code 0

  Command: <guest-path> terms show

  Observed: information it produces primarily to improve the security of the affected systems. 6. NO WARRANTY JANISSARY is provided "as is", without warranty of any kind, as set out in the Apache License 2.0. These Terms supplement, and do not replace, the Apache License 2.0. 7. GOVERNING LAW These Terms are governed by the laws of Victoria, Australia. The parties submit to the exclusive jurisdiction of the courts of Victoria, Australia. By typing I AGREE, you confirm that you have read these Terms, that you accept them, and that you will comply with clause 1 (Authorised Use) in every use of JANISSARY.

Local or hosted: local

Install JANISSARY from source, accept the Terms of Use, and run a DAST scan (janissary scan) and offline credential discovery (janissary creds) against a local HTTP target

cd <guest-path> && pwd && ls -la && git status 2>&1 | head -3; id -u; python3 --version; cat README.md | head -150
echo $CDP_URL; curl -s -m 10 -i $CDP_URL/json/version; echo; ls /inputs 2>&1; ls <guest-path> 2>&1
cd <guest-path> && sed -n 150,400p README.md
cd <guest-path> && grep -n "requires-python\|^name\|scripts" -A3 pyproject.toml | head -30; ls .coldpass; grep -n "janissary" pyproject.toml | head
cd <guest-path> && python3 -m venv <guest-path> && <guest-path> install -q --upgrade pip 2>&1 | tail -3; cd <guest-path> && <guest-path> install -e . 2>&1 | tail -5
cd <guest-path> && J=<guest-path>; $J terms show 2>&1 | head -20; echo ---; $J terms accept 2>&1; echo rc=$?; $J terms check 2>&1; echo rc=$?; $J --help 2>&1 | head -40
cd <guest-path> && ls tools tests benchmark docs; grep -rl "sqli" tools tests --include=*.py | head; grep -n "creds\|--scan-git" README.md | head -3
cd <guest-path> && ls tests/fixtures | head -30; J=<guest-path>; $J creds --help 2>&1 | head -30
mkdir -p <guest-path> && printf 'AWS_ACCESS_KEY_ID=<secret>\nAWS_SECRET_ACCESS_KEY=<secret>\n' > <guest-path> && cd <guest-path> && <guest-path> creds <guest-path> 2>&1; echo rc=$?
mkdir -p <guest-path> && cat > <guest-path> <<'EOF'
import http.server, urllib.parse, sys
class H(http.server.BaseHTTPRequestHandler):
    def do_GET(self):
        u = urllib.parse.urlparse(self.path)
        q = urllib.parse.parse_qs(u.query).get("q", [""])[0]
        if u.path == "/sqli" and "'" in q:
            body = b"SQLITE_ERROR: near \"'\": syntax error"
            code = 500
        elif u.path == "/sqli":
            body = ("<html><body>Results for " + q + "</body></html>").encode()
            code = 200
        else:
            body = b"not found"; code = 404
        self.send_response(code)
        self.send_header("Content-Type", "text/html")
        self.send_header("Content-Length", str(len(body)))
        self.end_headers()
        self.wfile.write(body)
    def log_message(self, *a): pass
http.server.ThreadingHTTPServer(("127.0.0.1", 5001), H).serve_forever()
EOF
cd <guest-path> && (nohup python3 -I server.py > server.log 2>&1 &) ; sleep 1; curl -s "http://127.0.0.1:5001/sqli?q=test"; echo; curl -s -o /dev/null -w "%{http_code}\n" "http://127.0.0.1:5001/sqli?q='"
cd <guest-path> && timeout 600 <guest-path> scan -u "http://127.0.0.1:5001/sqli?q=test" -p q 2><guest-path>; echo rc=$?; tail -5 <guest-path>
cd <guest-path> && grep -rn "exit code\|returncode\|Exit code" README.md docs/*.md | head; grep -n "return 1\|sys.exit\|return 64" src/janissary/cli.py | head -20
cd <guest-path> && grep -rniE "cron|schedul|--once|--now|webhook|while True" src/janissary | head; mkdir -p <guest-path> && echo "hello world, no secrets here" > <guest-path> && <guest-path> creds <guest-path>; echo rc=$?; <guest-path> scan -u "http://127.0.0.1:5001/sqli?q=test" -p q --jsonl 2>/dev/null | head -c 400; echo; echo rc=$?
mkdir -p <guest-path> && cd <guest-path> && cat > claims.json <<'EOF'
[
{"kind":"claim","claim":"Every finding carries raw_request and raw_response as HTTP/1.1 text (machine-readable JSONL)","source":"Every finding carries `raw_request` and `raw_response` as HTTP/1.1 text","input":"scan of local target http://127.0.0.1:5001/sqli?q=test with --jsonl","expected":"JSONL output containing raw_request; exit code 1 because findings exist","probe_kind":"cli","argv":["<guest-path>","scan","-u","http://127.0.0.1:5001/sqli?q=test","-p","q","--jsonl"],"expected_returncode":1,"expected_text":"raw_request","stdin":null,"env":{},"cwd":"<guest-path>"},
{"kind":"claim","claim":"creds discovers credentials in a directory tree","source":"Credential discovery in tree or Git history","input":"clean directory <guest-path>","expected":"0 findings","probe_kind":"cli","argv":["<guest-path>","creds","<guest-path>"],"expected_text":"[*] 0 finding(s)","stdin":null,"env":{},"cwd":"<guest-path>"},
{"kind":"claim","claim":"terms accept records Terms of Use acceptance","source":"Accept the Terms of Use (required once before any network command):","input":"janissary terms accept","expected":"Terms version 1 accepted.","probe_kind":"cli","argv":["<guest-path>","terms","accept"],"expected_text":"Terms version 1 accepted.","stdin":null,"env":{},"cwd":"<guest-path>"},
{"kind":"claim","claim":"scan reports findings grouped by severity","source":"Findings by severity:","input":"scan of local target http://127.0.0.1:5001/sqli?q=test","expected":"severity summary; exit code 1 because findings exist","probe_kind":"cli","argv":["<guest-path>","scan","-u","http://127.0.0.1:5001/sqli?q=test","-p","q"],"expected_returncode":1,"expected_text":"Findings by severity:","stdin":null,"env":{},"cwd":"<guest-path>"}
]
EOF
python3 -I -c "import json;print(len(json.load(open('claims.json'))))"
cd <guest-path> && cat > probe.json <<'EOF'
{"kind":"cli","argv":["<guest-path>","scan","-u","http://127.0.0.1:5001/sqli?q=test","-p","q","--jsonl"],"cwd":"<guest-path>","stdin":null,"env":{},"expected_returncode":1,"expected_text":"raw_request"}
EOF
cat > examples.json <<'EOF'
[
{"kind":"example","claim":"Scan a single endpoint (local target substituted for target.example)","source":"README.md Quickstart: Scan a single endpoint","input":"janissary scan -u http://127.0.0.1:5001/sqli?q=test -p q","expected":"reflected XSS findings reported; exit code 1","argv":["<guest-path>","scan","-u","http://127.0.0.1:5001/sqli?q=test","-p","q"],"cwd":"<guest-path>","env":{},"expected_returncode":1,"expected_text":"Findings by severity:"},
{"kind":"example","claim":"Scan a directory for credentials (offline, clean fixture; README example uses a git repo)","source":"README.md Quickstart: Scan a Git repository for leaked credentials","input":"janissary creds <guest-path>","expected":"0 findings, exit code 0","argv":["<guest-path>","creds","<guest-path>"],"cwd":"<guest-path>","env":{},"expected_text":"[*] 0 finding(s)"}
]
EOF
cat > cycles.json <<'EOF'
{"detected":false,"reason":"Inspected README.md and src/janissary (grep for cron, schedule, --once, --now, webhook, while True found no matches). janissary is a one-shot CLI (scan, creds, fingerprint, graphql, ws, admin, terms, agent, attack); no product scheduler or loop exists.","checks":[]}
EOF
for f in probe claims examples cycles; do python3 -I -m json.tool $f.json >/dev/null && echo ok $f; done
cd <guest-path> && <env-var>=<guest-path> python3 -I <guest-path> --validate --replay 2>&1 | tail -60
cd <guest-path> && grep -n "expected_returncode\|def _run_example\|example_checks\|deferred" check.py | head -40
cd <guest-path> && sed -n 1195,1215p check.py
cd <guest-path> && grep -n "def example_expectation_documented" -A12 check.py
curl -s -m 5 "http://localhost:5001/sqli?q=test"; echo; cd <guest-path> && sed -n 1088,1110p check.py
cd <guest-path> && sed -n 1110,1130p check.py
cd <guest-path> && cat > examples.json <<'EOF'
[
{"kind":"example","claim":"Scan a directory for credentials (offline, clean fixture; README example uses a git repo)","source":"README.md Quickstart: Scan a Git repository for leaked credentials","input":"janissary creds <guest-path>","expected":"0 findings, exit code 0","argv":["<guest-path>","creds","<guest-path>"],"cwd":"<guest-path>","env":{},"expected_text":"[*] 0 finding(s)"},
{"kind":"example","claim":"Show the Terms of Use required before network commands","source":"README.md Quickstart: Review with janissary terms show","input":"janissary terms show","expected":"Terms of Use text, exit code 0","argv":["<guest-path>","terms","show"],"cwd":"<guest-path>","env":{},"expected_text":"JANISSARY TERMS OF USE - version 1"}
]
EOF
cd <guest-path> && <env-var>=<guest-path> python3 -I <guest-path> --validate --replay 2>&1 | python3 -I -c "import json,sys; d=json.load(sys.stdin); print(d['valid'], d['problems']); print(d['replay']['status']); print([ (c.get('verdict'),c.get('outcome')) for k in ('claims','example_checks','cycle_checks') for c in (d.get('replay',{}).get('details',{}).get(k) or [])])" 2>&1 | head -30
mkdir -p <guest-path> && cd <guest-path> && cat > report.json <<'EOF'
{"outcome":"working","fault_owner":null,"operation":"Install JANISSARY from source, accept the Terms of Use, and run a DAST scan (janissary scan) and offline credential discovery (janissary creds) against a local HTTP target","operation_scope":"Local target only: http://127.0.0.1:5001/sqli?q=test served by a fixture server at <guest-path> (left running). Requires Python >=3.10 (guest has 3.12.3) and a venv. No network, browser, or credentials were needed.","steps":["python3 -m venv <guest-path> && <guest-path> install -e . (README 'From source (development)')","<guest-path> terms accept (README Quickstart)","<guest-path> terms show","<guest-path> scan -u \"http://127.0.0.1:5001/sqli?q=test\" -p q (README 'Scan a single endpoint'; returns exit 1 when findings exist)","<guest-path> scan -u \"http://127.0.0.1:5001/sqli?q=test\" -p q --jsonl (README 'Machine-readable output')","<guest-path> creds <guest-path> (finds AWS keys, exit 1)","<guest-path> creds <guest-path> (exit 0, 0 findings)"],"deviations":["Workspace is not a git repository and I did not run the git fetch/reset pin step; the pinned commit was not verified. Source already present in <guest-path> was used as-is.","/inputs/coldpass-preflight.py does not exist in this guest; ran <guest-path> as instructed.","README examples use https://target.example; substituted a local fixture HTTP server on 127.0.0.1:5001 (it reflects q unescaped and returns 500 on a single quote) because the scanner needs a reachable target.","README 'Scan a Git repository' example (creds ./my-repo --scan-git) replaced by directory scan of an offline fixture; no git repo was created.","The README scan example's exit code 1 (findings found) is documented in source code, not README text, so the scan example was recorded as a claim (exit 1 with 'Findings by severity:') rather than a checked example.","Scope enforcement (--scope-include/--scope-exclude, exit 64) was not exercised.","pip install -e . may have created egg-info metadata inside the workspace."],"stuck_step":null,"main_blocker":null,"plain_failure":null,"suggested_fix":"None required. Optional: the scan example in README uses target.example, which cannot be run as-is; a documented local test target would make the quickstart easier to replay."}
EOF
python3 -I -m json.tool report.json >/dev/null && echo ok; cd <guest-path> && <env-var>=<guest-path> python3 -I <guest-path> --validate --replay 2>&1 | head -c 300