Documentation
¶
Overview ¶
Package surfaces maps what a descriptor declares to the controls that look at it.
It exists so the question "what did this scan not look at?" has one answer regardless of who asks. The console prints it as a note after a scan; the MCP server returns it beside the verdict. Those two answers diverging would be worse than either being absent, because a reader comparing them has no way to tell which is stale.
Index ¶
Constants ¶
This section is empty.
Variables ¶
var Controls = map[string][]string{
"repositories": {"sca", "secrets", "sast", "iac"},
"images": {"images"},
"hosts": {"headers", "tls"},
"infrastructure": {"infrastructure"},
}
Controls names, for each surface a component can declare, the controls that examine it.
Discovery's promise is that the descriptor writes itself, and a descriptor enabling no control has not written itself — it has written a shape, whose first scan reports PASS having checked nothing. This map is what turns a declared surface into the controls that would look at it.
`dast` is deliberately absent from the host list. The passive host controls read a response; dast sends attack traffic at a live service, and turning that on because something noticed the service exists is not a decision Draugr gets to make on someone's behalf. Enable it yourself, having decided.
Functions ¶
func ComponentHas ¶
ComponentHas reports whether a component declares the given surface.
func DeclaresHosts ¶
DeclaresHosts reports whether any component exposes a host, which is the only case where the absence of `dast` from an uncovered-surface list is a question a reader would ask.
func Uncovered ¶
Uncovered names each component surface that no enabled control looks at.
A descriptor that declares a `hosts:` entry with the host controls off scans everything about that component except the thing it exposes to the internet, and says nothing. The run is a clean pass over a surface nobody looked at — the same shape as a scan that enables no control at all, which fails loudly, but with a smaller blast radius and no signal whatsoever.
Advisory rather than fatal: the choice may be deliberate, and refusing to scan because a control is off would be worse than the gap.
Types ¶
This section is empty.
Source Files