surface_scoring

const (

	// SignalHasInput - the OBSERVED request carried client-supplied input: a query
	// string or a body. Attacker-actionable immediately, which is what makes it
	// the strongest single predictor in the set.
	SignalHasInput Signal = 1 << iota
	// SignalAdvertisedInput - the response reveals input surface the observed
	// request did not exercise: an Allow / Access-Control-Allow-Methods listing a
	// mutating method, or form markup in the body.
	//
	// Its own bit rather than folded into SignalHasInput. A probe sends one bare
	// GET per host, so without this the input axis would be dead on exactly the
	// corpus that most needs ranking - but "<form> somewhere on the page" is true
	// of most HTML documents, and merging the two would have made the strong
	// predictor near-constant on an HTML corpus. That is the same defect the
	// SignalAuthBearing and SignalDynamic comments below describe avoiding.
	SignalAdvertisedInput
	// SignalStateChanging - a method that mutates (POST/PUT/PATCH/DELETE).
	// Drives access-control, CSRF and mass-assignment surface.
	SignalStateChanging
	// SignalUpload - the request is a file upload (multipart) or the response
	// offers one (a file input). Its own vulnerability class.
	SignalUpload

	// SignalTechStack - the host has at least one detected technology stack.
	// Host-scoped, so it is resolved at flush rather than per record (see Module).
	SignalTechStack
	// SignalLegacyStack - the path ends in a server-executed extension of an
	// older generation (.php, .jsp, .do, .aspx, .cgi...). These map a file
	// directly to a handler, predate framework-level defaults, and are what the
	// Struts/PHP/ASP.NET module families exist for.
	SignalLegacyStack
	// SignalAuthBearing - the exchange carries identity: an Authorization header,
	// or a session cookie in either direction.
	//
	// Deliberately NOT "any cookie". A CDN sets __cf_bm and an analytics tag sets
	// _ga on essentially every response they front, so crediting any Set-Cookie
	// made this bit near-constant on a CDN-fronted corpus - a constant added to
	// every score, which changes no ordering and costs a signal slot.
	SignalAuthBearing
	// SignalAuthSurface - the exchange advertises an authentication boundary: a
	// WWW-Authenticate challenge, a password input, or a redirect into an SSO /
	// OAuth / SAML flow.
	//
	// Distinct from SignalAuthBearing, which is about a session already in hand.
	// A host with accounts is a host with access-control surface, and on a sweep
	// a login page is the single most informative thing a bare GET can return.
	SignalAuthSurface
	// SignalNonStandardPort - the endpoint answers on a port other than 80/443.
	// On a host list this is disproportionately a dev, admin, or internal service
	// that was never meant to be reachable.
	SignalNonStandardPort

	// SignalRichHTML - an HTML document carrying interactive or navigational
	// substance (form inputs, or a real set of links).
	SignalRichHTML
	// SignalSPA - the response is a single-page-app shell.
	SignalSPA
	// SignalJSON - the response body is JSON.
	SignalJSON
	// SignalResponsive - the application answered: not a WAF/CDN edge block, and
	// either a success status or an error verbose enough to leak a stack trace.
	SignalResponsive

	// SignalDynamic - the response is origin-rendered or personalized rather than
	// served from an edge cache: an explicit no-store/private/no-cache, or a Vary
	// on Cookie/Authorization, and not a cache hit.
	//
	// Positive evidence only. "No cache headers at all" is the majority case and
	// crediting it would make the bit another near-constant; what earns the point
	// is the origin explicitly saying this response is per-request.
	SignalDynamic
	// SignalPermissiveCORS - the response opts into cross-origin reads: an
	// Access-Control-Allow-Origin of "*" or "null", or any allowed origin
	// combined with Access-Control-Allow-Credentials. A specific allowlisted
	// origin without credentials is normal configuration and earns nothing.
	SignalPermissiveCORS
	// SignalLeakedInternals - the response exposes something about the origin it
	// did not mean to: a source map reference, a directory listing, an
	// origin/dev-server banner, or a debug/version header.
	SignalLeakedInternals
	// SignalAPISurface - the endpoint presents as a programmatic API beyond
	// merely returning JSON: rate-limit or gateway headers, an API/GraphQL path,
	// or an OpenAPI/Swagger/GraphiQL document.
	SignalAPISurface
)