Penetration-test readiness kit for ɳSelf deployments. Business+ tier.

nself pentest-kit <subcommand> [flags]

• NSELF_PENTEST_KIT=true in environment.
• pentest plugin installed: nself plugin install pentest
• Business+ license key: nself license set <key>

Render a structured pentest scope document for this deployment.

nself pentest-kit generate [--output-dir ./pentest-docs]

Outputs pentest-scope.md with in-scope surfaces, out-of-scope exclusions, test credential summary, and rules of engagement.

Provision a Hasura pentest role and generate test credentials.

nself pentest-kit credentials

The role uses pentest:true Hasura metadata and has read-only access to non-sensitive tables. Credentials expire in 7 days.

Import findings from a structured JSON report.

nself pentest-kit remediation --import findings.json

Report format:

{
  "findings": [
    {
      "title": "SQL injection in search",
      "severity": "high",
      "cvss_score": 8.1,
      "description": "...",
      "remediation": "Use parameterized queries."
    }
  ]
}

Due dates are auto-assigned per severity:

• Critical: 7 days (NSELF_PENTEST_FINDINGS_DUE_DAYS_CRITICAL)
• High: 30 days (NSELF_PENTEST_FINDINGS_DUE_DAYS_HIGH)
• Medium: 90 days (NSELF_PENTEST_FINDINGS_DUE_DAYS_MEDIUM)

Show open findings by severity.

nself pentest-kit status

• cmd-secrets, secret rotation
• cmd-verify-sbom, SBOM verification
• security/Supply-Chain, supply-chain security
• Home