Reference template for penetration test engagements against ɳSelf deployments.

# Requires pentest plugin + Business+ license
nself pentest-kit generate --output-dir ./pentest-docs

This renders ./pentest-docs/pentest-scope.md populated with the deployment's actual IP ranges, ports, subdomains, and API endpoints.

1. In-scope surfaces, IP ranges, ports, subdomains, API endpoints
2. Out-of-scope surfaces, Cloudflare, Stripe, GitHub Actions, third-party SaaS
3. Test credentials, pentest Hasura role + JWT
4. Rules of engagement, no DoS, no social engineering, 72h critical reporting
5. Emergency stop procedure, contact, protocol

nself pentest-kit credentials

Creates a pentest Hasura role with pentest:true metadata. The role has:

• Read access to non-sensitive tables.
• No access to admin secrets, audit logs, or billing data.
• 7-day JWT expiry.

After the engagement, import findings from the structured report:

nself pentest-kit remediation --import findings.json

Track progress:

nself pentest-kit status

• SOC 2 CC7.1, System monitoring and vulnerability management
• PCI-DSS 11.3, Penetration testing
• HIPAA Security Rule, Periodic security testing (addressable)

• cmd-pentest-kit, CLI reference
• security/secret-rotation-runbook, credential rotation after pentest
• Home