mirror of https://github.com/laramies/theHarvester.git synced 2026-08-17 19:35:40 +02:00

Files

T

MattandGitHub 1fd5749e52 Add an authenticated durable run API v1 (#2511 )

* Model active evidence in result persistence

* Expose active action diagnostics

* Persist truthful DNS action evidence

* Persist direct action evidence

* feat: add authenticated durable run API v1

* Make API file interchange JSONL-only

* Harden API evidence boundaries

* Remove API rate limiter

* Unify API runs with result persistence

* Support target action runs

* Keep DNS resolver selection action-neutral

* Add action-neutral CLI resolver selection

* Preserve API evidence across JSONL round trips

* Complete HarvestView API run parity

* Harden HarvestView run API contracts

* Remove obsolete bundled network snapshots

Delete the unused bundled AWS IP-range and resolver snapshots while preserving operator-supplied resolver file input.

* refactor: canonicalize URL results

* docs: define a bounded test budget

* Standardize hostname and IP result names

* fix(api): avoid duplicate evidence conflicts

2026-08-10 00:08:04 -04:00

2.4 KiB

Raw Blame History

Agent guidance

theHarvester is a Python OSINT reconnaissance tool for collecting public information about domains, IPs, emails, names, and related assets.

Essentials

The project requires Python 3.12 or newer and uses uv for environments and commands.
Install development dependencies with uv sync --all-groups.
For code changes, follow CONTRIBUTING.md.
Make the smallest requested change, reuse existing code, and preserve unrelated worktree changes.

Domain language

Read CONTEXT.md when changing discovery terminology, evidence classification, scope handling, DNS validation, or P0/P1/P2 activity boundaries.

Code review rules

External compatibility: Flag changes that remove or rename CLI flags, output formats or fields, REST API response fields, or discovery source identifiers without a backward-compatible path and regression coverage. Preserve the existing contract or document and test the migration.
Sensitive-data boundary: Flag committed credentials, real target or operator data, reconnaissance results, or unsanitized provider payloads, including in logs, fixtures, and examples. Keep only the diagnostic metadata needed, redact sensitive values, and use RFC-reserved domains and TEST-NET IP ranges.
Reconnaissance boundary: Flag routine tests or CI that contact live third-party targets or providers. Use mocks or local fixtures; live reconnaissance belongs only in intentionally configured integration checks against explicitly authorized targets.

Verification

Focused tests: uv run pytest <test-path>
Full tests: uv run pytest
Lint: uv run ruff check .
Formatting: uv run ruff format --check .
Typing: uv run mypy theHarvester

Run focused checks first and expand according to risk. Report any skipped check and its reason.

Test budget

During implementation, run the narrowest test that covers the changed behavior. Do not rerun the full suite after every small edit.
Run the full non-browser suite once at the publication head. Dependent stack layers do not need to repeat it unless they change Python behavior.
Run the HarvestView browser suite once at the final UI head or rely on its GitHub workflow. Static UI edits should use focused UI tests and a JavaScript syntax check first.
Before retrying a long-running test, confirm the previous process exited. Poll the existing command or stop only its exact owned process instead of starting an overlapping run.

2.4 KiB Raw Blame History