env.example

# AutoAR Environment Configuration
# Copy this file to .env and update with your values

# ============================================================================
# OPERATIONAL MODE CONFIGURATION
# ============================================================================
AUTOAR_MODE=api

# ============================================================================
# MONITORING NOTIFICATIONS (OPTIONAL)
# ============================================================================
# Webhook the monitoring daemon posts change alerts to. Leave empty to disable.
# Any endpoint that accepts a JSON {"content": "..."} body works — Discord
# webhook URLs work out of the box.
MONITOR_WEBHOOK_URL=

# Bug-bounty scope-change monitor: when MONITOR_WEBHOOK_URL is set, AutoAR slowly
# sweeps every program you can see and posts a Discord alert whenever a NEW in-scope
# asset appears. Set PROGRAM_MONITOR=off to disable. PROGRAM_MONITOR_SPACING_MS is the
# delay between per-program scope checks (default 3000ms — keeps under API rate limits;
# a full sweep of ~1000 programs takes ~an hour). PROGRAM_MONITOR_PLATFORMS limits it to
# a csv subset, e.g. "h1" or "h1,bc" (empty = all of h1,bc,it).
PROGRAM_MONITOR=
PROGRAM_MONITOR_SPACING_MS=
PROGRAM_MONITOR_PLATFORMS=

# ============================================================================
# API SERVER CONFIGURATION
# ============================================================================
API_HOST=0.0.0.0
API_PORT=8000

# ============================================================================
# DASHBOARD AUTH (HTTP API + /ui)  — native local auth, no Supabase
# ============================================================================
# Set BOTH of these to require login on the dashboard + /api/* + /scan/*.
# When set, POST /api/auth/login returns a 24h HS256 JWT used as Bearer token.
DASHBOARD_USER=
DASHBOARD_PASSWORD=
#
# The server REFUSES to start unauthenticated on a public (non-loopback)
# API_HOST. To run with no auth anyway (e.g. localhost dev, or a trusted
# network), set this explicitly:
# AUTOAR_API_AUTH_DISABLED=true
#
# Strongly recommended when auth is enabled: a dedicated random JWT signing
# secret (>= 32 bytes). If unset, a random secret is generated and persisted.
# Do NOT rely on the password for signing.
# AUTOAR_JWT_SECRET=
#
# If you run behind a reverse proxy, list its IPs/CIDRs so X-Forwarded-For is
# trusted (otherwise it is ignored to prevent client-IP spoofing).
# AUTOAR_TRUSTED_PROXIES=127.0.0.1,10.0.0.0/8

# ============================================================================
# CORE APPLICATION CONFIGURATION
# ============================================================================
AUTOAR_SCRIPT_PATH=/usr/local/bin/autoar
AUTOAR_CONFIG_FILE=/app/autoar.yaml

# Results directory for scan outputs
# For Docker: use /app/new-results
# For native/local: use relative path (./new-results) or absolute path within your directory
# Note: Absolute paths at root (like /new-results) will be automatically converted to
#       relative paths when running natively to avoid permission issues
AUTOAR_RESULTS_DIR=/app/new-results
# Examples for native/local:
# AUTOAR_RESULTS_DIR=./new-results
# AUTOAR_RESULTS_DIR=/home/user/AutoAR/new-results

# Tool Setup
RUN_SETUP=false
REGENERATE_CONFIG=true
SAVE_TO_DB=true
VERBOSE=true

# Phase Timeouts (in seconds, 0 = no timeout)
# Misconfig scan timeout (default: 1800 = 30 minutes)
AUTOAR_TIMEOUT_MISCONFIG=1800
# Nuclei scan timeout (default: 0 = no timeout)
AUTOAR_TIMEOUT_NUCLEI=0
# Default timeout for other phases (default: 0 = no timeout)
AUTOAR_TIMEOUT_DEFAULT=0

# Logging Configuration
LOG_LEVEL=info                 # Log level: debug, info, warn, error
LOG_FILE=autoar-bot.log       # Log file path (relative to project root)
LOG_MAX_SIZE=100              # Max size in MB before rotation
LOG_MAX_AGE=7                 # Max days to keep old logs
LOG_MAX_BACKUPS=3             # Max number of old log files to keep
LOG_COMPRESS=true             # Compress old log files
LOG_JSON=false                # Set true for machine-readable JSON logs
AUTOAR_TRACING_ENABLED=false  # Set true to enable OpenTelemetry tracing

# Rate Limiting
API_RATE_LIMIT=100                # API requests per second (default: 100)
API_RATE_BURST=200                # Max burst size (default: 200)

# Graceful Shutdown
GRACEFUL_SHUTDOWN_TIMEOUT=300 # Seconds to wait for active scans before force shutdown

# Scan Timeouts
# Timeout for domain_run and subdomain_run scans (in seconds)
# Default: 18000 seconds (5 hours)
# Set to 0 for no timeout (not recommended)
DOMAIN_RUN_TIMEOUT=18000

# Timeout for other scan types (in seconds)
# Default: 1800 seconds (30 minutes)
# Set to 0 for no timeout (not recommended)
SCAN_TIMEOUT=1800


# ============================================================================
# DATABASE CONFIGURATION
# ============================================================================
# Database Type: postgresql or sqlite
DB_TYPE=postgresql

# For PostgreSQL:
# Option 1: Use PostgreSQL connection string
# DB_HOST=postgresql://username:password@host:port/database
# (Alternatively set DATABASE_URL=postgresql://… if DB_HOST is empty — same effect.)
#
# Option 2: Use individual environment variables
# DB_HOST=your_postgres_host
# DB_PORT=5432
# DB_USER=your_postgres_user
# DB_PASSWORD=your_postgres_password
# DB_NAME=bughunt

# For SQLite:
# DB_TYPE=sqlite
# DB_HOST=./bughunt.db  (or absolute path like /path/to/bughunt.db)
# DB_NAME is ignored for SQLite

# Database Collections
DOMAINS_COLLECTION=domains
SUBDOMAINS_COLLECTION=subdomains

# Example for PostgreSQL external database:
# DB_TYPE=postgresql
# DB_HOST=postgresql://username:password@external-host.com:5432/bughunt
# DB_USER=autoar_user
# DB_PASSWORD=secure_password_here
# DB_NAME=bughunt

# Example for SQLite:
# DB_TYPE=sqlite
# DB_HOST=./bughunt.db

# ============================================================================
# EXTERNAL API KEYS
# ============================================================================

# GitHub (for repository scanning and organization recon)
GITHUB_TOKEN=your_github_token_here

# Security APIs
SECURITYTRAILS_API_KEY=your_securitytrails_key_here
SHODAN_API_KEY=your_shodan_key_here
VIRUSTOTAL_API_KEY=your_virustotal_key_here

# Additional Security APIs
WORDPRESS_API_KEY=your_wordpress_key_here
BEVIGIL_API_KEY=your_bevigil_key_here
BINARYEDGE_API_KEY=your_binaryedge_key_here
URLSCAN_API_KEY=your_urlscan_key_here

# Search Engine APIs
CENSYS_API_ID=your_censys_id_here
CENSYS_API_SECRET=your_censys_secret_here
CERTSPOTTER_API_KEY=your_certspotter_key_here
CHAOS_API_KEY=your_chaos_key_here

# International Search Engines
FOFA_EMAIL=your_fofa_email_here
FOFA_KEY=your_fofa_key_here
FULLHUNT_API_KEY=your_fullhunt_key_here
INTELX_API_KEY=your_intelx_key_here

# Threat Intelligence APIs
PASSIVETOTAL_USERNAME=your_passivetotal_username_here
PASSIVETOTAL_API_KEY=your_passivetotal_key_here
QUAKE_USERNAME=your_quake_username_here
QUAKE_PASSWORD=your_quake_password_here
THREATBOOK_API_KEY=your_threatbook_key_here
WHOISXMLAPI_API_KEY=your_whoisxml_key_here

# Chinese Search Engines
ZOOMEYE_USERNAME=your_zoomeye_username_here
ZOOMEYE_PASSWORD=your_zoomeye_password_here
ZOOMEYEAPI_API_KEY=your_zoomeyeapi_key_here

# ============================================================================
# BUG BOUNTY PLATFORM CREDENTIALS
# Power the Programs page (program monitor + scope) and the Targets page /
# `autoar scope`. Set the platforms you use; leave the rest blank.
# ============================================================================
# HackerOne — username + API token (https://hackerone.com/settings/api_token)
H1_USERNAME=
H1_TOKEN=
# Bugcrowd — value of the _crowdcontrol_session_key session cookie
BUGCROWD_TOKEN=
# Intigriti — researcher API token. INTIGRITI_API_KEY is accepted as an alias.
INTIGRITI_TOKEN=
# YesWeHack — JWT token (no email/password needed)
YWH_TOKEN=
# HackAdvisor (https://hackadvisor.io/api-docs) — Bearer API token. Adds "external
# targets": bug-bounty programs from platforms AutoAR doesn't fetch natively
# (Immunefi, Standoff365, BI.ZONE, YesWeHack, self-hosted, …), each with its
# scope_updated_at so the scope-update watch alerts on them too. By default the
# HackerOne/Bugcrowd/Intigriti programs HackAdvisor lists are skipped (AutoAR
# already fetches those richer via your own tokens); set HACKADVISOR_INCLUDE_NATIVE=true
# to include them anyway.
HACKADVISOR_TOKEN=
HACKADVISOR_INCLUDE_NATIVE=

# ============================================================================
# AI / LLM PROVIDERS
# ============================================================================
# Set ONE of these to enable AI features (`autoar agent`, `autoar explain`,
# the Brain analysis on monitor changes, and the dashboard's AI helpers).
# Provider priority when multiple are set: OpenRouter -> OpenCode -> Z.ai -> Gemini.

# Default free provider — OpenCode Zen (https://opencode.ai/zen).
# OpenAI-compatible endpoint. Free tier available; create a key at the URL above.
OPENCODE_API_KEY=
# Optional: override the OpenCode model. Defaults to deepseek-v4-flash-free.
# See https://opencode.ai/zen/v1/models for the full list. The model id in this
# variable is sent verbatim as the request "model" field.
OPENCODE_MODEL=

# Optional: OpenRouter (https://openrouter.ai) for premium / alternative models.
OPENROUTER_API_KEY=
# Optional: override the OpenRouter model. Defaults to z-ai/glm-4.5-air:free.
OPENROUTER_MODEL=


# ============================================================================
# AWS CONFIGURATION (for S3 scanning)
# ============================================================================
# Leave empty to use public access only, or provide credentials for authenticated access
AWS_ACCESS_KEY_ID=your_aws_access_key_here
AWS_SECRET_ACCESS_KEY=your_aws_secret_key_here
AWS_SESSION_TOKEN=your_aws_session_token_here
AWS_DEFAULT_REGION=us-east-1

# ============================================================================
# CLOUDFLARE R2 STORAGE CONFIGURATION (Optional)
# ============================================================================
# Enable R2 storage for large files (files > 20MB are uploaded to R2 and served via public URL)
# This keeps large result artifacts off local disk and shareable as links
USE_R2_STORAGE=false
R2_BUCKET_NAME=autoar
R2_ACCOUNT_ID=your_r2_account_id_here
R2_ACCESS_KEY_ID=your_r2_access_key_id_here
R2_SECRET_KEY=your_r2_secret_key_here
# Optional: Custom public URL for R2 bucket (if you have a custom domain)
# If not set, will use default R2 public URL format: https://pub-{ACCOUNT_ID}.r2.dev
R2_PUBLIC_URL=

# ============================================================================
# TOOL-SPECIFIC CONFIGURATION
# ============================================================================

# Nuclei Configuration
NUCLEI_TEMPLATES_PATH=/app/nuclei_templates
NUCLEI_RATE_LIMIT=150
NUCLEI_CONCURRENCY=25

# Fuzzing Configuration
FFUF_WORDLIST_PATH=/app/Wordlists/quick_fuzz.txt
FFUF_THREADS=50

# Subdomain Enumeration
SUBFINDER_THREADS=10

# GitHub Scanning
GITHUB_MAX_REPOS=50
GITHUB_PARALLEL_JOBS=3
GITHUB_HTML_REPORTS=true
GITHUB_SCAN_TYPES=github_org_scan

# TruffleHog Configuration
TRUFFLEHOG_NO_UPDATE=true
TRUFFLEHOG_AUTOUPDATE=false

# ============================================================================
# USAGE EXAMPLES
# ============================================================================
#
# API Server:
#   AUTOAR_MODE=api
#   API_HOST=0.0.0.0
#   API_PORT=8000
#   docker compose up -d autoar-api
#   Access dashboard: http://localhost:8000/ui/
#   Access API docs: http://localhost:8000/docs
#
# Full Stack (API + Postgres):
#   docker compose --profile localdb up -d
#
# ============================================================================
ZHIPU_API_KEY=