ERSEC 29.1.2 — Professional Security Assessment Platform

ERSEC is a defensive application-security platform designed for authorized web and API assessments. It transforms traditional scanning into a mature, evidence-driven assurance process: reviewed security intent $\rightarrow$ bounded multi-principal assurance $\rightarrow$ semantic evidence $\rightarrow$ explicit uncertainty $\rightarrow$ regression contract $\rightarrow$ release decision.

🚀 What's New in 29.1.2 (Production Ready)

This release marks the transition to a professional, Kali-ready platform with a focus on reliability, discoverability, and deterministic proof.

🛠️ Professional Command Center

The CLI has been redesigned from a flat flag-based system to a modular subcommand architecture:

• ersec scan: Perform target scans (including the new --all max-intensity profile).
• ersec discover: Build attack-surface inventory.
• ersec policy: Manage and validate security policies.
• ersec assure: Run authorization and workflow assurance tests.
• ersec agent: Inspect AI agents and MCP posture.
• ersec report: Generate and regenerate professional evidence dashboards.
• ersec benchmark: Run reproducible evaluation suites.
• ersec doctor: Diagnose installation and environment health.

⚡ Max-Intensity Scanning (--all)

The new ScanProfile.MAX profile activates "Deep" detectors for high-impact vulnerabilities, including:

• Deep SQLi: Time-based blind injection across multiple DB engines.
• Deep SSRF: Out-of-band callback detection.
• Deep RCE: Command injection across OS boundaries.
• Deep LFI: Local file inclusion checks for sensitive system artifacts.
• Deep XSS: Blind XSS via callback triggers.

📊 Evidence-First Dashboard

A professional, multi-tab HTML dashboard replaces the flat report, providing a SOC-style overview:

• Executive Overview: Posture grade, risk distribution, and business impact.
• Risk & Findings: Filterable ledger with AI-powered remediation analysis.
• Attack Surface: Detailed inventory of discovered pages, forms, and endpoints.
• Evidence Explorer: Integrated visual proof via automated screenshots.

📸 Automated Visual Proof

ERSEC now integrates headless browser automation to capture high-fidelity screenshots of critical findings. Evidence is linked directly in the dashboard, providing deterministic proof of a vulnerability's existence.

🏛️ Core Architecture

ERSEC is built on the principle that a finding is not a claim, but a proven observation.

1. Security Behavior Graph

Instead of a flat list of bugs, ERSEC builds a semantic map of your application: Identity $\rightarrow$ Resource/Route $\rightarrow$ Finding $\rightarrow$ Invariant Violation

2. Security Behavior Assurance

Move from inferred behavior to operator-declared models. Define your identities, roles, and expected access patterns in a YAML policy, and let ERSEC prove the reality.

3. The Assurance Kernel

A deterministic engine that compiles a "Security Constitution" into proof obligations. Release decisions are based on explicit evidence, not the absence of a finding.

4. ERSEC Shield

A professional application-layer enforcement point (reverse proxy) that allows you to apply virtual patches and positive-security envelopes based on the evidence discovered during scans.

📖 Quick Start

Installation

python3 -m venv .venv
source .venv/bin/activate
pip install ersec
# Optional: Install browser automation for screenshots
pip install "ersec[browser]"
playwright install chromium

Basic Scan

ersec scan -t https://example.com

High-Intensity Assessment

ersec scan -t https://example.com --profile max --html report.html

Authorization Benchmark

ersec benchmark --authorization-benchmark result.json

🛡️ Safety & Ethics

ERSEC is designed for authorized, bounded, and non-destructive testing.

• Scope Enforcement: Strict host, port, and path boundaries.
• Risk Budgeting: Capped request counts to prevent DoS.
• No Destructive Payloads: Does not automate data exfiltration, persistence, or remote shell acquisition.

Legal Notice: Only scan systems you own or have explicit written authorization to test.

📈 Versioning & Maturity

ERSEC follows a conventional release model. Current stable version: 29.1.2. For a detailed list of changes, see CHANGELOG.md.