📋
pentest-action-plan.md
Attack vectors identified and ready to execute.
- Clear goals per vector
- Test procedures and payloads
- Validation and failure criteria
- Summary table: Access · Input · Availability · Information
AppSec · DevSecOps · OWASP
Actionable pentest
plans for engineering
Generate pentest action plans from OpenAPI specs, code, or design docs. Complements STRIDE threat analysis with operational validation — vectors, payloads, remediations, and prioritized RFCs.
# Platform Team — Pentest Action Plan
## Tenant Traversal
Goal: swap tenant header
Payload: X-Tenant-ID: 999999999999
Fail: 200 with another tenant's data
## Summary Table
Access · Input · Availability · Information
→ 12 vectors mapped · 4 quick winsWhat is it?
From specification to attack plan
A tool that generates pentest action plans from OpenAPI, code, or design docs. Complements threat analysis (STRIDE) with operational validation and actionable handoff for engineering.
Available as a Ruby gem for CI/CD and pipelines, and as an AI skill for coding assistants — same taxonomy, same rigor.
What you get
A security pipeline in 3 artifacts
From attack plan to prioritized remediation
Highest value
🛠️
remediations.md
Fixes tailored to your stack (Rails, BigQuery, and more).
- Reference snippets
- Implementation steps
- Regression tests
- Effort estimate and priority
- Quick wins — shippable in ≤ 2h
📐
rfcs/
Remediation RFCs for structural changes (P0).
- Global auth
- Rate limiting
- IAM and permissions
- Multi-tenant architecture
When to use?
The right moments to generate a plan
-
New endpoint or OpenAPI contract Before manual pentest — map vectors from the real contract.
-
Multi-tenant or analytics features BOLA/IDOR, injection, logical DoS, and cross-tenant leaks.
-
Data Lake integration Tenant bypass, IAM, overprivilege, and cost-based DoS.
-
AppSec → Engineering handoff Document the validation plan before tests run.
How is it different?
Not a generic checklist
01
Concrete
Real payloads from your contract — headers, params, and paths from your project, not generic samples.
02
Practical
Remediations for your code and stack (Rails, BigQuery, REST) — snippets ready for the backlog.
03
Prioritized
Quick wins separated from structural RFCs. Estimated effort. Focus on what unblocks first.
Ruby gem
Install and generate your first plan
Input: OpenAPI, code snippet, or design doc. Output: a full Markdown plan.
Install
gem install security_pentest_planner
Usage
security-pentest-planner openapi.yaml --datalake -o plan.md