# OWASP Top 10 Web Application Security Profile
# Covers CSP, XSS (Reflected + DOM), Injection, Auth, and all OWASP Top 10 categories
#
# OWASP Coverage:
#   A01 - Broken Access Control      → http/vulnerabilities/ (auth bypass, path traversal)
#   A02 - Cryptographic Failures     → ssl/, http/exposures/
#   A03 - Injection (XSS, SQLi...)   → http/vulnerabilities/, dast/vulnerabilities/xss/
#   A04 - Insecure Design            → http/misconfiguration/
#   A05 - Security Misconfiguration  → http/misconfiguration/ (CSP, headers)
#   A06 - Vulnerable Components      → http/cves/
#   A07 - Auth Failures              → http/default-logins/
#   A08 - Software Integrity         → http/exposures/
#   A09 - Logging & Monitoring       → http/misconfiguration/
#   A10 - Server-Side Request Forgery → http/vulnerabilities/

type:
  - http
  - ssl
  - javascript
  - headless

templates:
  - http/misconfiguration/
  - http/vulnerabilities/
  - http/cves/
  - http/default-logins/
  - http/exposures/
  - dast/vulnerabilities/xss/
  - ssl/

exclude-tags:
  - dos
  - fuzz
  - osint
