Skip to content
BreachPilot

Open source

Contribute to BreachPilot

Apache-2.0 licensed, public repository, fully mocked test suite, CI on every push and PR. Read the guide and AGENTS.md, keep changes focused, and verify flags and config still match reality before you open a PR.

Contribute on GitHubContribution guide

BreachPilot is for authorized testing only — contributions must preserve scope gating, the target allowlist lock, and the audit trail.

What to expect

Mocked tests, strict gates, docs in the same PR

Safety-relevant changes need regression tests. Keep PRs focused and verify every flag and config key still matches reality.

  • Tests

    ~250 mocked test files — no live Nmap, everything mocks subprocess and network. New safety-relevant code needs regression tests.

  • CI

    Mocked suite on Python 3.11–3.13, coverage, ruff check + format, mypy over tools/, package build, WebUI build + tests, mocked eval suite.

  • Quality gates

    CodeQL (Python + JS/TS), dependency review, weekly Dependabot for pip, Actions and npm.

  • Python

    3.11+ required; ruff line-length 120; strict mypy on security-sensitive hot files.

  • TypeScript / WebUI

    tsc + vite build + vitest in webui/ — run all three if you touch the UI.

  • Docs discipline

    Adding a flag, tool or config key means updating the user-facing docs in the same PR.

Checks to run before a PR

checks to run before a PR
python -m pytest tests/ -v
ruff check .
ruff format --check .
mypy --follow-imports=skip tools

Read the docs and the safety model before touching scope, policy, or tool-execution code.