Repository navigation
Expand file tree
/
Copy path.env.example
More file actions
43 lines (38 loc) · 2.27 KB
/
Copy path.env.example
File metadata and controls
43 lines (38 loc) · 2.27 KB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
# MUAD'DIB environment variables — template
# Copy to .env (local dev) or /opt/muaddib/.env (VPS) and fill in real values.
# .env files are gitignored. NEVER commit a real token.
# ----------------------------------------------------------------------------
# Threat-feed API tokens (all OPTIONAL — scrapers degrade gracefully if absent)
# ----------------------------------------------------------------------------
# OpenSourceMalware.com — community-verified threat intel
# Free tier: 60 req/min, /query-latest gives 100 most recent threats per ecosystem.
# Sign up + generate at: https://opensourcemalware.com/auth → profile → API Tokens
# Format: osm_<random-32+chars>
# Used by: src/ioc/scraper.js → scrapeOSMQueryLatest()
OSM_API_TOKEN=
# ----------------------------------------------------------------------------
# Webhook destinations (optional — monitor alerts)
# ----------------------------------------------------------------------------
# Discord webhook for monitor alerts (P1/P2/P3 triage)
# DISCORD_WEBHOOK_URL=
# ----------------------------------------------------------------------------
# FPR plan gates — DEFAULT ON since v2.11.9 (no need to set these unless opting OUT)
# ----------------------------------------------------------------------------
# Measured impact on the v2.11.4 evaluation corpus (1054 packages):
# FPR curated 15.6% -> 9.36% (-6.24 pp), FPR random 7.0% -> 2.0% (-5.00 pp).
# TPR@3 / TPR@20 / ADR strictly unchanged.
#
# Opt-OUT individual gates (uncomment + set to 0):
# MUADDIB_FN_REACHABILITY=0 # function-level reachability gating
# MUADDIB_DECAY=0 # group score decay on bundled outputs
# MUADDIB_MATURE_CAP=0 # cap mature, well-trafficked packages at MEDIUM
# MUADDIB_METADATA_FACTOR=0 # registry signals -> reputation multiplier
# MUADDIB_DELTA_MODE=0 # delta scoring against prior versions
#
# Skip ALL network fetches (npm registry packument + GitHub Releases IOC
# bootstrap) in one shot. Disables MATURE_CAP + METADATA_FACTOR + DELTA_MODE
# at the per-scan level AND the first-run IOC database download. Useful for:
# - air-gap / offline CI environments
# - test runners (set automatically by tests/run-tests.js)
# - perf-critical batch scans where you've pre-warmed the IOC cache
# MUADDIB_NO_REGISTRY_FETCH=1