Global Configuration¶

Global Configuration is applied universally to all scans (ASM and DAST) across the entire platform. When both Global Configuration and Profile Configuration are defined for a scan, the configurations are merged according to a Profile-override precedence model.

Configuration Merge Behavior¶

When Global Configuration and Profile Configuration contain overlapping keys, the configurations are merged using a deep merge algorithm similar to Terraform's merge() function. The Profile Configuration takes precedence and completely overrides the Global Configuration value for that specific key. Non-overlapping keys from both configurations are preserved in the final merged configuration.

Merge Example:

Global Configuration:

key_a:
  - abc
  - def

key_b: 42

Profile Configuration:

key_a:
  - ghi

key_c: 1337

Resulting Merged Configuration:

key_a:
  - ghi

key_b: 42
key_c: 1337

In this example, key_a is completely replaced by the Profile Configuration value, while key_b is inherited from Global Configuration and key_c is added from Profile Configuration.

ASM Configuration¶

Most of your scan configuration already follows the global scan configuration, such as authentication, network or inference.

However, there are a few additional configurations that are specific to WebApp scans.

For example SPA and SSR applications may not be crawled the same way, and you may want to configure the crawler to crawl them differently.

Example¶

Here is an example configuration:

---
frontend_dast:
  agentic_crawling:
    enabled: false
    instructions: ''
  api_checks_during_auth: true
  escape_user_header: false
  hotstart: []
  location_id: ''
  logout_detection:
    auto_reauthenticate: true
    enabled: true
    logged_in_indicator_regex_patterns: []
    logout_redirection_url_patterns:
    - /login
    - /signout
    - /logout
    - /sign-out
    - /sign-in
    - /sign-out
    - /sign-in
    session_cookie_regex_patterns:
    - (SESSION|JSESSIONID|ASPSESSIONID[A-Z0-9]+|PHPSESSID|ASP\.NET_SessionId)
  max_duration: 120
  mode: read_write
  parallel_workers: 3
  prefetch_sitemap: false
  relax_cors_security: true
  scope:
    api:
      allowlist_domains: []
      allowlist_url_patterns: []
      skipped_url_patterns: []
    pages:
      allowlist_element_selectors: []
      allowlist_url_patterns: []
      blocklist_element_selectors: []
      blocklist_patterns:
      - .*logout.*
      - .*signout.*
      - .*logoff.*
      - .*sign_out.*
      - .*sign-off.*
      - .*mobile_logout.*
      - .*disconnect.*
      - .*signup.*
      - .*register.*
      extra_allowed_domains: []
      max_parameterized_url_variations: 10
      max_unique_fragments_per_page: 10
      max_unique_values_per_query_param: 10
      only_inscope_crawling_logs: true
  security_checks_enabled:
  - ALL
  single_page_worker: false
  static_crawling:
    enabled: true
    time_limit_seconds: 300
  use_persistence: true
  user_agent: null
inference:
  null_is_unauthenticated: true
  scalars:
    my_custom_scalar:
      description: API keys internal to my organization. Should not be committed or
        exposed to internet.
      examples:
      - org_ABCDEFGHIJKLMNOPABCDEFGHIJKLMNOP
      ignored_names: []
      ignored_pattern: null
      is_sourceable: true
      names:
      - org_key
      - organization_key
      parents: []
      pattern: ^org_[A-Z]{32}$
      raise_on_commit: true
      raise_on_exposure: true
      sensitivity: HIGH
      strategy: key_or_value
network:
  cancel_unhealthy_scan_after: 120
  custom_headers:
    my-header:
    - value1
    - value2
    x-scanned-by:
    - escape.tech
  escape_user: true
  parallel_requests: 10
  request_timeout_s: 2
  requests_per_second: 1000
  sec_escape_user: true

Configuration reference¶

Fields¶

APIScopeConfig¶

Configuration for controlling which API traffic the scanner should analyze and test.

Note: The scanner observes API traffic without interfering with it - the web application continues to work normally. These settings only control what the scanner analyzes and tests for security issues.

AgenticCrawlingConfig¶

Configuration options for agentic crawling.

CustomScalarConfig¶

FrontendAPIURLSkipRule¶

This is used to skip urls from API traffic testing. Does not block pages traffic.

FrontendDASTConfig¶

Most of your scan configuration already follows the global scan configuration, such as authentication, network or inference.

However, there are a few additional configurations that are specific to WebApp scans.

For example SPA and SSR applications may not be crawled the same way, and you may want to configure the crawler to crawl them differently.

FrontendDASTScopeConfig¶

Configuration options for controlling the scope of the frontend scan.

This configuration is organized into two main sections:

• pages: Controls which pages the scanner should crawl and interact with
• api: Controls which API traffic the scanner should analyze and test

This separation makes it clear what applies to page crawling versus API traffic analysis.

InferenceConfig¶

Inference configures how escape will detect secrets exposed by the API or in files.

The inference is also used to reinject IDs in the DAST scanners.

LogoutDetectionConfig¶

Configuration options for logout detection.

Enabled by default with default values. It will analyze all pages content and response redirections to detect if the user is logged out. If you want to disable it, set enabled to False.

NetworkConfig¶

PageScopeConfig¶

Configuration for controlling which pages the scanner should crawl and interact with.

StaticCrawlerConfig¶

Configuration options for static crawler.

Disabled by default. It will run a static crawled to extract & seed URLs to the scanner. This should not be enabled when using single page worker.

FrontendDASTConfig¶

Enums¶

FrontendSecurityChecksTypes¶

MatchingStrategy¶

Method¶

ScalarParent¶

ScalarSensitivity¶

ScanMode¶