Global Configuration¶

Global Configuration is applied universally to all scans (ASM and DAST) across the entire platform. When both Global Configuration and Profile Configuration are defined for a scan, the configurations are merged according to a Profile-override precedence model.

Configuration Merge Behavior¶

When Global Configuration and Profile Configuration contain overlapping keys, the configurations are merged using a deep merge algorithm similar to Terraform's merge() function. The Profile Configuration takes precedence and completely overrides the Global Configuration value for that specific key. Non-overlapping keys from both configurations are preserved in the final merged configuration.

Merge Example:

Global Configuration:

key_a:
  - abc
  - def

key_b: 42

Profile Configuration:

key_a:
  - ghi

key_c: 1337

Resulting Merged Configuration:

key_a:
  - ghi

key_b: 42
key_c: 1337

In this example, key_a is completely replaced by the Profile Configuration value, while key_b is inherited from Global Configuration and key_c is added from Profile Configuration.

ASM Configuration¶

Most of your scan configuration already follows the global scan configuration, such as authentication, network or inference.

However, there are a few additional configurations that are specific to WebApp scans.

For example SPA and SSR applications may not be crawled the same way, and you may want to configure the crawler to crawl them differently.

Example¶

Here is an example configuration:

---
frontend_dast:
  agentic_crawling:
    enabled: false
    instructions: ''
  api_checks_during_auth: false
  crawling_tuning:
    max_parameterized_url_variations: 10
    max_unique_fragments_per_page: 10
    max_unique_values_per_query_param: 10
    only_inscope_crawling_logs: true
  escape_user_header: false
  hotstart: []
  location_id: ''
  logout_detection:
    agentic_detection_enabled: false
    auto_reauthenticate: true
    enabled: true
    logged_in_indicator_regex_patterns: []
    logout_redirection_url_patterns:
    - /login
    - /signout
    - /logout
    - /sign-out
    - /sign-in
    - /sign-out
    - /sign-in
    session_cookie_regex_patterns:
    - (SESSION|JSESSIONID|ASPSESSIONID[A-Z0-9]+|PHPSESSID|ASP\.NET_SessionId)
  max_duration: 120
  mode: read_write
  parallel_workers: 3
  prefetch_sitemap: false
  relax_cors_security: true
  scope:
    api_testing:
      allowlist: []
      blocklist: []
      extend_global_scope: true
    crawling:
      allowlist: []
      blocklist: []
      extend_global_scope: false
  security_checks_enabled:
  - ALL
  single_page_worker: false
  static_crawling:
    enabled: true
    time_limit_seconds: 300
  use_persistence: true
  user_agent: null
inference:
  null_is_unauthenticated: true
  scalars:
    my_custom_scalar:
      description: API keys internal to my organization. Should not be committed or
        exposed to internet.
      examples:
      - org_ABCDEFGHIJKLMNOPABCDEFGHIJKLMNOP
      ignored_names: []
      ignored_pattern: null
      is_sourceable: true
      names:
      - org_key
      - organization_key
      parents: []
      pattern: ^org_[A-Z]{32}$
      raise_on_commit: true
      raise_on_exposure: true
      sensitivity: HIGH
      strategy: key_or_value
network:
  cancel_unhealthy_scan_after: 120
  custom_headers:
    my-header:
    - value1
    - value2
    x-scanned-by:
    - escape.tech
  escape_user: true
  parallel_requests: 10
  request_timeout_s: 2
  requests_per_second: 1000
  sec_escape_user: true
scope:
  allowlist: []
  blocklist: []
  use_defaults: true

Configuration reference¶

Fields¶

APITestingScopeConfig¶

Scope configuration for API testing. Only relevant types here, rest_api_path, rest_api_url, graphql_operation, ip, domain, but not web_page_url.

AgenticCrawlingConfig¶

Configuration options for agentic crawling.

CrawlingTuningConfig¶

CustomScalarConfig¶

DomainRule¶

Domain target (e.g., "escape.tech", "*.escape.tech").

FrontendDASTConfig¶

Most of your scan configuration already follows the global scan configuration, such as authentication, network or inference.

However, there are a few additional configurations that are specific to WebApp scans.

For example SPA and SSR applications may not be crawled the same way, and you may want to configure the crawler to crawl them differently.

FrontendDASTScopeConfigV2¶

GlobalScopeConfig¶

Global scope configuration for controlling what targets scanners can cover.

Targets have different types, for dns domains, ips, web_page_url, rest_api_path, rest_api_url, graphql_operation.

The scope configuration uses allowlists and blocklists to precisely define what is in-scope for scanning. This configuration can be set at the global level and optionally extended or overridden by scanner-specific configurations.

Precedence rules:

1. Blocklist takes precedence over allowlist (if a target matches both, it's blocked)
2. More specific rules take precedence over general rules
3. Profile-level scope can extend or override global scope based on extend_global_scope setting

GraphQLOperationRule¶

GraphQL operation target (e.g., "query.users", "mutation.createUser").

IPRule¶

IP address target (e.g., "192.168.1.1", "10.0.0.0/24").

InferenceConfig¶

Inference configures how escape will detect secrets exposed by the API or in files.

The inference is also used to reinject IDs in the DAST scanners.

LogoutDetectionConfig¶

Configuration options for logout detection.

Enabled by default with default values. It will analyze all pages content and response redirections to detect if the user is logged out. If you want to disable it, set enabled to False.

NetworkConfig¶

RestApiEndpointUrlRule¶

REST API full URL endpoint target (e.g., "app.escape.tech) with optional HTTP method (e.g., "GET", "POST", "PUT", "DELETE").

RestApiPathRule¶

REST API path target (e.g., "/api/v1/users") with optional domain and optional HTTP method (e.g., "GET", "POST", "PUT", "DELETE").

StaticCrawlerConfig¶

Configuration options for static crawler.

Disabled by default. It will run a static crawled to extract & seed URLs to the scanner. This should not be enabled when using single page worker.

WebAppCrawlingScopeConfig¶

Scope configuration for web app crawling. Only relevant types here, web_page_url, domain, but not api_route.

WebPageElementSelectorRule¶

CSS selector target (e.g., "button.logout", "a[href='/logout']").

WebPageUrlRule¶

Web page URL target (e.g., "app.escape.tech.)

FrontendDASTConfig¶

Enums¶

FrontendSecurityChecksTypes¶

HTTPMethod¶

MatchingStrategy¶

ScalarParent¶

ScalarSensitivity¶

ScanMode¶

ScopeMatchOperation¶