69 lines
2.8 KiB
Text
69 lines
2.8 KiB
Text
# Server
|
|
PORT=3001
|
|
NODE_ENV=development
|
|
|
|
# Frontend origin (CORS + post-login redirect target)
|
|
FRONTEND_URL=http://localhost:5173
|
|
|
|
# WorkOS AuthKit — https://dashboard.workos.com
|
|
# Configure WORKOS_REDIRECT_URI as a Redirect URI in the WorkOS dashboard.
|
|
WORKOS_API_KEY=
|
|
WORKOS_CLIENT_ID=
|
|
# Must be at least 32 characters. Generate: openssl rand -base64 32
|
|
WORKOS_COOKIE_PASSWORD=
|
|
WORKOS_REDIRECT_URI=http://localhost:3001/auth/callback
|
|
|
|
# Optional local-only identity used by Docker/E2E runs when WorkOS credentials
|
|
# are intentionally unavailable. Ignored when NODE_ENV=production.
|
|
LOCAL_DEV_AUTH_EMAIL=
|
|
LOCAL_DEV_AUTH_FIRST_NAME=Guest
|
|
LOCAL_DEV_AUTH_LAST_NAME=
|
|
|
|
# Supabase Postgres connection string (BACKEND ONLY — never expose to the browser).
|
|
# Supabase dashboard → Project Settings → Database → Connection string (URI).
|
|
# Use the connection pooler URI for serverless / many short connections.
|
|
DATABASE_URL=
|
|
|
|
# GitHub OAuth App — https://github.com/settings/developers (OAuth Apps).
|
|
# Set the app's "Authorization callback URL" to GITHUB_REDIRECT_URI.
|
|
# The 'repo' scope (used to list private repos) grants broad repo access.
|
|
GITHUB_CLIENT_ID=
|
|
GITHUB_CLIENT_SECRET=
|
|
GITHUB_REDIRECT_URI=http://localhost:3001/api/github/callback
|
|
|
|
# Secret used to encrypt stored GitHub tokens at rest (any random string).
|
|
# Generate: openssl rand -base64 32
|
|
APP_ENCRYPTION_KEY=
|
|
|
|
# Scanner (apps/cli). SCAN_RUNNER: inline (in-process, default for dev — no Docker) |
|
|
# docker (run the container locally) | cloudrun (trigger the Cloud Run Job).
|
|
SCAN_RUNNER=inline
|
|
# Backend URL the scanner POSTs results to (docker/cloudrun modes).
|
|
# For docker, use http://host.docker.internal:3001 so the container can reach the host.
|
|
SCAN_CALLBACK_URL=http://localhost:3001
|
|
# Shared secret for /internal/scan-result (required for docker/cloudrun).
|
|
SCAN_CALLBACK_SECRET=
|
|
# docker mode: the built scanner image (e.g. cerebrus-scanner).
|
|
SCANNER_IMAGE=
|
|
# cloudrun mode: the Cloud Run Job to execute.
|
|
GCP_PROJECT=
|
|
GCP_REGION=us-central1
|
|
SCAN_JOB_NAME=cerebrus-scanner
|
|
|
|
# DeepSeek — the LLM that performs the file-by-file vulnerability analysis + chaining.
|
|
# Required for a real scan (docker/cloudrun pass it to the container; inline reads it here).
|
|
DEEPSEEK_API_KEY=
|
|
DEEPSEEK_MODEL=deepseek-reasoner
|
|
DEEPSEEK_BASE_URL=https://api.deepseek.com
|
|
# Max files analyzed in parallel (deepseek-reasoner is slow — keep this modest).
|
|
DEEPSEEK_CONCURRENCY=4
|
|
|
|
# Per-scan logs are written to <SCAN_LOG_DIR>/scan-<scanId>.log (host-readable).
|
|
SCAN_LOG_DIR=./scan-logs
|
|
|
|
# Ecosystems for the optional bulk `cve:sync` (on-demand OSV querybatch needs no config).
|
|
OSV_ECOSYSTEMS=npm,PyPI,Go,crates.io,Maven,RubyGems
|
|
|
|
# Auto-fix: after a scan finds vulnerabilities, open a PR on the user's repo applying
|
|
# the suggested fixes (uses the user's GitHub token). Set to "false" to disable.
|
|
SCAN_AUTOFIX=true
|