{"id":"passive-test-plan","filename":"passive-test-plan.yaml","schema":"test-plan","document":{"version":"1.0","test_plan_id":"TEST-DEMO-PASSIVE-001","authorization_id":"AUTH-DEMO-2026-001","client_id":"client-demo","target":"https://security-demo.example.com","environment":"production","mode":"passive","objective":"Verify public website edge controls and detect deployment drift without active attack payloads.","scope":{"allowed_hosts":["security-demo.example.com"],"allowed_paths":["/"],"allowed_accounts":[],"allowed_data":["public-response-metadata"],"excluded_dependencies":["payment-provider","analytics-provider","shared-cdn-control-plane"]},"test_cases":[{"test_id":"WEB-PASSIVE-DNS-TLS","family":"transport-and-domain","references":["OWASP-ASVS-5.0.0","OWASP-WSTG-4.2"],"control_objective":"DNS, certificates, protocols, and redirects resolve to the intended client service.","interaction":"Bounded DNS lookup, TLS handshake, and HTTP HEAD/GET requests.","preconditions":["ownership-proof-verified","external-scope-enforcement"],"permitted_methods":["dns-query","tls-handshake","http-head","http-get"],"prohibited_effects":["state-change","credential-use","third-party-targeting"],"expected_result":"Trusted certificate, intended host routing, approved protocol policy, and deterministic HTTPS redirect behavior.","evidence_required":["dns-answer","certificate-chain","protocol-result","redirect-chain","timestamp"],"cleanup":["none-required"],"default_enabled":true},{"test_id":"WEB-PASSIVE-RESPONSE","family":"headers-cookies-errors-exposure","references":["OWASP-ASVS-5.0.0","OWASP-ZAP-BASELINE"],"control_objective":"Public responses apply intended browser controls and reveal no obvious secret, debug, or deployment exposure.","interaction":"Brief same-host crawl and passive response analysis.","preconditions":["rate-limit-enforced","redirect-boundary-enforced","kill-switch-ready"],"permitted_methods":["same-host-crawl","passive-analysis"],"prohibited_effects":["active-payload","form-submission","file-upload","authentication-attempt"],"expected_result":"No material passive finding and no scope escape.","evidence_required":["exact-command","tool-image-identity","report-json","report-html","policy-decision"],"cleanup":["remove-ephemeral-container","retain-redacted-evidence"],"default_enabled":true}],"limits":{"requests_per_second":1,"concurrency":1,"duration_minutes":5,"max_error_rate":0.05,"max_latency_ms":3000,"max_test_records":0},"stop_conditions":["target leaves approved host or path boundary","widespread 5xx responses or material latency increase","any third-party or cross-tenant content appears","telemetry or rate enforcement is lost","emergency contact requests stop"],"evidence":{"destination":"evidence://client-demo/web/passive/TEST-DEMO-PASSIVE-001","redact":["authorization","cookie","token","secret","personal-data"],"integrity":"sha256-plus-signed-manifest","retention_days":90},"cleanup":["stop worker at duration limit","remove temporary container and cache","verify no application state was changed","record final cleanup status"],"status":"authorized"},"yaml":"version: \"1.0\"\ntest_plan_id: TEST-DEMO-PASSIVE-001\nauthorization_id: AUTH-DEMO-2026-001\nclient_id: client-demo\ntarget: https://security-demo.example.com\nenvironment: production\nmode: passive\nobjective: Verify public website edge controls and detect deployment drift without active attack payloads.\nscope:\n  allowed_hosts: [security-demo.example.com]\n  allowed_paths: [\"/\"]\n  allowed_accounts: []\n  allowed_data: [public-response-metadata]\n  excluded_dependencies: [payment-provider, analytics-provider, shared-cdn-control-plane]\ntest_cases:\n  - test_id: WEB-PASSIVE-DNS-TLS\n    family: transport-and-domain\n    references: [OWASP-ASVS-5.0.0, OWASP-WSTG-4.2]\n    control_objective: DNS, certificates, protocols, and redirects resolve to the intended client service.\n    interaction: Bounded DNS lookup, TLS handshake, and HTTP HEAD/GET requests.\n    preconditions: [ownership-proof-verified, external-scope-enforcement]\n    permitted_methods: [dns-query, tls-handshake, http-head, http-get]\n    prohibited_effects: [state-change, credential-use, third-party-targeting]\n    expected_result: Trusted certificate, intended host routing, approved protocol policy, and deterministic HTTPS redirect behavior.\n    evidence_required: [dns-answer, certificate-chain, protocol-result, redirect-chain, timestamp]\n    cleanup: [none-required]\n    default_enabled: true\n  - test_id: WEB-PASSIVE-RESPONSE\n    family: headers-cookies-errors-exposure\n    references: [OWASP-ASVS-5.0.0, OWASP-ZAP-BASELINE]\n    control_objective: Public responses apply intended browser controls and reveal no obvious secret, debug, or deployment exposure.\n    interaction: Brief same-host crawl and passive response analysis.\n    preconditions: [rate-limit-enforced, redirect-boundary-enforced, kill-switch-ready]\n    permitted_methods: [same-host-crawl, passive-analysis]\n    prohibited_effects: [active-payload, form-submission, file-upload, authentication-attempt]\n    expected_result: No material passive finding and no scope escape.\n    evidence_required: [exact-command, tool-image-identity, report-json, report-html, policy-decision]\n    cleanup: [remove-ephemeral-container, retain-redacted-evidence]\n    default_enabled: true\nlimits:\n  requests_per_second: 1\n  concurrency: 1\n  duration_minutes: 5\n  max_error_rate: 0.05\n  max_latency_ms: 3000\n  max_test_records: 0\nstop_conditions:\n  - target leaves approved host or path boundary\n  - widespread 5xx responses or material latency increase\n  - any third-party or cross-tenant content appears\n  - telemetry or rate enforcement is lost\n  - emergency contact requests stop\nevidence:\n  destination: evidence://client-demo/web/passive/TEST-DEMO-PASSIVE-001\n  redact: [authorization, cookie, token, secret, personal-data]\n  integrity: sha256-plus-signed-manifest\n  retention_days: 90\ncleanup:\n  - stop worker at duration limit\n  - remove temporary container and cache\n  - verify no application state was changed\n  - record final cleanup status\nstatus: authorized\n"}