.zap-baseline.conf

# OWASP ZAP Baseline Configuration
# This file configures ZAP baseline scan rules

# Rules to include (comprehensive security scan)
include = *

# Rules to exclude (false positives or low priority)
exclude = 
    10021,  # X-Content-Type-Options header missing (we add this via middleware)
    10020,  # X-Frame-Options header missing (we add this via middleware)
    10054,  # CSP header missing (we add this via middleware)

# Alert thresholds
# HIGH = High risk vulnerabilities
# MEDIUM = Medium risk vulnerabilities  
# LOW = Low risk vulnerabilities
# INFO = Informational findings

# Minimum alert level to report
minAlertLevel = LOW

# Maximum alert level to report
maxAlertLevel = HIGH

# Scan duration (in seconds)
scanDuration = 300

# Timeout for requests (in seconds)
requestTimeout = 30

# Follow redirects
followRedirects = true

# Maximum redirects to follow
maxRedirects = 5

# Active scan policy
activeScanPolicy = DEFAULT

# Passive scan rules
passiveScanRules = DEFAULT

# Authentication (if needed)
# authType = form
# authUrl = http://localhost:8000/api/login
# authUsername = test
# authPassword = test

# Context configuration
# contextName = CreditNexus
# contextUrl = http://localhost:8000