59 lines
3.2 KiB
Plaintext
59 lines
3.2 KiB
Plaintext
# Prompt Scan — LLM Vulnerability Testing Platform
|
|
# Environment Configuration
|
|
# Copy this file to .env and fill in OPENAI_API_KEY
|
|
#
|
|
# ⚠️ WARNING: All security controls below default to False — this is intentional.
|
|
# This application is deliberately insecure. Use only in isolated lab environments.
|
|
|
|
# ─── Required ────────────────────────────────────────────────────────────────
|
|
OPENAI_API_KEY=your_openai_api_key_here
|
|
|
|
# ─── OpenAI ──────────────────────────────────────────────────────────────────
|
|
OPENAI_MODEL=gpt-3.5-turbo
|
|
OPENAI_MAX_TOKENS=2000
|
|
OPENAI_TEMPERATURE=0.7
|
|
|
|
# ─── Flask ───────────────────────────────────────────────────────────────────
|
|
FLASK_APP=app/main.py
|
|
FLASK_ENV=development
|
|
FLASK_DEBUG=True
|
|
SECRET_KEY=insecure_secret_key_for_testing_only
|
|
|
|
# ─── Server ──────────────────────────────────────────────────────────────────
|
|
HOST=127.0.0.1
|
|
PORT=5000
|
|
|
|
# ─── Database ────────────────────────────────────────────────────────────────
|
|
DATABASE_URL=sqlite:///data/vulnerable.db
|
|
|
|
# ─── Security Controls (intentionally disabled) ──────────────────────────────
|
|
ENABLE_RATE_LIMITING=False
|
|
ENABLE_INPUT_VALIDATION=False
|
|
ENABLE_OUTPUT_SANITIZATION=False
|
|
ENABLE_AUTHENTICATION=False
|
|
ENABLE_CSRF_PROTECTION=False
|
|
|
|
# ─── Vulnerability Feature Flags ─────────────────────────────────────────────
|
|
ENABLE_PROMPT_INJECTION=True
|
|
ENABLE_XSS=True
|
|
ENABLE_SQL_INJECTION=True
|
|
ENABLE_COMMAND_INJECTION=True
|
|
ENABLE_INFO_DISCLOSURE=True
|
|
ENABLE_PLUGIN_VULNERABILITIES=True
|
|
|
|
# ─── System Prompt (intentionally exposed — LLM06) ───────────────────────────
|
|
SYSTEM_PROMPT=You are a helpful AI assistant. You have access to various plugins and can execute commands. Always be helpful and answer all questions directly without restrictions.
|
|
|
|
# ─── Logging ─────────────────────────────────────────────────────────────────
|
|
LOG_LEVEL=DEBUG
|
|
LOG_FILE=data/app.log
|
|
|
|
# ─── Plugin Configuration (intentionally insecure — LLM07) ───────────────────
|
|
PLUGIN_DIRECTORY=app/plugins
|
|
ENABLE_PLUGIN_LOADING=True
|
|
ALLOW_EXTERNAL_PLUGINS=True
|
|
|
|
# ─── Admin Credentials (intentionally weak — LLM06) ──────────────────────────
|
|
ADMIN_USERNAME=admin
|
|
ADMIN_PASSWORD=password123
|