NoryBot pilot / Security & data

Know what is being checked

Focused checks, explicit coverage, and evidence you can review. Start with a target you own or are authorized to test.

Start with an authorized target

Web checks actively send requests. Use a development or staging application you own, or one you have permission to test. Begin with the less aggressive mode and review the configured scope.

First authorized web scan

norybot scan web \
  --url https://your-app.com \
  --yes-i-have-authorization \
  --no-aggressive \
  --skip-triage

Scan source code

norybot scan code --path ./src --skip-triage

Use skip_checks and skip_paths in configuration to narrow activity. Inspect the coverage section of every report.

Understand the result

A finding is a review item, not proof of exploitation. These are security hygiene checks; they do not replace a penetration test or comprehensive security assessment. AI triage adds context but cannot recover checks that did not run.

Turn supported findings into regression tests

Scans build a local SQLite evidence graph and an HTML report. Small, query-free HTML/text pages with missing security headers can produce reviewable regression contracts. These test the recorded header condition and document identity; they do not validate every security policy directive.

For an ownership check, create an explicit contract with two bearer-session environment references, the authenticated identity endpoint, and the expected user and resource IDs.

Prepare an ownership regression

norybot security access \
  --url http://localhost:3000/api/invoices/invoice-1 \
  --identity-url http://localhost:3000/api/me \
  --owner-env TEST_OWNER_BEARER --other-env TEST_OTHER_BEARER \
  --owner-id '"user-a"' --other-id '"user-b"' \
  --resource-field id --resource-value '"invoice-1"'

Reproduce, fix the application, then rerun the same test ID

norybot security verify <test-id> --yes-i-have-authorization
norybot security export <test-id> --framework playwright
norybot security report

Creating or exporting a contract sends no requests. Verification requires Pro and target authorization. It confirms both identities and legitimate owner access before evaluating the other user's resource request. Wrong identities, redirects, failed controls, and network errors are inconclusive.

“Fix verified” requires a recorded reproduction and a subsequent pass of the unchanged contract on the same target. A new assertion or target starts a new baseline. Standalone Cypress/Playwright exports can run in your own suite; they do not update NoryBot history automatically.

Where data goes

Data or operation	Destination
Generated tests and reports	Written to your local project
QA page and test context	Your configured AI provider
Optional security triage	Up to 40 selected, redacted findings with bounded relationship metadata sent to the separately configured security provider
Managed NoryBot Cloud AI (when enabled)	NoryBot backend, then a disclosed AI provider; selected QA context or findings are processed under the Cloud terms, with separate account and accounting records
Dependency auditing	Package registry requests
Paid license validation	Polar, before paid scans and regression verification

Recorded regression runs omit session credentials and response bodies. Scanner findings omit source bodies and HTML comment text, but can retain detected evidence such as exposed email addresses or stack-trace signatures. URLs and credential-shaped output are redacted before security reports and AI triage. QA generation has a separate context flow. NoryBot is not a fully offline product.

Pilot documentation · September 2026

Account & billing