Security services (CTEM)
The security-services suite (CTEM / DAST / SAST / VM) is described by GET /v1/security/services — a public, unauthenticated edge that DESCRIBES only.
curl -s https://api.kotoba.cloud/v1/security/services | jq '.[] | {id, status}'
# ctem → "component-shipped"
# dast → "gated"
# sast → "gated"
# vm → "component-shipped"CTEM — exposure management
CTEM continuously enumerates the external attack surface and entry points, and hands attack paths plus asset context to the VM ledger (status: component-shipped).
# CTEM capabilities (from the catalog entry)
surface-inventory # continuous external attack-surface / asset inventory
attack-path # reachable attack-path identification
context # asset context (public routes, deps, owner)
exposure-feed # exposure events fed to the VM ledger
# inputs: assets, dns, certificates, open-endpoints
# outputs: attack-paths, exposure-findings, asset-context
# integration: feeds vm, emits :finding (shared finding-schema)SAST — static application security testing
SAST analyzes source code for vulnerable patterns and missing sanitization, emitting code findings with file and line to the VM ledger (status: gated).
# SAST capabilities (from the catalog entry)
code-analysis # static source-code analysis
taint-flow # taint / data-flow inspection
code-finding # code findings with file + line
# inputs: source-code, dependency-manifests
# outputs: code-findings, taint-paths, dependency-notes
# integration: feeds vm, emits :finding (role: code-findings)DAST — dynamic application security testing
DAST probes running applications and reports reproducible runtime findings (request/response evidence) to the VM ledger (status: gated).
# DAST capabilities (from the catalog entry)
runtime-probe # dynamic probing of running applications
auth-scenarios # probing with authenticated scenarios
runtime-finding # runtime vulnerability detection as findings
# inputs: running-apps, scan-scopes, auth-scenarios
# outputs: runtime-findings, request-response-evidence
# integration: feeds vm, emits :finding (role: runtime-findings)DAST / SAST are gated (behind the private authority). The three upstream services emit findings in the shared finding-schema; VM dedups, scores (reachability × exploitability) and tracks remediation keyed by CPE/CVE.