COS target template

Use this sample configuration file with snyk cos target add.

Description

Use this sample template file with the snyk cos target add command.

The configuration file has three sections:

• target: the name of the application, its primary URL, and the hosts to include in or exclude from the scope.

• authentication: the login URL and one entry for each user role the scan should test.

• settings: the headers and cookies to inject into every request, and free-form guidance for the agent.

The configuration file can contain credentials and other secrets. Mark every secret value with sensitive: true and store the file securely.

Example

# Target configuration
# ── Target ─────────────────────────────────────────────────────────
target:
  name: "Customer Portal"                    # Display name — required
  url: "https://app.acme.com"                # Primary URL — required
  additional_scope:                          # Optional — domains, subdomains. *.acme.io or **acme.io
    - host: "api.acme.com"

  reject:                                    # Optional — domains, subdomains. *.acme.io or **acme.io
    - "admin.acme.io"

# ── Authentication ──────────────────────────────────────────────────
authentication:
  login_url: "https://app.acme.com/login"    # Optional — auto-detected if omitted
  users:                                     # Optional — one entry per role
    - label: "Standard user"
      type: credentials_login                # credentials_login | custom
      credentials:
        - key: username
          value: "[e-mail]"
        - key: password
          value: "password"
          sensitive: true
      instructions: |                        # Optional — login hints for the agent
        Accept the cookie banner on first visit. Select the EU region if prompted.
    - label: "Admin user"
      type: credentials_login
      credentials:
        - key: username
          value: "[e-mail]"
        - key: password
          value: "password"
          sensitive: true
        - key: api_key
          value: "sk-acme-prod-abc123"
          sensitive: true
    - label: "User with MFA"
      type: credentials_login
      credentials:
        - key: username
          value: "[e-mail]"
        - key: password
          value: "password"
          sensitive: true
      totp_secret: "JBSWY3DPEHPK3PXP"
    - label: "SSO user"
      type: custom
      instructions: |
        Navigate to /login, click "Sign in with SSO", enter the email in #sso-email,
        click Continue, complete the IdP login, then accept the MFA push notification.

# ── Other settings ──────────────────────────────────────────────────
settings:
  headers:                                   # Optional — injected into every request
    - key: X-Bug-Bounty
      value: "snyk-evo-prod"
    - key: X-Internal-Token
      value: "abc123"
      sensitive: true
  cookies:                                   # Optional — injected as Cookie header
    - key: consent
      value: "accepted"
    - key: session_hint
      value: "eu-west"
  context: |                                 # Optional — free-form agent guidance
    All data is EU-resident. Session tokens expire after 30 minutes.
    Do not create real payment transactions — use amounts under €0.01 for test flows.