openshield/.env.example at dev · OWASP/openshield · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
# Database
DATABASE_URL=postgresql://openshield:openshield@localhost:5432/openshield

# Auth - see docs/security/authentication.md
# shared_secret (default, local/CI) or oidc (enterprise identity provider)
OPENSHIELD_AUTH_MODE=shared_secret
JWT_SECRET=change-me-in-production
# Optional in shared_secret mode; validated when set
JWT_ISSUER=
JWT_AUDIENCE=
# Required when OPENSHIELD_AUTH_MODE=oidc
OIDC_ISSUER=
OIDC_AUDIENCE=
OIDC_JWKS_URL=
# Optional oidc settings
OIDC_ALLOWED_TENANTS=
OIDC_ROLE_CLAIM=roles
OIDC_ROLE_MAP=

# Optional - comma-separated subscription_id allowlist for POST /api/scans/trigger.
# Unset accepts any subscription_id (matches historical behavior); the API
# logs a startup warning when this is unset. See docs/api-reference.md.
OPENSHIELD_AUTHORIZED_SUBSCRIPTIONS=

# AI providers - add at least one
ANTHROPIC_API_KEY=
GROQ_API_KEY=
GEMINI_API_KEY=

# Optional
NVD_API_KEY=
SENTRY_DSN=

# Optional - enables AZ-SC-007/008 (Azure DevOps pipeline scanning)
AZURE_DEVOPS_ORG_URL=
AZURE_DEVOPS_PROJECT=