leebaird/engagement-mgrEngagement Manager is a web application for tracking offensive security engagements. It features a modern UI, built with Next.js, Prisma, and PostgreSQL.
Engagement Manager is a web application for tracking offensive security engagements. It features a modern UI, built with Next.js, Prisma, and PostgreSQL. The app includes a calendar, engagements, clients, contacts, findings, and operators.
Lee Baird @discoverscripts
Jay "L1ghtn1ng" Townsend @jay_townsend1
| Scanner/export family | Accepted export |
|---|---|
| Burp Suite | Issues XML, including the inert internal schema DTD |
| Nessus / Tenable | Nessus v2 XML (.nessus) |
| Nmap | XML; open ports and their script output become informational observations, not inferred vulnerabilities |
| OpenVAS / Greenbone | Native XML report or GMP get_reports_response |
| OWASP ZAP | Traditional JSON report with sites and alerts |
| Nuclei | JSON Lines (-jsonl) |
| Qualys | Scan-result XML (SCAN/IP structure), not the separate host-detection API format |
| Semgrep / CodeQL and other SARIF producers | SARIF JSON runs, rules and results |
Exports are limited to 2 MB and 500 findings per import, with per-user preview and confirmation rate limits. The application accepts at most 10,000 findings in total and 500 for one engagement across manual creation, templates and scanner imports. The global Findings list loads 100 rows per page, and engagement/report finding queries are capped by the same per-engagement limit. Unknown layouts fail visibly rather than silently being treated as a successful import. Scanner severities are suggestions: review their context before approval. Referenced URLs, HTML and embedded remote images are not fetched or executed.
Reports allow 1–100 findings, up to 100 evidence images (5 MB each, 20 MB total input), 500 pages and 25 MB output. Issuance is limited to 50 versions per engagement and 1 GB of issued PDFs across the application. Preview and issuance have per-user rate limits, and only one PDF render is admitted per application process at a time. Findings retain at most 1000 revisions and 500 comments; reaching a limit fails without overwriting history. DejaVu fonts and their redistribution license are included in assets/fonts; deployments must retain these assets (Next output tracing includes them).
Next.js Server Actions share a single 25mb body size limit (set in next.config.ts) for evidence uploads. Login uses a dedicated same-origin URL-encoded route with a 4 KB streaming limit before authentication or database work.
This preserves the existing shared authenticated workspace, not a new per-client tenancy model. All new pages, actions and PDF downloads check a current database-backed session. Drafts are scoped to their owner; review, template approval and issuance permissions are enforced server-side. Confidential PDF responses are private/no-store. Final PDFs contain only an explicit report field allowlist, never private drafts, review comments or unrelated engagements.
The implementation uses the OWASP Top 10:2025 checklist: access checks (A01), private responses and existing CSP/CSRF controls (A02), pinned dependencies and CI (A03), existing session/secret protections plus report integrity checks (A04/A08), inert Markdown/XML and parameterized database access (A05), bounded processing and independent review (A06), live session checks (A07), content-free audit events (A09), and transactional changes with cleanup on failure (A10). A digest detects accidental corruption; it is not a digital signature or protection from a database administrator. This is not a compliance certification. Production still requires HTTPS, protected database/backup storage and operational monitoring of audit output.
