Fable RedTeam

Execute safe, bounded, agentic ethical penetration testing and active vulnerability discovery.

Purpose

Provide an automated, reproducible offensive security audit engine to prove whether application defenses withstand real-world attack vectors. fable-redteam verifies API authentication, authorization boundaries, object isolation, and sensitive exposures in authorized staging/local environments, producing immediate remediation cards for implementation.

When to Use

• Active security testing is needed for local, staging, or authorized test targets.
• Verifying whether API endpoints enforce authentication and authorization (BOLA/IDOR).
• Testing for CORS misconfigurations, missing security headers, or leaked .env files.
• Simulating attacker-controlled requests against staging endpoints before release.
• Validating whether a previously applied security patch truly eliminates the vulnerability.

When NOT to Use

• Pure static code review or threat modeling without live target endpoints (use fable-security).
• Functional test runs or assertion checking without security probing (use fable-verify).
• Unauthorized public targets outside the explicitly configured scope.
• Stress testing or denial-of-service simulations (strictly out of scope).