pentest gforge loom ai-gateway genai appsec scope
GForge — Current vs Planned Capabilities
Scope guard for the engagement. GForge contains substantial roadmap functionality — this note keeps live capability separate from future capability so planned features do not silently enter scope.
Capability Matrix
| Capability | State | Confidence | Pentest Implication |
|---|---|---|---|
| Loom / LibreChat web UI | Current | Confirmed | Primary user-facing surface |
| AI Gateway model proxy | Current | Confirmed | Primary service under test |
| AWS Bedrock model routing | Current | Confirmed | GLM 5 stated as enabled in production |
| Okta + PKCE authentication | Current | Confirmed | Current browser authentication flow |
| Internal-only VPN / VPC placement | Current | Confirmed | Network boundary; not a substitute for app-layer controls |
| Vault → SSM → secret injection | Current | Confirmed | Supporting runtime configuration path |
| Snyk repository integration | In progress | Confirmed workstream | Use available results as testing input |
| Budget enforcement | Planned | Confirmed future | Do not assume implemented |
| Rate-limit governance | Planned | Confirmed future | Current controls must be verified rather than assumed |
| CLI access + separate auth flow | Planned | Confirmed future | Out of current scope unless enabled for test |
| Agentic email / Teams / GitHub workflows | Planned | Confirmed future | Excessive-agency / tool testing becomes relevant only when implemented |
| Additional / self-hosted models | Planned | Confirmed future | Model governance protocols are being defined |
| Direct Hugging Face enablement | Not planned | Confirmed | Meeting explicitly stated models would be governed/hosted through AWS rather than direct Hugging Face enablement |
Scope Guardrail
Warning
Do not spend current-test time on agent tool permissions, email/Teams/GitHub connectors, CLI authentication, or budget enforcement unless those functions are actually present and approved in staging at test time.
Model Enablement
| Model | State | Confidence |
|---|---|---|
| GLM 5 | Production-enabled at meeting time | Confirmed |
| Kimi 2.5 | Future / planned | Confirmed as future |
| Qwen 2.5 | Future / planned | Confirmed as future |
| Self-hosted / open-source routes | Future / planned | Confirmed as future |
To Confirm
- Is GLM 5 still the only production-enabled model at test time?
- Are Kimi / Qwen / self-hosted models enabled in staging?
Residual Risk from Missing Controls
Because governance features are roadmap items, the absence of a control is itself worth documenting.
| Missing / Planned Control | Current Residual Risk |
|---|---|
| Budget enforcement | Uncontrolled model spend is not prevented by design today |
| Rate-limit governance | Request-volume abuse depends on whatever limits exist today — must be measured, not assumed |
| Broader model governance protocols | Model/provider policy scope is still being defined |
Note
Report these as current residual risk with planned mitigation, not as bypassed controls. A control that does not exist cannot be bypassed.
Feature Confirmation Checklist
Run this at kickoff before writing test cases.
- Which functions are definitely enabled in staging on day one?
- Are uploads enabled?
- Is retrieval / RAG enabled?
- Are plugins enabled?
- Is browsing enabled?
- Are tools / connectors enabled?
- Is code execution enabled?
- Is CLI access enabled?
- Are agentic workflows (email / Teams / GitHub) enabled?
- Which budget / rate controls are actually implemented today versus roadmap?
- Which Bedrock guardrails or model-governance controls are currently active?
Important
If a feature is not enabled, explicitly exclude it in the scope record rather than leaving it ambiguous.
Testing Priority by State
Everything marked P3 in the priority matrix is future capability and stays out of active testing by default:
| P3 Area | Becomes Testable When |
|---|---|
| CLI authentication | Implemented and in scope |
| Agentic tool permissions / indirect prompt injection | Tools, retrieval, or connectors are enabled |
| Budget governance bypass | Enforcement actually exists |
Full priority matrix and methodology → GForge - Pentest Game Plan > Priority Matrix