pentest gforge loom ai-gateway api-security appsec
GForge — Endpoint Inventory
Working inventory for Loom and the AI Gateway. Do not invent endpoints — populate only from browser traffic, provided API documentation, or architecture docs.
Build this in Phase 2 before negative authorization testing → GForge - Pentest Game Plan > Phase 2 — Baseline Behavior and Endpoint Inventory.
Loom (UI / Application)
| Method | Endpoint | Purpose | Auth Required | Role/Object | Object ID Type | Environment | Tested | Notes |
|---|---|---|---|---|---|---|---|---|
| [ ] |
AI Gateway
| Method | Endpoint | Purpose | Client-Controllable Fields | Model/Provider | Auth Required | Environment | Tested | Notes |
|---|---|---|---|---|---|---|---|---|
| [ ] |
Authentication Flow Endpoints
| Step | Endpoint / Host | Token Involved | Notes | Captured |
|---|---|---|---|---|
| Okta authorize (PKCE) | [ ] | |||
| Token exchange | [ ] | |||
| Loom session establishment | [ ] | |||
| Gateway token validation | [ ] | |||
| Logout | [ ] |
Baseline Flows to Capture
Capture only flows that actually exist in the deployed build.
- Login (Okta / PKCE)
- Chat creation
- Model request
- Streaming / response delivery
- Chat history listing
- Chat history retrieval
- Project listing / retrieval
- Configuration or model settings
- Logout
- Error flows
Transport and Protocol
To Confirm
Does chat use normal HTTP, streaming SSE, WebSocket, or another transport? Confirm before building request-manipulation tests.
| Aspect | Observed | Notes |
|---|---|---|
| Chat transport | ||
| Streaming mechanism | ||
| API documentation available (Swagger / OpenAPI) |
Object Identifiers
Record identifier formats before authorization testing. Do not assume UI labels map directly to server-side boundaries.
| Object | Identifier Format | Predictable? | Ownership Model | Notes |
|---|---|---|---|---|
| Chat / conversation | To Confirm | |||
| Project | To Confirm | |||
| User | ||||
| Message |
Warning
Ownership and sharing semantics for Projects and Chat History are unconfirmed. See GForge - Security Model > Authorization and User-Data Isolation.
Sources
Populate from:
- Browser proxy traffic (Burp) in the approved staging environment
- Gateway API documentation (Swagger / OpenAPI) — availability To Confirm
- Confluence architecture documentation — not yet received