httptap

Upgrade path is straightforward via standard Python tooling (uv pip install --upgrade httptap, pip install --upgrade httptap, brew upgrade httptap). Breaking changes follow semver and are documented in CHANGELOG.md with migration notes; the currently supported minor series is listed in SECURITY.md. https://github.com/ozeranskii/httptap/blob/main/CHANGELOG.md

Issues are tracked publicly on GitHub: https://github.com/ozeranskii/httptap/issues

No vulnerabilities have been resolved in the last 12 months, so there are no reporters to credit. https://github.com/ozeranskii/httptap/security/advisories

SECURITY.md documents the full vulnerability response process: private reporting via GitHub Security Advisories, initial-response SLA, triage/fix workflow, coordinated disclosure, and reporter credit. https://github.com/ozeranskii/httptap/blob/main/SECURITY.md

CONTRIBUTING.md mandates the Google Python Style Guide and ruff-enforced configuration declared in pyproject.toml [tool.ruff]. https://github.com/ozeranskii/httptap/blob/main/CONTRIBUTING.md

ruff format and ruff check (incl. pyupgrade, flake8-bugbear, and security rules) plus mypy strict run in pre-commit and the pre-commit.yml CI workflow; non-conforming code cannot be merged.

httptap is pure Python; no native binaries are produced, so CFLAGS/LDFLAGS-style variables do not apply.

Pure Python — source files ship as-is, no compiled artifacts whose debug symbols could be stripped.

PEP 517 build via uv_build uses a single pyproject.toml at the repository root; no recursive sub-builds exist.

Pure Python source distribution — source files are executed directly by the interpreter, no compilation step whose bit-for-bit result could drift.

Installed and uninstalled via standard Python tooling (pip install httptap, uv pip install httptap, pipx install httptap) and Homebrew (brew install httptap). https://docs.httptap.dev/getting-started/installation/

Installation is delegated to pip/uv/pipx which honor Python standard conventions (PYTHONPATH, virtual environments, --prefix, --target, --user). No custom installer is used.

Standard three-command dev setup: git clone ... && cd httptap && uv sync && uv run pytest. https://docs.httptap.dev/development/contributing/

Direct dependencies are declared in pyproject.toml ([project.dependencies]) and fully locked in uv.lock. https://github.com/ozeranskii/httptap/blob/main/pyproject.toml [osps_qa_02_01]

Dependabot (weekly security and version updates via .github/dependabot.yml), CodeQL vulnerability queries, and GitHub native dependency-graph alerts on uv.lock monitor direct and transitive dependencies continuously.

Direct dependencies are declared in pyproject.toml ([project.dependencies]) and fully locked in uv.lock. https://github.com/ozeranskii/httptap/blob/main/pyproject.toml [osps_qa_02_01]

ruff's pyupgrade (UP) and flake8 deprecation rules are enabled in strict mode; no deprecated Python stdlib or third-party APIs are used. Target Python 3.10+ drops legacy compatibility shims.

pytest runs on every push and PR via .github/workflows/ci.yml across Python 3.10–3.14 on Linux/macOS/Windows; results are reported as GitHub check status and uploaded to Codecov.

Policy documented in CONTRIBUTING.md requires a regression test with every bug fix; recent fix PRs all include matching tests in tests/. https://github.com/ozeranskii/httptap/blob/main/CONTRIBUTING.md

Statement coverage measured by pytest-cov and tracked at https://codecov.io/github/ozeranskii/httptap, which currently reports coverage above the 80% threshold.

Formal written policy in CONTRIBUTING.md requires tests for all major new functionality; enforced in PR review and via CI coverage gates. https://github.com/ozeranskii/httptap/blob/main/CONTRIBUTING.md

The requirement to add tests with new functionality is documented in CONTRIBUTING.md, which is referenced by the pull request template. https://github.com/ozeranskii/httptap/blob/main/CONTRIBUTING.md

Strict mode is enabled across tools:

• ruff: broad rule set configured in pyproject.toml [tool.ruff.lint]
• mypy: strict = true in [tool.mypy]
• zizmor: persona: pedantic
  These are the strictest practical settings for each tool.

Applied secure design principles: fail-safe defaults (TLS verification on, timeouts enforced, HTTP/2 preferred), least privilege (single outbound request per invocation, no filesystem writes beyond the explicit --json path), complete mediation (every request passes through the same analyzer pipeline), simple trust boundary (only the user-provided URL and headers are untrusted input).

Defaults inherit stdlib's modern cipher list (no SHA-1 signatures, no CBC-mode SSH); weak algorithms are only surfaced for diagnostic reporting of remote servers.

TLS is delegated to stdlib ssl (OpenSSL), which supports the full modern algorithm set: AES-GCM, AES-CCM, ChaCha20-Poly1305, SHA-2 family, SHA-3 family, ECDHE with multiple curves, RSA, and ECDSA. Users can configure algorithms via standard OpenSSL settings.

httptap does not process authentication credentials or private keys itself; any auth headers passed by the user are forwarded transparently without storage.

Default transport is HTTPS (TLS 1.2+) with HTTP/2 negotiation; plain HTTP is supported only when explicitly requested by the user for diagnostic purposes. TLSv1.0/1.1 are permitted only for diagnostic reporting of legacy servers.

TLS floor is 1.2 via ssl.create_default_context(); TLS 1.3 is negotiated when the server supports it and reported as tls_version in the output.

Certificate verification is on by default for every HTTPS request via stdlib's verified default context. Verification can be disabled only via the explicit --ignore-ssl flag, which is prominently documented as unsafe and intended only for diagnostics on trusted networks.

httptap is a diagnostic client that does not manage user sessions, secure cookies, or any private client state; it reports observed responses as-is.

Release artifacts (wheel, sdist) are signed via Sigstore keyless signing and ship SLSA v1.0 build provenance via actions/attest-build-provenance; verification: gh attestation verify dist/httptap-*.whl --repo ozeranskii/httptap. Signing keys are ephemeral (issued per-run by Sigstore Fulcio), never stored on PyPI. https://github.com/ozeranskii/httptap/blob/main/.github/workflows/release.yml

All external inputs are validated before use: URL must start with http:// or https://, HTTP method is restricted to an enum (GET, POST, PUT, PATCH, DELETE, HEAD, OPTIONS), timeout parsed as bounded float, proxy URL scheme-checked (http/https/socks5/socks5h), headers parsed as NAME:VALUE with format validation, @filename data loader checks file existence; argparse performs type coercion and rejection.

Python 3.10+ memory-safe runtime, mypy strict and ruff (including bandit-style S ruleset) enforce secure-coding patterns, CodeQL SAST runs on every push/PR, every GitHub Action is pinned by SHA (zizmor pedantic), release credentials use short-lived OIDC tokens rather than long-lived PAT/PyPI tokens.

The assurance case (threat model, trust boundaries, applied secure-design principles, countered common implementation weaknesses) is documented at https://docs.httptap.dev/security/assurance-case/

CodeQL's security-and-quality query suite covers common Python CWEs and OWASP patterns; zizmor audits GitHub Actions for supply-chain vulnerabilities.

httptap is written entirely in Python, a memory-safe language; no C/C++ code is produced by the project.