Documentation

Everything here is the repository’s own documentation, rendered from the files the build ships with. If a page disagrees with the tool, the tool is right and the page is a bug.

Quickstart

Install, write a scope file, read the plan. Nothing is sent until --execute, and nothing runs outside the allowlist whether or not you pass it.

pipx install relift

relift init-scope --engagement lab \
  --host 10.20.0.0/16 --deny 10.20.4.0/24 --out scope.json

relift plan --target mysql://10.20.7.9:3306/app --scope scope.json
relift scan --target mysql://10.20.7.9:3306/app --scope scope.json --execute

relift chains --run latest     # the threads, from the stored run
relift report --run latest --format md --out report.md

A scope file is not a formality: it carries the owner, the engagement, an expiry, a risk ceiling and the deny rules. Deny wins, a *.example.com rule never matches example.com itself, and a CIDR wider than /22 is refused unless you insist.

What is in the tree

Support

Bugs and feature requests go to GitHub Issues. A report is easiest to act on when it includes the run_id, the profile, and the catalogue entry you expected to fire.