Struct VerifyConfig 

pub struct VerifyConfig {
    pub timeout: Duration,
    pub max_concurrent_per_service: usize,
    pub max_concurrent_global: usize,
    pub max_inflight_keys: usize,
    pub danger_allow_private_ips: bool,
    pub danger_allow_http: bool,
    pub proxy: Option<String>,
    pub insecure_tls: bool,
}

Runtime configuration for live verification.

Config-surface boundary: VerifyConfig is an orthogonal subsystem config, NOT part of the detection/bench config surface. Only ScanConfig + ScannerConfig (+ nested MultilineConfig) influence detection accuracy and are exercised by the benchmark. VerifyConfig governs live HTTP verification (network I/O, concurrency, proxy, TLS) and is constructed only on the --verify path (cli/src/orchestrator/postprocess.rs); the bench runs with --no-verification and never touches it. The sibling orthogonal configs are OobConfig (verifier/src/oob/session.rs, --verify-oob only), HttpClientConfig (sources/src/http.rs, per-source network I/O), MegakernelSessionConfig (scanner GPU slot geometry), and AwsSigV4Config (S3 request signing). Do NOT fold any of these into the canonical scan config: they are legitimately separate axes.

Fields

timeout: Duration

End-to-end timeout for one verification attempt.

max_concurrent_per_service: usize

Maximum concurrent requests allowed per service.

max_concurrent_global: usize

Maximum concurrent verification tasks overall.

max_inflight_keys: usize

Upper bound for distinct in-flight deduplication keys.

danger_allow_private_ips: bool

Whether to skip SSRF protection for private IP addresses.

danger_allow_http: bool

Whether to allow plaintext HTTP verification URLs. Default false: production paths must use HTTPS so credentials are never sent in the clear. Test fixtures (mock HTTP servers, in-memory listeners) opt in.

proxy: Option<String>

Explicit upstream proxy URL applied to every verifier request and OOB poll. None falls back to the KEYHOG_PROXY env var; literal "off" disables proxying entirely. Until this was added, --proxy only reached the WebSource scanner - verification traffic and interactsh polls bypassed it silently, surprising operators who pointed Burp at keyhog and saw only half the traffic.

insecure_tls: bool

Accept invalid / self-signed TLS certs for verifier + OOB traffic. Off by default. Required when intercepting through a MITM proxy (Burp, mitmproxy) that re-signs HTTPS with its own CA.

Trait Implementations

impl Default for VerifyConfig

fn default() -> Self

Returns the “default value” for a type.