Struct VerifyConfig 

pub struct VerifyConfig {
    pub timeout: Duration,
    pub max_concurrent_per_service: usize,
    pub max_concurrent_global: usize,
    pub max_inflight_keys: usize,
    pub danger_allow_private_ips: bool,
    pub danger_allow_http: bool,
    pub proxy: Option<String>,
    pub insecure_tls: bool,
    pub allow_script_verify: bool,
}

Runtime configuration for live verification.

Config-surface boundary: VerifyConfig is an orthogonal subsystem config, NOT part of the detection/bench config surface. Only ScanConfig + ScannerConfig (+ nested MultilineConfig) influence detection accuracy and are exercised by the benchmark. VerifyConfig governs live HTTP verification (network I/O, concurrency, proxy, TLS) and is constructed only on the --verify path (cli/src/orchestrator/postprocess.rs); the bench runs with --no-verification and never touches it. The sibling orthogonal configs are OobConfig (verifier/src/oob/session.rs, --verify-oob only), HttpClientConfig (sources/src/http.rs, per-source network I/O), MegakernelSessionConfig (scanner GPU slot geometry), and AwsSigV4Config (S3 request signing). Do NOT fold any of these into the canonical scan config: they are legitimately separate axes.

Fields

timeout: Duration

End-to-end timeout for one verification attempt.

max_concurrent_per_service: usize

Maximum concurrent requests allowed per service.

max_concurrent_global: usize

Maximum concurrent verification tasks overall.

max_inflight_keys: usize

Upper bound for distinct in-flight deduplication keys.

danger_allow_private_ips: bool

Whether to skip SSRF protection for private IP addresses.

danger_allow_http: bool

Whether to allow plaintext HTTP verification URLs. Default false: production paths must use HTTPS so credentials are never sent in the clear. Test fixtures (mock HTTP servers, in-memory listeners) opt in.

proxy: Option<String>

Explicit upstream proxy URL applied to every verifier request and OOB poll, set ONLY by --proxy / TOML. None means no proxy and also neutralizes reqwest’s ambient proxy-env detection; no environment variable is consulted (config-policy mandate + security: an ambient proxy must never silently reroute secret-bearing traffic). The literal "off"/"none" sentinels disable proxying explicitly.

insecure_tls: bool

Accept invalid / self-signed TLS certs for verifier + OOB traffic. Off by default. Required when intercepting through a MITM proxy (Burp, mitmproxy) that re-signs HTTPS with its own CA.

allow_script_verify: bool

Permit AuthSpec::Script verification. Off by default because detector TOML can otherwise execute verifier-supplied code with credential context. The CLI sets this only from the visible --allow-script-verify flag and prints a warning when active; no environment variable can weaken the policy.

Trait Implementations

impl Default for VerifyConfig

fn default() -> Self

Returns the “default value” for a type.