1/** 2 * TASK-0134 security audit suites (OWASP ASVS L2). 3 * 4 * Two families: 5 * - **Static / engine suites** (deps, gitleaks-config, permission-fuzz, 6 * formula-fuzz, audit-report) run anywhere with the lockfile + source. 7 * - **Live-app suites** (auth-paths, headers, upload-abuse, rate-limits) 8 * need a running API + web — they resolve `SEC_API_URL` / 9 * `SEC_WEB_URL` (defaults http://localhost:4000 / :3000, matching the dev 10 * stack and the CI e2e services) and SKIP (not fail) when the API is 11 * unreachable, so the suite is green in a partial environment but red in 12 * CI where the stack IS up (the CI stage asserts the skip-count is zero). 13 * 14 * Fuzz budgets: 10k iterations in CI (fixed seed); `SEC_FUZZ_SEED=random` 15 * (nightly) re-seeds fast-check. 16 */ 17import { defineConfig } from "vitest/config"; 18 19export default defineConfig({ 20 test: { 21 environment: "node", 22 include: ["**/*.test.ts"], 23 // The live-app suites boot the full stack in CI (cold pulls) — 120 s hook 24 // timeout; the fuzz suites are CPU-bound but bounded (10k × <50 ms evals). 25 testTimeout: 60_000, 26 hookTimeout: 120_000, 27 teardownTimeout: 15_000, 28 }, 29}); 30