Frequently Asked Questions

Technical answers covering scanning modes, bench requirements, security models, and suppression.

Scanning & Analysis

Does frapAST require a running Frappe bench to scan code?

No. Standard scanning (frapast scan) is completely static and offline. It indexes Python ASTs, DocType JSON schemas, and hooks.py files without invoking any Python interpreters or requiring database access. A bench is only needed for Tier 2 active HTTP/RPC proof verification.

How does frapAST resolve DocType schema permissions?

frapAST parses all doctype.json files across the target app and its dependencies. It extracts fields, istable flags, is_submittable status, and permission rules (e.g. if_owner, role permissions) into an indexed memory schema.

Active Proof & Verification

What is the difference between Tier 1 and Tier 2 proofs?

Tier 1 (AST Proof) generates a standalone, self-contained Python program that exercises logic bugs (e.g. missing rollback handlers, mutable default args, bare except blocks) locally.

Tier 2 (HTTP/RPC Proof) executes live HTTP requests against your Frappe bench via FrappeHTTPClient to verify whether guest or unauthorized users can trigger unauthenticated mutations or injection vectors.

Suppression & False Positives

How do I suppress a false positive?

frapAST supports three suppression methods:

• Inline comment directive: Append # frapast: ignore FR-PERM-001 to the specific line.
• Config file exclusion: Exclude paths in frapast.toml or .frapastignore.
• Cryptographic Baseline: Generate a baseline of known findings via frapast scan --write-ledger.