Skill-driven AI security review for Burp Suite
_{Capture traffic → pick a review goal → get a triaged vulnerability dashboard with AI findings, PoCs and reports.}

1. Download release/sectiv-1.0.0.jar.
2. Burp Suite → Extensions → Installed → Add → type Java → select the JAR.
3. A Sectiv tab appears. Open Settings, paste your AI provider API key. Done.

• Severity dashboard — Critical / High / Medium / Low / Info, search, filters, triage status and HTML / Markdown / JSON export.
• Scope picker — load proxy history or site map, filter, collapse duplicates, remove static assets, tick the requests to review.
• Skills — built-in demo skills (IDOR, XSS, SQLi, SSRF, auth…) plus create, edit, import and export your own.
• Structured findings — description, steps to reproduce, impact, PoC (HTML / Python / curl), CWE/CVE and CVSS.
• Identity context — two accounts for BAC/IDOR reasoning, plus an optional deterministic identity-swap check.
• Multiple providers — DeepSeek, OpenAI, Claude, GLM, z.ai, OpenRouter, Ollama and any OpenAI-compatible endpoint.
• Privacy controls — cookies, tokens, keys and JWTs are masked before traffic is sent to the model.

1. Settings — pick a provider, set base URL + model, paste the API key, Test connection, save.
2. Scan → Target scope — load history or site map and tick the requests to review.
3. Scan → Review goal — pick a skill (or run all enabled).
4. Scan → Identity context — optionally paste two accounts for BAC/IDOR checks.
5. Run scan — findings appear live in the dashboard; export when done.

The built-in skills are demo examples — add your own skills tailored to your target.

Tip: end every skill body with a validation instruction, for example:

Before reporting a finding, confirm it against the captured evidence and explain what would validate it. If you cannot confirm it, mark it tentative or leave it out.

That one line eliminates most false positives.

Requires JDK 21.

./gradlew test          # unit + headless UI tests
./gradlew shadowJar     # builds build/libs/sectiv-1.0.0.jar

• This is an AI-assisted review — validate every finding before reporting it.
• The AI only reasons about the traffic you select; it cannot discover endpoints that are absent from that traffic.