docs: add ROADMAP.md with production roadmap

Author: bot

ROADMAP.md

@@ -0,0 +1,100 @@
+# BugFinder Production Roadmap
+
+## Phase Completed ✓
+- [x] TLS verification enabled (was `verify=False` everywhere)
+- [x] Secret redaction in evidence
+- [x] All 63 mypy strict mode errors resolved
+- [x] CI enforces type checking
+- [x] Race condition fixed in rate limiter
+- [x] Scope bypass fixed (no-hostname URLs)
+- [x] Finding ID collisions fixed across 6 agents
+- [x] Shannon entropy optimized O(256n) → O(n)
+- [x] Database indexes on all FKs
+- [x] Dockerfile: non-root user, healthcheck
+- [x] HTTP retry + structured logging
+- [x] Prompt injection + stored XSS sanitized
+- [x] 95 tests (up from 52)
+
+## Phase 1 — Foundation for Automation
+- [x] Create ROADMAP.md
+- [x] Wire `ScopeEnforcer` into shared HTTP client
+- [x] Add shared HTTP client helper to `BaseAgent`
+- [x] Initialize structured logging at startup
+- [x] Unify scan execution (delete duplicate `_async_scan`, use `ScanOrchestrator`)
+- [ ] Implement `bf report` command
+
+## Phase 2 — Complete the Agent Layer
+- [ ] `web.crawler`: full recursive crawl with Playwright
+- [ ] `web.sqli`: POST, blind time-based, OOB detection
+- [ ] `web.xss`: stored + DOM XSS with headless browser
+- [ ] `recon.dns`: MX/NS/TXT/CNAME + passive subdomain enumeration
+- [ ] `recon.subdomain`: crt.sh + DNS brute-force
+- [ ] `web.auth`: login detection, credential testing, JWT analysis
+- [ ] `web.ssrf`: collaborator-based detection
+- [ ] `web.lfi`: path traversal testing
+- [ ] `api.fuzz`: parameter fuzzing + method discovery
+- [ ] `api.auth`: auth bypass, token manipulation
+- [ ] `infra.port`: TCP port scanning
+- [ ] `verification`: re-test findings, AI false-positive analysis
+
+## Phase 3 — Rich Reporting & AI Explanations
+- [ ] HTML report generator
+- [ ] JSON report generator
+- [ ] Wire AI explainer into findings
+- [ ] AI executive summary narrative
+- [ ] Remediation guidance per finding
+- [ ] PDF report via weasyprint
+
+## Phase 4 — Real-Time TUI Dashboard
+- [ ] `ScanProgressScreen` with live progress
+- [ ] `FindingsScreen` with filterable list
+- [ ] `FindingDetailScreen` with AI explanation
+- [ ] `AssetInventoryScreen`
+- [ ] Wire `ScanOrchestrator` → TUI via callback
+- [ ] `ScanHistoryScreen`
+- [ ] `ConfigScreen`
+- [ ] Replace stub `action_scan`
+
+## Phase 5 — Automation & Integration
+- [ ] Scan scheduling (`bf schedule --every 24h`)
+- [ ] Webhook notifications (Slack, Discord)
+- [ ] GitHub Issues integration
+- [ ] Email reports
+- [ ] CI/CD mode (`bf ci --exit-on-finding`)
+- [ ] Batch target scanning (`--targets-file`)
+
+## Phase 6 — AI/LLM Vulnerability Agents
+- [x] Add `TargetType.LLM`
+- [ ] `ai.prompt_injection` agent
+- [ ] `ai.sensitive_disclosure` agent
+- [ ] `ai.denial_of_service` agent
+- [ ] `ai.excessive_agency` agent
+- [ ] `ai.output_handling` agent
+- [ ] `ai.model_theft` agent
+- [ ] `ai.plugin_scan` agent
+- [ ] LLM target detection + planner rules
+
+## Phase 7 — AI-Enhanced Bug Finding
+- [ ] AI payload selection for XSS (context-aware)
+- [ ] AI DB detection + tailored SQLi payloads
+- [ ] AI path discovery for crawler
+- [ ] AI API fuzzing from OpenAPI specs
+- [ ] AI false-positive classification for secrets
+- [ ] AI finding correlation + attack chains
+
+## Phase 8 — Zero-Config Experience
+- [ ] `bf init` setup wizard
+- [ ] Auto-detect API key locations
+- [ ] Graceful degradation without AI
+- [ ] Plain-English error messages
+- [ ] Target auto-categorization (14+ types)
+
+## Phase 9 — Production Hardening
+- [ ] Parallel agent execution
+- [ ] Scan pause/resume
+- [ ] Adaptive planning (results → planner feedback loop)
+- [ ] WAF detection + evasion
+- [ ] OOB callback server
+- [ ] Finding de-duplication
+- [ ] PoC generation
+- [ ] Scan diffing (`bf diff`)