DeforaNetworks/pentext
3
0
Fork 0
Code Releases Activity

implemented advanced snippet selection for quotes/offertes, better denomination selection throughout document suite

Browse Source
This commit is contained in:
skyanth
2016-09-08 14:34:42 +02:00
parent 40db16580f
commit a213cb7a84
36 changed files with 367 additions and 4394 deletions
Download Patch File Download Diff File Expand all files Collapse all files
xml/source/contract.xml
-79
View File
@@ -1,79 +0,0 @@
<?xml version="1.0" encoding="UTF-8"?>
<contract xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xmlns:xi="http://www.w3.org/2001/XInclude"
xmlns:xlink="http://www.w3.org/1999/xlink"
xsi:noNamespaceSchemaLocation="../dtd/contract.xsd"
xml:lang="en">
<meta>
<xi:include href="snippets/company_info.xml"/>
<scope>
<contract_type>fixed_term</contract_type>
<!-- single_engagement or fixed_term -->
<engagement_description>battle the pirates</engagement_description>
<!-- [NOTE: only needed for SINGLE ENGAGEMENT type contract, value is ignored otherwise] -->
<secondpartyrole>Consultant</secondpartyrole>
<!-- what contractor will be referred to throughout the contract. Can be anything, but should probably be Consultant or Consultancy company. When in doubt, leave as is. -->
</scope>
<contractor sex="M"><!-- (M|F|O) (O for other) --> <!-- this info is used to select the correct pronoun, not for profiling :) -->
<name>Peter Pan</name>
<ctcompany>Lost Boys Inc.</ctcompany>
<!-- delete element in case of freelancer without company -->
<address>Cloud 9</address>
<postal_code>1234 XX</postal_code>
<city>Treehouse City</city>
<country>Neverland</country>
<email>peter@pan.tech</email>
<hourly_fee denomination="eur">50</hourly_fee>
<!-- (eur|gbp|usd) -->
</contractor>
<work>
<activities><!-- add/delete activity elements as necessary -->
<activity>Taunting Captain Hook</activity>
<activity>Feeding crocodiles</activity>
<activity>Flying to and fro ('to' and 'fro' to be specified at takeoff)</activity>
</activities>
<start_date>2016-08-18</start_date>
<end_date>2016-09-15</end_date>
<planning><!-- amount of work to be done between the start and end date -->
<hours>30</hours>
<!-- non-negative integer, used for planned working hours over total engagement (for SINGLE ENGAGEMENT contract) or over each period in <per> (for FIXED TIME contract) -->
<per>month</per>
<!-- (month|week) [NOTE: only used for FIXED TIME contract, value is ignored otherwise] -->
</planning>
</work>
</meta>
<section>
<title>security consulting agreement</title>
<xi:include href="snippets/contract/en/parties.xml"/>
<p>WHEREAS:</p>
<ol type="A">
<xi:include href="snippets/contract/en/wa_contractorcan.xml"/>
<xi:include href="snippets/contract/en/wa_noemploymentintention.xml"/>
</ol>
<!--Agreement section-->
<section>
<title>agree as follows</title>
<ol type="1">
<xi:include href="snippets/contract/en/ag_period.xml"/>
<xi:include href="snippets/contract/en/ag_noemployment.xml"/>
<xi:include href="snippets/contract/en/ag_companyinstructs.xml"/>
<xi:include href="snippets/contract/en/ag_ownrisk.xml"/>
<xi:include href="snippets/contract/en/ag_workinghours.xml"/>
<xi:include href="snippets/contract/en/ag_payment_fixed_term.xml"/>
<xi:include href="snippets/contract/en/ag_biggerscopewarning.xml"/>
<xi:include href="snippets/contract/en/ag_propertyrights.xml"/>
<xi:include href="snippets/contract/en/ag_retainrights.xml"/>
<xi:include href="snippets/contract/en/ag_nondisclosure.xml"/>
<xi:include href="snippets/contract/en/ag_responsibilities.xml"/>
<xi:include href="snippets/contract/en/ag_thirdparty.xml"/>
<xi:include href="snippets/contract/en/ag_liability.xml"/>
<xi:include href="snippets/contract/en/ag_provisions.xml"/>
<xi:include href="snippets/contract/en/ag_generaltermsandconditions.xml"/>
</ol>
</section>
<section>
<title>Signed in duplicate on August 18, 2016 in</title>
<generate_contract_signature_box/>
</section>
</section>
</contract>
xml/source/document.xml
-1502
View File
File diff suppressed because it is too large Load Diff
xml/source/invoice.xml
-20
View File
@@ -1,20 +0,0 @@
<?xml version="1.0" encoding="UTF-8"?>
<invoice xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xmlns:xi="http://www.w3.org/2001/XInclude"
xmlns:xlink="http://www.w3.org/1999/xlink"
xmlns:fo="http://www.w3.org/1999/XSL/Format"
xsi:noNamespaceSchemaLocation="../dtd/invoice.xsd"
date="2016-08-25"
invoice_no="00/000"
denomination="euro">
<meta>
<xi:include href="snippets/company_info.xml"/>
<xi:include href="client_info.xml"/>
</meta>
<servicesdelivered>
<service>
<description>6-day penetration test Sitting Duck</description>
<fee>100</fee>
</service>
</servicesdelivered>
</invoice>
xml/source/offerte.xml
-73
View File
@@ -1,73 +0,0 @@
<?xml version="1.0" encoding="UTF-8"?>
<offerte xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xmlns:xi="http://www.w3.org/2001/XInclude"
xmlns:xlink="http://www.w3.org/1999/xlink"
xmlns:fo="http://www.w3.org/1999/XSL/Format"
xsi:noNamespaceSchemaLocation="../dtd/offerte.xsd"
xml:lang="en"><!--document meta information; to be filled in by the offerte writer-->
<meta>
<offered_service_long>penetration testing services</offered_service_long>
<!--if there is a shorter way of saying the same thing, you can type it here (it makes for more dynamic offerte text). If not, just repeat the long name.-->
<offered_service_short>penetration test</offered_service_short>
<xi:include href="snippets/company_info.xml"/>
<targets><!--one target element per target-->
<target>dsfsd</target>
<target>adfsd</target>
</targets>
<permission_parties>
<xi:include href="client_info.xml"/>
<party>
<full_name>dafaf</full_name>
<short_name>dad</short_name>
<!-- Name of the person who will need to sign the waiver for this vendor -->
<waiver_rep>sgf</waiver_rep>
<address>fsgf</address>
<city>sgf</city>
<country>sfgsfg</country>
</party>
</permission_parties>
<pentestinfo>
<duration>6</duration>
<!--duration of pentest, in working days-->
<test_planning>TBD</test_planning>
<!--date or date range in text, e.g. May 18th until May 25th, 2015-->
<report_due>TBD</report_due>
<!--date or date range in text, e.g. May 18th until May 25th, 2015-->
<nature>time-boxed</nature>
<type>crystal-box</type>
<!--please choose one of the following: black-box, grey-box, crystal-box-->
<fee denomination="euro">100</fee>
<!--(euro|dollar)-->
</pentestinfo>
<version_history><!--needed for date on frontpage and in signature boxes; it is possible to add a new <version> after each review; in that case, make sure to update the date/time-->
<version number="auto" date="2016-08-25T10:00:00"><!--actual date-time here; you can leave the number attribute alone-->
<v_author>ROS Writer</v_author>
<!--name of the author here; for internal use only-->
<v_description>Initial draft</v_description>
<!--for internal use only-->
</version>
</version_history>
</meta>
<!--Introduction and Scope-->
<xi:include href="snippets/offerte/en/introandscope.xml"/>
<!--Project overview section-->
<xi:include href="snippets/offerte/en/projectoverview.xml"/>
<!--Prerequisites section-->
<xi:include href="snippets/offerte/en/prerequisites.xml"/>
<!--Disclaimer section-->
<xi:include href="snippets/offerte/en/disclaimer.xml"/>
<!--Methodology section-->
<xi:include href="snippets/offerte/en/methodology.xml"/>
<xi:include href="snippets/offerte/en/codeauditmethodology.xml"/>
<xi:include href="snippets/offerte/en/teamandreporting.xml"/>
<!--Planning and payment section-->
<xi:include href="snippets/offerte/en/planningandpayment.xml"/>
<!--About Us section-->
<xi:include href="snippets/offerte/en/aboutus.xml"/>
<!--Work condition section-->
<xi:include href="snippets/offerte/en/conditions.xml"/>
<!--General terms and conditions section-->
<xi:include href="snippets/offerte/en/generaltermsandconditions.xml"/>
<!--Waivers-->
<xi:include href="snippets/offerte/en/waiver.xml"/>
</offerte>
xml/source/quickscope.xml
+3 -3
View File
@@ -5,18 +5,18 @@
<!-- Today's date -->
<version date="2015-01-01"/>
<!-- YYYY-MM-DD -->
<!-- COMPANY INFO -->
<!-- CLIENT INFO -->
<xi:include href="client_info.xml"/>
<!-- SERVICE INFO -->
<meta>
<!-- Language the offer should be in (en|nl) -->
<offer_language>en</offer_language>
<!-- Offer type (pentest|basic-scan|load-test|other) -->
<!-- Offer type (pentest|basic-scan|load-test|code-audit|other) -->
<offer_type>pentest</offer_type>
<!-- Required service -->
<!-- Note: is only used when type is 'other', if offer_type is a specific type, service name will be taken from the localisation strings -->
<requested_service>penetration testing services</requested_service>
<requested_service></requested_service>
<!-- Which targets will need to be tested?
(one <target> element for each piece of software/service/server address/location...), delete/add as necessary -->
<targets>
xml/source/quickscope_sample.xml
-58
View File
@@ -1,58 +0,0 @@
<?xml version="1.0" encoding="UTF-8"?>
<quickscope xmlns:xi="http://www.w3.org/2001/XInclude"
xmlns:xml="http://www.w3.org/XML/1998/namespace">
<!-- Today's date -->
<version date="2015-01-01"/>
<!-- YYYY-MM-DD -->
<!-- COMPANY INFO -->
<xi:include href="client_info.xml"/>
<!-- SERVICE INFO -->
<meta>
<!-- Language the offer should be in (en|nl) -->
<offer_language>en</offer_language>
<!-- Offer type (pentest|basic-scan|load-test|other) -->
<offer_type>pentest</offer_type>
<!-- Required service -->
<!-- Note: is only used when type is 'other', if offer_type is a specific type, service name will be taken from the localisation strings -->
<requested_service>penetration testing services</requested_service>
<!-- Which targets will need to be tested?
(one <target> element for each piece of software/service/server address/location...), delete/add as necessary -->
<targets>
<target>dsfsd</target>
<target>adfsd</target>
</targets>
</meta>
<!-- Some information about any third parties involved with the software/service to be tested, if applicable.
If not applicable, delete the whole <third_party> element. If more parties are needed, add <third_party> elements -->
<third_party>
<full_name>dafaf</full_name>
<short_name>dad</short_name>
<!-- Name of the person who will need to sign the waiver for this vendor -->
<waiver_rep>sgf</waiver_rep>
<address>fsgf</address>
<city>sgf</city>
<country>sfgsfg</country>
</third_party>
<pentest_info>
<!-- How long would you like the test to be? (in days) -->
<days>6</days>
<!-- Service execution (Use one of the following values: time-boxed, subscription) -->
<nature>time-boxed</nature>
<!-- Testing type (Use one of the following values: crystal-box, black-box, grey-box) -->
<type>crystal-box</type>
<!-- Test planning (when would you like the test to be executed -->
<!-- Ideally something specific like 'December 7th - December 12th, 2015', but another description 'Beginning of December' is fine as well -->
<!-- do not start with a capital letter -->
<planning>TBD</planning>
<!-- Pentest report delivery date (please allow at least 1 week between the end of the pentest and the report delivery date) -->
<delivery>TBD</delivery>
<!-- Do you need/want a code audit? (possible values: yes/no), only for pentest -->
<codeaudit perform="yes"/>
<!-- rate (to be filled in by ROS ;) -->
<rate>100</rate>
</pentest_info>
</quickscope>
xml/source/snippets/localisationstrings.xml
+17 -1
View File
@@ -23,10 +23,26 @@
<translation xml:lang="nl">basis-securityscandiensten</translation>
<translation xml:lang="en">basic security scan services</translation>
</string>
<string id="coverpage_service_basic-scan">
<string id="coverpage_service_basic-scan_short">
<translation xml:lang="nl">basis-securityscan</translation>
<translation xml:lang="en">basic scan</translation>
</string>
<string id="coverpage_service_code-audit">
<translation xml:lang="nl">code-auditing-diensten</translation>
<translation xml:lang="en">code auditing services</translation>
</string>
<string id="coverpage_service_code-audit_short">
<translation xml:lang="nl">code audit</translation>
<translation xml:lang="en">code audit</translation>
</string>
<string id="coverpage_service_load-test">
<translation xml:lang="nl">loadtest-diensten</translation>
<translation xml:lang="en">load testing services</translation>
</string>
<string id="coverpage_service_load-test_short">
<translation xml:lang="nl">load test</translation>
<translation xml:lang="en">load test</translation>
</string>
<string id="coverpage_for">
<translation xml:lang="nl">VOOR</translation>
<translation xml:lang="en">FOR</translation>
xml/source/snippets/offerte/en/aboutus.xml
+1 -1
View File
@@ -24,7 +24,7 @@
intelligence agencies, or anything of the sort. If a job is even remotely
morally questionable, we simply won't do it.</li>
<li><b>Open-Source</b><br/>
Releasing ALL tools and frameworks, we build as open-source on our website.</li>
Releasing ALL tools and frameworks we build as open source.</li>
<li><b>Teach to fish</b><br/>
During engagements, we will not only share our results with your company,
but also provide a step-by-step description of how to perform the same
xml/source/snippets/offerte/en/additional-code-audit_methodology.xml
+49
View File
@@ -0,0 +1,49 @@
<?xml version="1.0" encoding="UTF-8"?>
<section>
<title>Code Audit</title>
<p>
<company_short/> will perform a code audit to aid pentesting. During a
code audit, we manually examine the code of an application to ensure there
are no security vulnerabilities and use our understanding of the code to
guide our pentesting. If vulnerabilities are found, we document those and
suggest ways to fix them. This is done by highly-trained penetration testers
who can both review the raw code as well as interpret the findings of the
automated scans, putting them into context.
</p>
<p>
During the code audit portion of penetration tests, we take the following
criteria into account:
</p>
<ol>
<li>Risk Assessment and "Threat Modeling"<br/>
In this step, we analyze the risks of a particular application or system.
Threat Modeling is a specific, structured approach to risk analysis that
enables us to identify, qualify, and address the security risks, thus
dovetailing with the Code Review process. For example, user data is
sacred. We focus on encrypted storage, discover if <client_short/> employees
have a backdoor into data, and cut loose stolen devices by wiping them
remotely and revoking accounts.
</li>
<li>Purpose and Context<br/>
Here we focus on risks, especially in the quick and easy sharing of
internal documents and itineraries. Account details aren't so secret
when we know who will be in meetings, but what's being discussed is secret.
</li>
<li>Complexity<br/>
The complexity of the system is in the frameworks that support the web
application. We'd ignore those and focus only on the custom code and
backend code. We would also
focus on implementation mistakes and known flaws in the systems. For
example, we'd ensure you're using the latest versions of software,
but we wouldn't delve into the framework itself. Since we assume the
code is written by a team, it should be clearly-written code. If you have
several full-release versions, there will undoubtedly be several revisions
and audits on that code.
</li>
</ol>
<p>
For more information, please refer to this link:
<a href="https://www.owasp.org/index.php/OWASP_Code_Review_V2_Table_of_Contents">
https://www.owasp.org/index.php/OWASP_Code_Review_V2_Table_of_Contents</a>
</p>
</section>
xml/source/snippets/offerte/en/codeauditmethodology.xml
-40
View File
@@ -1,40 +0,0 @@
<?xml version="1.0" encoding="UTF-8"?>
<section>
<title>Code Audit</title>
<p><company_short/> will perform a code audit to aid pentesting. During a
code audit, we manually examine the code of an application to ensure there
are no security vulnerabilities and use our understanding of the code to
guide our pentesting. If vulnerabilities are found, we document those and
suggest ways to fix them. This is done by highly-trained penetration testers
who can both review the raw code as well as interpret the findings of the
automated scans, putting them into context.</p>
<p>During the code audit portion of penetration tests, we take the following
criteria into account:</p>
<ol>
<li>Risk Assessment and "Threat Modeling"<br/>
In this step, we analyze the risks of a particular application or system.
Threat Modeling is a specific, structured approach to risk analysis that
enables us to identify, qualify, and address the security risks, thus
dovetailing with the Code Review process. For example, user data is
sacred. We focus on encrypted storage, discover if <client_short/> employees
have a backdoor into data, and cut loose stolen devices by wiping them
remotely and revoking accounts.</li>
<li>Purpose and Context<br/>
Here we focus on risks, especially in the quick and easy sharing of
internal documents and itineraries. Account details aren't so secret
when we know who will be in meetings, but what's being discussed is secret.</li>
<li>Complexity<br/>
The complexity of the system is in the frameworks that support the web
application. We'd ignore those and focus only on the custom code and
backend code. We would also
focus on implementation mistakes and known flaws in the systems. For
example, we'd ensure you're using the latest versions of software,
but we wouldn't delve into the framework itself. Since we assume the
code is written by a team, it should be clearly-written code. If you have
several full-release versions, there will undoubtedly be several revisions
and audits on that code.</li>
</ol>
<p>For more information, please refer to this link:
<a href="https://www.owasp.org/index.php/OWASP_Code_Review_V2_Table_of_Contents">https://www.owasp.org/index.php/OWASP_Code_Review_V2_Table_of_Contents</a></p>
</section>
xml/source/snippets/offerte/en/conditions_code-audit.xml
+27
View File
@@ -0,0 +1,27 @@
<?xml version="1.0" encoding="UTF-8"?>
<section>
<title>Terms and Conditions</title>
<p>
<company_short/> will only perform the <company_svc_short/>
if it has obtained the permission from <generate_permission_parties/>
as set out in the waiver, attached as <b>Annex 2</b>,
or provided in a separate document.
</p>
<p>
<company_short/> performs this assignment on the basis of its general
terms and conditions, which are attached to this offer as Annex 1.
<company_short/> rejects any general terms and conditions used by
<client_short/>.
</p>
<p>
In order to agree to this offer, please sign this letter in duplicate
and return it to:
</p>
<contact>
<name><company_legal_rep/></name>
<address><company_long/><br/>Overdiemerweg 28<br/>1111 PP Diemen</address>
<email>melanie@radicallyopensecurity.com</email>
</contact>
<generate_offer_signature_box/>
</section>
xml/source/snippets/offerte/en/disclaimer_code-audit.xml
+22
View File
@@ -0,0 +1,22 @@
<?xml version="1.0" encoding="UTF-8"?>
<section>
<title>Disclaimer</title>
<p>
It is important to understand the limits of <company_short/>'s services.
<company_short/> does not (and cannot) give guarantees that something is
secure. <company_short/>, instead, has an obligation to make reasonable
efforts (in Dutch: “<i>inspanningsverplichting</i>”) to perform the
agreed services.
</p>
<p>
<company_short/> and <client_short/> agree to take reasonable measures to
maintain the confidentiality of information and any personal data they gain
access to in the course of performing the code audit. Both parties will use the
information and data they receive or access only for the purposes outlined
in this agreement.
<company_short/> warrants that all core-team members, external freelancers,
and volunteers it engages to perform the code audit have signed a
non-disclosure agreement (NDA).
</p>
</section>
xml/source/snippets/offerte/en/methodology_code-audit.xml
+45
View File
@@ -0,0 +1,45 @@
<?xml version="1.0" encoding="UTF-8"?>
<section>
<title>Code Audit</title>
<p>
<company_short/> will perform a code audit. During this process we will verify if the proper
security controls are present, work as intended and are implemented correctly.
If vulnerabilities are found, we determine the threat level by assessing the
likelihood of exploitation of this vulnerability and the impact on the
Confidentiality, Integrity and Availability (CIA) of the system. We will describe how an
attacker would exploit the vulnerability and suggest ways of fixing it.<br/>
This requires an extensive knowledge of the platform the application is running on, as well
as the extensive knowledge of the language the application in written
in and patterns that have been used. Therefore a code audit done by highly-trained
specialists with a strong background in programming.
</p>
<p>
During the code audit, we take the following approach:
</p>
<ol>
<li>Thorough comprehension of functionality<br/>
We try to get a thorough comprehension of how the application works and how
it interacts with the user and other systems. Having detailed documentation
(manuals, flow charts, system sequence diagrams, design documentation) at
this stage is very helpful, as they aid the understanding of the application
</li>
<li>Static analysis<br/>
Using the understanding we gained in the previous step, we will use static code
analysis to uncover any vulnerabilities. Static analysis means the specialist will
analyze the code and implementation of security controls to get an understanding of
the security of the application, rather than running the application to reach the same
goal. This is primarily a manual process, where the specialist relies on his knowledge and expertise
to find the flaws in the application. The specialist may be aided in this process by
automatic analysis tools, but his or her skills are the driving force.<br/>
Depending on the type of application, we will identify the endpoints. In this case, it means
where data enters and leaves the application. The data is then followed through the application
and is leading in determining if assessing the quality of the security measures.
</li>
<li>Dynamic analysis<br/>
Dynamic analysis can also be performed. In this case, the program
is run and actively exploited by the specialist. This is usually done to confirm
a vulnerability and as such follows the result of the static analysis.
</li>
</ol>
</section>
xml/source/snippets/offerte/en/methodology_loadtest.xml → xml/source/snippets/offerte/en/methodology_load-test.xml
View File
xml/source/snippets/snippetselection.xml
+108 -5
View File
@@ -1,15 +1,118 @@
<?xml version="1.0" encoding="UTF-8"?>
<snippet_selection>
<!-- QUOTES -->
<!-- [NOTE: when creating a new offerte subtype, please make sure you have at least one snippet_group with @set="group1"] -->
<document type="offerte">
<selection subtype="pentest">
<snippet>introandscope</snippet>
<snippet>projectoverview</snippet>
<snippet_group set="group1">
<snippet>introandscope</snippet>
<snippet>projectoverview</snippet>
<snippet>prerequisites</snippet>
<snippet>disclaimer</snippet>
<snippet>methodology</snippet>
</snippet_group>
<snippet_group set="additionalcodeaudit">
<!-- isolated since it is subject to logic (unlike some people) -->
<snippet>additional-code-audit_methodology</snippet>
</snippet_group>
<snippet_group set="group2">
<snippet>teamandreporting</snippet>
<snippet>planningandpayment</snippet>
<snippet>aboutus</snippet>
<snippet>conditions</snippet>
<snippet>generaltermsandconditions</snippet>
<snippet>waiver</snippet>
</snippet_group>
</selection>
<selection subtype="basic-scan">
<snippet>introandscope</snippet>
<snippet>projectoverview</snippet>
<snippet_group set="group1">
<snippet>introandscope</snippet>
<snippet>projectoverview</snippet>
<snippet>prerequisites</snippet>
<snippet>disclaimer</snippet>
<snippet>methodology</snippet>
</snippet_group>
<snippet_group set="additionalcodeaudit">
<!-- isolated since it is subject to logic -->
<snippet>additional-code-audit_methodology</snippet>
</snippet_group>
<snippet_group set="group2">
<snippet>teamandreporting</snippet>
<snippet>planningandpayment</snippet>
<snippet>aboutus</snippet>
<snippet>conditions</snippet>
<snippet>generaltermsandconditions</snippet>
<snippet>waiver</snippet>
</snippet_group>
</selection>
<selection subtype="load-test">
<snippet_group set="group1">
<snippet>introandscope</snippet>
<snippet>projectoverview</snippet>
<snippet>prerequisites</snippet>
<snippet>disclaimer</snippet>
<snippet>methodology_load-test</snippet>
</snippet_group>
<snippet_group set="additionalcodeaudit">
<!-- isolated since it is subject to logic -->
<snippet>additional-code-audit_methodology</snippet>
</snippet_group>
<snippet_group set="group2">
<snippet>teamandreporting</snippet>
<snippet>planningandpayment</snippet>
<snippet>aboutus</snippet>
<snippet>conditions</snippet>
<snippet>generaltermsandconditions</snippet>
<snippet>waiver</snippet>
</snippet_group>
</selection>
<selection subtype="code-audit">
<!-- no additional code audit presumed :) -->
<snippet_group set="group1">
<snippet>introandscope</snippet>
<snippet>projectoverview</snippet>
<snippet>prerequisites</snippet>
<snippet>disclaimer_code-audit</snippet>
<snippet>methodology_code-audit</snippet>
<snippet>teamandreporting</snippet>
<snippet>planningandpayment</snippet>
<snippet>aboutus</snippet>
<snippet>conditions_code-audit</snippet>
<snippet>generaltermsandconditions</snippet>
<snippet>waiver</snippet>
</snippet_group>
</selection>
<selection subtype="other">
<!-- standard -->
<snippet_group set="group1">
<snippet>introandscope</snippet>
<snippet>projectoverview</snippet>
<snippet>prerequisites</snippet>
<snippet>disclaimer</snippet>
<snippet>methodology</snippet>
</snippet_group>
<snippet_group set="additionalcodeaudit">
<!-- isolated since it is subject to logic -->
<snippet>additional-code-audit_methodology</snippet>
</snippet_group>
<snippet_group set="group2">
<snippet>teamandreporting</snippet>
<snippet>planningandpayment</snippet>
<snippet>aboutus</snippet>
<snippet>conditions</snippet>
<snippet>generaltermsandconditions</snippet>
<snippet>waiver</snippet>
</snippet_group>
</selection>
</document>
<!-- CONTRACTS -->
<!-- [NOTE: when creating a new contract subtype, please make sure you have at least one snippet_group with @set="agree1"] -->
<document type="contract">
<selection subtype="single_engagement">
<snippet_group set="parties">
@@ -23,7 +126,7 @@
<snippet>wa_contractorcan</snippet>
<snippet>wa_noemploymentintention</snippet>
</snippet_group>
<snippet_group set="agree">
<snippet_group set="agree1">
<!-- define agreement -->
<snippet>ag_noemployment</snippet>
<snippet>ag_companyinstructs</snippet>