@@ -235,6 +235,79 @@ def counts(records: list) -> dict:
     return out
 
 
+# ------------------------------------------------------------------ scoping
+
+# What a penetration test is scoped on is the application's own pages and
+# endpoints.  Three kinds of 200 are not that: files a CDN or firewall serves
+# on every site behind it, static files the pages load, and a site that turned
+# the scanner away, where the few 200s left are the firewall's own.
+STATIC = re.compile(r"\.(js|mjs|css|map|png|jpe?g|gif|svg|ico|webp|avif|bmp|woff2?|ttf|otf|eot"
+                    r"|mp4|webm|mp3|wav|pdf|txt|json|xml|webmanifest)$", re.I)
+EDGE = [("Cloudflare", re.compile(r"^/(cdn-cgi|__cf)(/|$)", re.I)),
+        ("Imperva", re.compile(r"^/(_Incapsula_Resource|_incapsula)", re.I)),
+        ("Akamai", re.compile(r"^/(akam|_sec)/", re.I))]
+# A segment that is a value rather than a name: a number, a UUID, a long hex
+# or mixed token, or a date.  /orders/1001 and /orders/1002 are one endpoint.
+_VALUE = re.compile(r"^(\d+|[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}"
+                    r"|[0-9a-f]{12,}|(?=[A-Za-z0-9_-]*\d)[A-Za-z0-9_-]{20,}"
+                    r"|\d{4}-\d{2}-\d{2})$", re.I)
+# Most of what was asked was refused: the scan saw the firewall, not the site.
+BLOCKED_SHARE = 0.8
+BLOCKED_MIN = 10
+
+
+def edge_of(path: str) -> str:
+    """The CDN or firewall a path belongs to, or ""."""
+    return next((name for name, rule in EDGE if rule.match(path or "")), "")
+
+
+def endpoint(path: str) -> str:
+    """The path with its values written as {id}."""
+    segs = [s for s in (path or "/").split("/") if s]
+    return "/" + "/".join("{id}" if _VALUE.match(s) else s for s in segs)
+
+
+def scoping(records: list) -> dict:
+    """The numbers a penetration test is scoped on, from one scan's paths.
+
+    http_200    every path that answered HTTP 200
+    endpoints   the application's own pages and endpoints: a 200 that is a
+                real page (see classify), less CDN and firewall files and
+                static files, with values collapsed.  The site's root counts
+                when it answered 200, since a site that answers is real.
+    blocked     most answers were 401 or 403, so the count is the firewall's
+    """
+    records = records or []
+    answered = len(records)
+    http_200 = [r for r in records if r.get("s") == 200]
+    edges, refused, found = set(), 0, set()
+    for r in records:
+        name = edge_of(r.get("p", ""))
+        if name:
+            edges.add(name)
+        if r.get("s") in (401, 403):
+            refused += 1
+    for r in http_200:
+        path = r.get("p", "")
+        if edge_of(path) or STATIC.search(path):
+            continue
+        if r.get("r") is True or path == "/":
+            found.add(endpoint(path))
+    share = refused / answered if answered else 0.0
+    return {"answered": answered, "http_200": len(http_200),
+            "endpoints": sorted(found), "refused_share": round(share, 3),
+            "edge": sorted(edges),
+            "blocked": answered >= BLOCKED_MIN and share >= BLOCKED_SHARE}
+
+
+def blocked_text(scope: dict) -> str:
+    """For the CSV: empty, or yes with why."""
+    if not scope.get("blocked"):
+        return ""
+    by = ", ".join(scope.get("edge") or [])
+    return f"yes, {round(scope['refused_share'] * 100)}% refused" + (f" by {by}" if by else "")
+
+
 # ------------------------------------------------------------------ matching
 
 def _segs(path: str) -> list:
 
@@ -2058,6 +2058,29 @@ def touch_asset(db, scan: ExternalDastScan) -> None:
                             scan.recorded_by)
 
 
+def scoping_by_asset(db, asset_ids=None) -> dict:
+    """The pen test scoping numbers of each site, from its newest finished
+    scan that recorded paths, the same scan url_paths comes from.
+    -> {asset id: {"scan": scan, "scope": dast_paths.scoping(...)}}"""
+    from app.core import dast_paths
+
+    query = (db.query(ExternalDastScan.id, ExternalDastScan.asset_id)
+             .filter(ExternalDastScan.status == "done",
+                     ExternalDastScan.paths_count.isnot(None)))
+    if asset_ids is not None:
+        query = query.filter(ExternalDastScan.asset_id.in_(list(asset_ids) or [0]))
+    newest = {}
+    for scan_id, asset_id in query.order_by(ExternalDastScan.scanned_at.desc(),
+                                            ExternalDastScan.id.desc()):
+        newest.setdefault(asset_id, scan_id)
+    out = {}
+    for asset_id, scan_id in newest.items():
+        scan = db.get(ExternalDastScan, scan_id)
+        out[asset_id] = {"scan": scan, "scope": dast_paths.scoping(
+            dast_paths.load(scan.paths).get("paths") or [])}
+    return out
+
+
 def copy_newest(db, asset: ExternalAsset) -> None:
     """The newest finished scan onto the site, or nothing when there is none."""
     newest = (db.query(ExternalDastScan)
 
@@ -299,10 +299,16 @@ def export_csv(request: Request, user: User = Depends(current_user)):
                          "telemetry_at", "last_dast_at", "last_dast_severity",
                          "last_dast_server", "last_dast_url",
                          "url_paths", "url_paths_scan",
+                         "http_200_paths", "unique_endpoints", "scan_blocked",
+                         "paths_answered",
                          "repositories", "comments"]
                         + external.FIELD_KEYS)
+        # One read of each site's newest counted scan, not one per column.
+        scoped = external.scoping_by_asset(db)
+        from app.core import dast_paths as _dast_paths
         for a in db.query(ExternalAsset).order_by(ExternalAsset.host):
             values = external.field_values(a)
+            scope = (scoped.get(a.id) or {}).get("scope")
             repos = []
             for l in mapper.links(a):
                 if l["linked"]:
@@ -324,6 +330,10 @@ def export_csv(request: Request, user: User = Depends(current_user)):
                 "" if a.last_paths is None else a.last_paths,
                 (a.last_paths_at.strftime("%Y-%m-%d") + " " + (a.last_paths_profile or "")).strip()
                 if a.last_paths_at else "",
+                "" if scope is None else scope["http_200"],
+                "" if scope is None else len(scope["endpoints"]),
+                "" if scope is None else (_dast_paths.blocked_text(scope) or "no"),
+                "" if scope is None else scope["answered"],
                 " ".join(repos),
                 (a.notes or "").replace("\n", " ")] + [values.get(k, "") for k in external.FIELD_KEYS]])
     stamp = datetime.now(timezone.utc).strftime("%Y%m%d-%H%M")
@@ -1063,7 +1073,12 @@ def scan_page(asset_id: int, scan_id: int, request: Request, sev: str = "",
         context = _shared(db, user)
         if verdict == "decided":
             findings = [f for f in findings if f.get("decision")]
+        from app.core import dast_paths as _dast_paths
+
+        scope = (_dast_paths.scoping(_dast_paths.load(scan.paths).get("paths") or [])
+                 if scan.paths_count is not None else None)
         context.update(active_page="external", asset=asset, scan=scan, view=view,
+                       scope=scope, blocked_text=_dast_paths.blocked_text(scope or {}),
                        code=external.code_behind(db, user, scan, asset),
                        findings=findings, sev=sev, verdict=verdict, decided=decided,
                        decision_kinds=external_decisions.KINDS,
 
@@ -81,6 +81,18 @@
       <div class="faint">{{ cc.answered | thousands }} addresses answered.  {% for k, n in cc.by_status.items() if n %}{{ k }}: {{ n | thousands }}{{ ', ' if not loop.last }}{% endfor %}
         {% if cc.by_engine %}&middot; by engine: {% for k, n in cc.by_engine.items() %}{{ k }} {{ n | thousands }}{{ ', ' if not loop.last }}{% endfor %}{% endif %}</div>
     </div>
+    {% if scope %}
+    <div class="small" style="margin-bottom:.5rem">For penetration test scoping:
+      <strong>{{ scope.endpoints | length | thousands }}</strong> unique endpoint{{ '' if scope.endpoints | length == 1 else 's' }}
+      <span class="faint" title="Real pages that answered 200, without CDN or firewall files and static files, with numbers and ids collapsed so /orders/1001 and /orders/1002 are one">(the application's own pages, ids collapsed)</span>
+      &middot; {{ scope.http_200 | thousands }} path{{ '' if scope.http_200 == 1 else 's' }} answered HTTP 200
+      {% if blocked_text %}<div><span class="badge high">blocked</span> {{ blocked_text | capitalize }}.  The scan mostly saw the
+        firewall, so these counts are not the site's.  Let the scanner's address through, then scan again.</div>{% endif %}
+      {% if scope.endpoints %}<details style="margin-top:.3rem"><summary class="faint">The endpoints</summary>
+        <div class="mono small">{% for e in scope.endpoints[:500] %}<div>{{ e }}</div>{% endfor %}
+          {% if scope.endpoints | length > 500 %}<div class="faint">and {{ scope.endpoints | length - 500 }} more</div>{% endif %}</div></details>{% endif %}
+    </div>
+    {% endif %}
     {% endif %}
     {% if code.linked %}
     <div class="small" style="margin-bottom:.5rem">Linked code reached: