diff --git a/README.md b/README.md
index 558d4fb9c9..1f6bbc4e1f 100644
--- a/README.md
+++ b/README.md
@@ -397,6 +397,7 @@ For details, see [Configuration](https://www.blacklanternsecurity.com/bbot/Stabl
     - [Setting Up a Dev Environment](https://www.blacklanternsecurity.com/bbot/Stable/dev/dev_environment)
     - [BBOT Internal Architecture](https://www.blacklanternsecurity.com/bbot/Stable/dev/architecture)
     - [How to Write a BBOT Module](https://www.blacklanternsecurity.com/bbot/Stable/dev/module_howto)
+    - [Validating & Inspecting Presets](https://www.blacklanternsecurity.com/bbot/Stable/dev/preset_validation)
     - [Unit Tests](https://www.blacklanternsecurity.com/bbot/Stable/dev/tests)
     - [Discord Bot Example](https://www.blacklanternsecurity.com/bbot/Stable/dev/discord_bot)
     - **Code Reference**
diff --git a/bbot/cli.py b/bbot/cli.py
index f27bd48e7c..2ebe9046e3 100755
--- a/bbot/cli.py
+++ b/bbot/cli.py
@@ -102,6 +102,7 @@ async def _main():
                 preset._default_internal_modules = []
 
             # Bake a temporary copy of the preset so that flags correctly enable their associated modules before listing them
+            preset.validate()
             preset = preset.bake()
 
             # --list-modules
@@ -156,6 +157,7 @@ async def _main():
                 print(row)
             return
 
+        preset.validate()
         baked_preset = preset.bake()
 
         # --current-preset / --current-preset-full
diff --git a/bbot/core/config/files.py b/bbot/core/config/files.py
index 2be7bbaa1a..7814626f11 100644
--- a/bbot/core/config/files.py
+++ b/bbot/core/config/files.py
@@ -1,7 +1,8 @@
 import sys
+import yaml
 from pathlib import Path
-from omegaconf import OmegaConf
 
+from .merge import deep_merge
 from ...logger import log_to_stderr
 from ...errors import ConfigLoadError
 
@@ -18,24 +19,32 @@ class BBOTConfigFiles:
     def __init__(self, core):
         self.core = core
 
-    def _get_config(self, filename, name="config"):
+    def _get_config(self, filename, name="config") -> dict:
         filename = Path(filename).resolve()
+        if not filename.exists():
+            return {}
         try:
-            conf = OmegaConf.load(str(filename))
+            with open(filename) as f:
+                conf = yaml.safe_load(f) or {}
+            if not isinstance(conf, dict):
+                raise ConfigLoadError(
+                    f"Error parsing config at {filename}: expected a YAML mapping at the top level, "
+                    f"got {type(conf).__name__}"
+                )
             cli_silent = any(x in sys.argv for x in ("-s", "--silent"))
             if __name__ == "__main__" and not cli_silent:
                 log_to_stderr(f"Loaded {name} from {filename}")
             return conf
+        except ConfigLoadError:
+            raise
         except Exception as e:
-            if filename.exists():
-                raise ConfigLoadError(f"Error parsing config at {filename}:\n\n{e}")
-            return OmegaConf.create()
+            raise ConfigLoadError(f"Error parsing config at {filename}:\n\n{e}")
 
-    def get_custom_config(self):
-        return OmegaConf.merge(
+    def get_custom_config(self) -> dict:
+        return deep_merge(
             self._get_config(self.config_filename, name="config"),
             self._get_config(self.secrets_filename, name="secrets"),
         )
 
-    def get_default_config(self):
+    def get_default_config(self) -> dict:
         return self._get_config(self.defaults_filename, name="defaults")
diff --git a/bbot/core/config/merge.py b/bbot/core/config/merge.py
new file mode 100644
index 0000000000..a59964995e
--- /dev/null
+++ b/bbot/core/config/merge.py
@@ -0,0 +1,94 @@
+"""
+Deep-merge helpers replacing omegaconf's merge semantics.
+
+`deep_merge(a, b)` returns a new dict that is `a` with `b` merged in: nested
+dicts are merged recursively, leaf values (and lists) from `b` replace those in
+`a`. This matches `OmegaConf.merge(a, b)` for BBOT's preset layering use case.
+"""
+
+from __future__ import annotations
+
+from copy import deepcopy
+from typing import Any
+
+
+def deep_merge(base: dict[str, Any] | None, *updates: dict[str, Any] | None) -> dict[str, Any]:
+    """
+    Deep-merge one or more update dicts into a copy of `base`. Last wins on
+    leaf conflicts; lists are replaced wholesale (not concatenated).
+
+    The returned dict shares no mutable state with the inputs — nested dicts,
+    lists, and other mutable values are deep-copied as they're carried over.
+    """
+    result: dict[str, Any] = deepcopy(base) if base else {}
+    for update in updates:
+        if not update:
+            continue
+        for k, v in update.items():
+            if k in result and isinstance(result[k], dict) and isinstance(v, dict):
+                result[k] = deep_merge(result[k], v)
+            else:
+                result[k] = deepcopy(v)
+    return result
+
+
+def dotted_get(data: dict[str, Any], path: str, default: Any = None) -> Any:
+    """
+    Look up a dotted path in a nested dict.
+
+    Note: keys containing literal `.` are not addressable (no escape syntax).
+
+    >>> dotted_get({"a": {"b": {"c": 1}}}, "a.b.c")
+    1
+    >>> dotted_get({"a": 1}, "a.b.c", default="x")
+    'x'
+    """
+    cursor: Any = data
+    for part in path.split("."):
+        if not isinstance(cursor, dict) or part not in cursor:
+            return default
+        cursor = cursor[part]
+    return cursor
+
+
+def dotted_set(data: dict[str, Any], path: str, value: Any) -> None:
+    """
+    Set a dotted path in a nested dict, creating intermediate dicts as needed.
+
+    Non-dict intermediates are silently replaced. This is intentional —
+    callers (CLI parsing) feed the result through pydantic validation, which
+    surfaces any resulting type mismatch.
+
+    >>> d = {}
+    >>> dotted_set(d, "a.b.c", 1)
+    >>> d
+    {'a': {'b': {'c': 1}}}
+    """
+    parts = path.split(".")
+    cursor = data
+    for part in parts[:-1]:
+        if part not in cursor or not isinstance(cursor[part], dict):
+            cursor[part] = {}
+        cursor = cursor[part]
+    cursor[parts[-1]] = value
+
+
+def iter_dotted_paths(data: dict[str, Any], prefix: str = "") -> list[str]:
+    """
+    Return every dotted leaf path in a nested dict. Empty dicts are treated
+    as leaves (so they round-trip through dotted_get/dotted_set).
+
+    >>> iter_dotted_paths({"a": 1, "b": {"c": 2}})
+    ['a', 'b.c']
+    """
+    paths: list[str] = []
+    for k, v in data.items():
+        path = f"{prefix}.{k}" if prefix else k
+        if isinstance(v, dict) and v:
+            paths.extend(iter_dotted_paths(v, path))
+        else:
+            paths.append(path)
+    return paths
+
+
+__all__ = ["deep_merge", "dotted_get", "dotted_set", "iter_dotted_paths"]
diff --git a/bbot/core/config/models.py b/bbot/core/config/models.py
new file mode 100644
index 0000000000..91cb188cdc
--- /dev/null
+++ b/bbot/core/config/models.py
@@ -0,0 +1,485 @@
+"""
+Pydantic schema for BBOT's global config and preset files.
+
+These models describe the *shape* of valid BBOT configuration — field names
+and their expected types — so that `validate_preset()` can catch typos
+(`scpoe:`, `http_timoeut:`) and type errors at the boundary.
+
+Defaults live in `bbot/defaults.yml` — the single source of truth. This file
+intentionally does **not** repeat those values; every field is optional, and
+an absent field passes validation. At runtime, `BBOTConfigFiles` loads the
+merged dict straight from YAML, and these models only ever validate shape.
+"""
+
+from __future__ import annotations
+
+import os
+from typing import Annotated, Any, Literal, Optional
+
+from pydantic import BaseModel, BeforeValidator, ConfigDict, field_validator
+from pydantic import Field as _PydanticField
+from pydantic_core import PydanticUndefined
+
+from bbot.core.helpers.validators import validate_fqdn_or_ip
+
+
+STRICT = ConfigDict(extra="forbid")
+
+
+def _normalize_upper(v):
+    """Uppercase a string so severity/confidence options are case-insensitive."""
+    return v.upper() if isinstance(v, str) else v
+
+
+# Single source of truth for severity/confidence option types (used by the baddns family).
+# The BeforeValidator normalizes case at validation time so e.g. "low" validates as "LOW".
+SeverityLiteral = Annotated[Literal["INFO", "LOW", "MEDIUM", "HIGH", "CRITICAL"], BeforeValidator(_normalize_upper)]
+ConfidenceLiteral = Annotated[
+    Literal["UNKNOWN", "LOW", "MEDIUM", "HIGH", "CONFIRMED"], BeforeValidator(_normalize_upper)
+]
+
+
+def Field(default=PydanticUndefined, *, sensitive: bool = False, mandatory: bool = False, **kwargs):
+    """
+    Drop-in replacement for `pydantic.Field` that records two BBOT-specific
+    flags as field metadata:
+
+    - `sensitive=True`: value should be redacted when serializing configs
+      (api keys, passwords, http cookies, …).
+    - `mandatory=True`: option must be supplied for the module to function;
+      drives the "Needs API Key" column in `bbot -l` and the
+      `BaseModule.auth_required` property.
+
+    Both flags are stashed under `json_schema_extra` so pydantic preserves
+    them on `FieldInfo.json_schema_extra` (and in any generated JSON schema)
+    without affecting validation. All other arguments pass through unchanged.
+    """
+    extra = dict(kwargs.pop("json_schema_extra", None) or {})
+    if sensitive:
+        extra["sensitive"] = True
+    if mandatory:
+        extra["mandatory"] = True
+    if extra:
+        kwargs["json_schema_extra"] = extra
+    return _PydanticField(default, **kwargs)
+
+
+def field_flags(field) -> dict:
+    """Return the BBOT flags dict for a pydantic FieldInfo (empty if none)."""
+    extra = getattr(field, "json_schema_extra", None)
+    return dict(extra) if isinstance(extra, dict) else {}
+
+
+def is_sensitive(field) -> bool:
+    return bool(field_flags(field).get("sensitive"))
+
+
+def is_mandatory(field) -> bool:
+    return bool(field_flags(field).get("mandatory"))
+
+
+def _unwrap_optional(annotation):
+    """Strip a single `Optional[X]` / `Union[X, None]` wrapper, return X. Pass-through otherwise."""
+    import typing
+
+    origin = typing.get_origin(annotation)
+    if origin is typing.Union:
+        args = [a for a in typing.get_args(annotation) if a is not type(None)]
+        if len(args) == 1:
+            return args[0]
+    return annotation
+
+
+def _resolve_field(model, key):
+    """Resolve `key` against `model.model_fields`, honoring `Field(alias=...)`."""
+    fields = getattr(model, "model_fields", None)
+    if not fields:
+        return None
+    if key in fields:
+        return fields[key]
+    for f in fields.values():
+        if getattr(f, "alias", None) == key:
+            return f
+    return None
+
+
+def _field_submodel(field):
+    """If `field`'s annotation is a `BaseModel` subclass, return it; else None."""
+    if field is None:
+        return None
+    ann = _unwrap_optional(field.annotation)
+    if isinstance(ann, type) and issubclass(ann, BaseModel):
+        return ann
+    return None
+
+
+def _yaml_scalar(value):
+    """yaml.safe_load a raw string, but never coerce to date/time. Non-strings pass through."""
+    import datetime as _dt
+    import yaml as _yaml
+
+    if not isinstance(value, str):
+        return value
+    if value == "":
+        return ""
+    try:
+        parsed = _yaml.safe_load(value)
+    except _yaml.YAMLError:
+        return value
+    return value if isinstance(parsed, (_dt.date, _dt.time)) else parsed
+
+
+def coerce_value(value, adapter):
+    """Coerce one config value toward its declared type via a pydantic TypeAdapter.
+
+    `value` may be a raw CLI string OR an already-parsed YAML value. `adapter` is
+    the field's TypeAdapter (from the config type index), or None when the field is
+    unknown -- then fall back to YAML scalar parsing; unknown keys are still caught
+    by validation. Returns `value` unchanged if it can't be validated as the declared
+    type, so the schema pass reports the real error instead of coercion hiding it.
+    """
+    from pydantic import ValidationError
+
+    # pydantic won't coerce os.PathLike -> str, so do it up front.
+    if isinstance(value, os.PathLike):
+        value = str(value)
+
+    if adapter is None:
+        return _yaml_scalar(value) if isinstance(value, str) else value
+
+    if isinstance(value, str):
+        parsed = _yaml_scalar(value)
+        # Keep the raw string for scalar fields (lossless: "1.10", "0755", dates,
+        # bad YAML); only the parsed form can satisfy a list/dict-typed field.
+        primary = parsed if isinstance(parsed, (list, dict)) else value
+        fallback = parsed if primary is value else value
+        for candidate in (primary, fallback):
+            try:
+                return adapter.validate_python(candidate)
+            except ValidationError:
+                pass
+        return value
+
+    try:
+        return adapter.validate_python(value)
+    except ValidationError:
+        return value
+
+
+def coerce_config(config, index, prefix=""):
+    """Walk a config dict and coerce each leaf toward its declared type."""
+    out = {}
+    for k, v in config.items():
+        dotted = f"{prefix}.{k}" if prefix else k
+        if isinstance(v, dict):
+            out[k] = coerce_config(v, index, dotted)
+        else:
+            out[k] = coerce_value(v, index.get(dotted))
+    return out
+
+
+def partition_sensitive_config(config, model, *, keep_sensitive: bool):
+    """
+    Walk `config` (a dict) alongside the pydantic `model`, returning a copy
+    that either drops or extracts every `sensitive=True` field.
+
+    - `keep_sensitive=False` -> caller wants the public, non-secret view (used
+      by `BBOTCore.no_secrets_config`).
+    - `keep_sensitive=True` -> caller wants only the secrets (used by
+      `BBOTCore.secrets_only_config` to materialize `~/.config/bbot/secrets.yml`).
+
+    Unknown keys (no matching field in the schema) pass through unchanged when
+    redacting and are dropped when extracting secrets-only.
+    """
+    import copy as _copy
+
+    if not isinstance(config, dict) or model is None:
+        return _copy.deepcopy(config) if keep_sensitive is False else {}
+
+    out: dict = {}
+    for key, val in config.items():
+        field = _resolve_field(model, key)
+        sub_model = _field_submodel(field)
+
+        if sub_model is not None and isinstance(val, dict):
+            child = partition_sensitive_config(val, sub_model, keep_sensitive=keep_sensitive)
+            # When redacting, preserve the parent key even if its body was
+            # entirely sensitive — matches the prior `clean_dict` behavior.
+            # When extracting secrets-only, drop empty branches so the result
+            # is just the secrets that exist.
+            if keep_sensitive:
+                if child:
+                    out[key] = child
+            else:
+                out[key] = child
+            continue
+
+        if field is None:
+            # No matching schema field — pass through unchanged when redacting,
+            # drop when extracting secrets-only.
+            if not keep_sensitive:
+                out[key] = _copy.deepcopy(val)
+            continue
+
+        sensitive = is_sensitive(field)
+        if keep_sensitive:
+            if sensitive:
+                out[key] = _copy.deepcopy(val)
+        else:
+            if not sensitive:
+                out[key] = _copy.deepcopy(val)
+    return out
+
+
+class ScopeConfig(BaseModel):
+    model_config = STRICT
+
+    strict: Optional[bool] = None
+    report_distance: Optional[int] = None
+    search_distance: Optional[int] = None
+
+
+class DnsConfig(BaseModel):
+    model_config = STRICT
+
+    disable: Optional[bool] = None
+    minimal: Optional[bool] = None
+    threads: Optional[int] = None
+    cache_size: Optional[int] = None
+    brute_threads: Optional[int] = None
+    brute_nameservers: Optional[str] = None
+    search_distance: Optional[int] = None
+    runaway_limit: Optional[int] = None
+    timeout: Optional[int] = None
+    retries: Optional[int] = None
+    wildcard_disable: Optional[bool] = None
+    wildcard_ignore: Optional[list[str]] = None
+    wildcard_tests: Optional[int] = None
+    abort_threshold: Optional[int] = None
+    filter_ptrs: Optional[bool] = None
+    debug: Optional[bool] = None
+    omit_queries: Optional[list[str]] = None
+
+
+class BodySpillConfig(BaseModel):
+    """`web.body_spill` — keeps large HTTP_RESPONSE bodies off the Python heap."""
+
+    model_config = STRICT
+
+    enabled: Optional[bool] = None
+    cache_mb: Optional[int] = None
+    compress: Optional[bool] = None
+
+
+class WebConfig(BaseModel):
+    model_config = STRICT
+
+    http_proxy: Optional[str] = None
+    http_proxy_exclude: Optional[list[str]] = None
+    user_agent: Optional[str] = None
+    user_agent_suffix: Optional[str] = None
+    spider_distance: Optional[int] = None
+    spider_depth: Optional[int] = None
+    spider_links_per_page: Optional[int] = None
+    http_timeout: Optional[int] = None
+    blasthttp_timeout: Optional[int] = None
+    http_headers: Optional[dict[str, str]] = None
+    http_cookies: Optional[dict[str, str]] = Field(default=None, sensitive=True)
+    api_retries: Optional[int] = None
+    http_retries: Optional[int] = None
+    blasthttp_retries: Optional[int] = None
+    http_rate_limit: Optional[int] = None
+    body_spill: Optional[BodySpillConfig] = None
+    # The `429_*` keys start with a digit, so we expose them via aliases.
+    sleep_interval_429: Optional[int] = Field(default=None, alias="429_sleep_interval")
+    max_sleep_interval_429: Optional[int] = Field(default=None, alias="429_max_sleep_interval")
+    debug: Optional[bool] = None
+    http_max_redirects: Optional[int] = None
+    ssl_verify: Optional[bool] = None
+
+
+class EngineConfig(BaseModel):
+    model_config = STRICT
+
+    debug: Optional[bool] = None
+
+
+class DepsToolConfig(BaseModel):
+    """Per-tool dep config (e.g. `deps.ffuf.version`)."""
+
+    model_config = STRICT
+
+    version: Optional[str] = None
+
+
+class DepsConfig(BaseModel):
+    model_config = STRICT
+
+    behavior: Optional[Literal["abort_on_failure", "retry_failed", "ignore_failed", "disable", "force_install"]] = None
+    ffuf: Optional[DepsToolConfig] = None
+
+
+class BaseModuleConfig(BaseModel):
+    """
+    Shared base for every module's `class Config(BaseModuleConfig)`.
+
+    Declares the three universal module options that are applied to every
+    module regardless of declaration. The actual default values live in
+    `bbot/defaults.yml`; this class only validates shape.
+    """
+
+    model_config = STRICT
+
+    batch_size: Optional[int] = Field(
+        default=None,
+        description="The number of events to process in a single batch (only applies to batch modules)",
+    )
+    module_threads: Optional[int] = Field(
+        default=None,
+        description="How many event handlers to run in parallel",
+    )
+    module_timeout: Optional[int] = Field(
+        default=None,
+        description="Max time in seconds to spend handling each event or batch of events",
+    )
+
+
+class BBOTConfig(BaseModel):
+    """
+    Root BBOT config schema. Unknown top-level keys are rejected so that
+    typos like `scpoe:` or `moudules:` become loud errors instead of silent
+    no-ops.
+
+    This is a validation schema only -- it has no default values. The real
+    defaults live in `bbot/defaults.yml`.
+    """
+
+    model_config = ConfigDict(
+        extra="forbid",
+        populate_by_name=True,
+    )
+
+    # Basic options
+    home: Optional[str] = None
+    keep_scans: Optional[int] = None
+    status_frequency: Optional[int] = None
+    file_blobs: Optional[bool] = None
+    folder_blobs: Optional[bool] = None
+    max_mem_percent: Optional[int] = None
+
+    # Nested sections
+    scope: Optional[ScopeConfig] = None
+    dns: Optional[DnsConfig] = None
+    web: Optional[WebConfig] = None
+    engine: Optional[EngineConfig] = None
+    deps: Optional[DepsConfig] = None
+
+    # Module loader paths
+    module_dirs: Optional[list[str]] = None
+
+    # Module runtime
+    module_handle_event_timeout: Optional[int] = None
+    module_handle_batch_timeout: Optional[int] = None
+
+    # Internal module toggles (hardcoded because they're first-class scan
+    # pipeline features; the set changes rarely)
+    speculate: Optional[bool] = None
+    excavate: Optional[bool] = None
+    aggregate: Optional[bool] = None
+    dnsresolve: Optional[bool] = None
+    cloudcheck: Optional[bool] = None
+    unarchive: Optional[bool] = None
+
+    # URL handling
+    url_querystring_remove: Optional[bool] = None
+    url_querystring_collapse: Optional[bool] = None
+    url_extension_blacklist: Optional[list[str]] = None
+    url_extension_special: Optional[list[str]] = None
+    url_extension_static: Optional[list[str]] = None
+
+    # Parameter handling
+    parameter_blacklist: Optional[list[str]] = None
+    parameter_blacklist_prefixes: Optional[list[str]] = None
+
+    # Event output filter
+    omit_event_types: Optional[list[str]] = None
+
+    # Interactsh
+    interactsh_server: Optional[str] = None
+    interactsh_token: Optional[str] = Field(default=None, sensitive=True)
+    interactsh_disable: Optional[bool] = None
+
+    # bbot.io API key (used by the asn helper)
+    bbot_io_api_key: Optional[str] = Field(default=None, sensitive=True)
+
+    _validate_interactsh_server = field_validator("interactsh_server")(validate_fqdn_or_ip)
+
+    # Per-module configs — validated separately, per-module, against each
+    # module's own `class Config(BaseModuleConfig)`.
+    modules: Optional[dict[str, dict[str, Any]]] = None
+
+
+class PresetSchema(BaseModel):
+    """
+    Schema for the top-level keys in a preset YAML file. Catches typos like
+    `modlues:` or `flgas:` at load time.
+
+    `target`/`targets` and `include`/`presets` are aliases; both are accepted.
+    The `config` key is validated separately as `BBOTConfig`.
+    """
+
+    model_config = ConfigDict(
+        extra="forbid",
+        populate_by_name=True,
+    )
+
+    target: Optional[list[str]] = None
+    targets: Optional[list[str]] = None
+    seeds: Optional[list[str]] = None
+    blacklist: Optional[list[str]] = None
+
+    modules: Optional[list[str]] = None
+    output_modules: Optional[list[str]] = None
+    exclude_modules: Optional[list[str]] = None
+    flags: Optional[list[str]] = None
+    require_flags: Optional[list[str]] = None
+    exclude_flags: Optional[list[str]] = None
+
+    config: Optional[dict[str, Any]] = None
+    module_dirs: Optional[list[str]] = None
+
+    include: Optional[list[str]] = None
+    presets: Optional[list[str]] = None
+
+    scan_name: Optional[str] = None
+    output_dir: Optional[str] = None
+    name: Optional[str] = None
+    description: Optional[str] = None
+
+    conditions: Optional[list[str]] = None
+
+    verbose: Optional[bool] = None
+    debug: Optional[bool] = None
+    silent: Optional[bool] = None
+
+
+__all__ = [
+    "BBOTConfig",
+    "BaseModuleConfig",
+    "ConfidenceLiteral",
+    "DepsConfig",
+    "DepsToolConfig",
+    "DnsConfig",
+    "EngineConfig",
+    "Field",
+    "PresetSchema",
+    "ScopeConfig",
+    "SeverityLiteral",
+    "WebConfig",
+    "coerce_config",
+    "coerce_value",
+    "field_flags",
+    "is_mandatory",
+    "is_sensitive",
+    "partition_sensitive_config",
+]
diff --git a/bbot/core/core.py b/bbot/core/core.py
index 5814052771..feeccac0f5 100644
--- a/bbot/core/core.py
+++ b/bbot/core/core.py
@@ -1,15 +1,14 @@
 import os
 import logging
-from copy import copy
+from copy import copy, deepcopy
 from pathlib import Path
-from contextlib import suppress
-from omegaconf import OmegaConf
 
 from bbot.errors import BBOTError
+from .config.merge import deep_merge
 from .multiprocess import SHARED_INTERPRETER_STATE
 
 
-DEFAULT_CONFIG = None
+DEFAULT_CONFIG: dict | None = None
 
 
 class BBOTCore:
@@ -26,17 +25,12 @@ class BBOTCore:
     - load quickly
     """
 
-    # used for filtering out sensitive config values
-    secrets_strings = ["api_key", "username", "password", "token", "secret", "_id"]
-    # don't filter/remove entries under this key
-    secrets_exclude_keys = ["modules"]
-
     def __init__(self):
         self._logger = None
         self._files_config = None
 
-        self._config = None
-        self._custom_config = None
+        self._config: dict | None = None
+        self._custom_config: dict | None = None
 
         # bare minimum == logging
         self.logger
@@ -85,22 +79,20 @@ def scans_dir(self):
         return self.home / "scans"
 
     @property
-    def config(self):
+    def config(self) -> dict:
         """
-        .config is just .default_config + .custom_config merged together
+        .config is just .default_config + .custom_config merged together.
 
-        any new values should be added to custom_config.
+        Any new values should be added to custom_config.
         """
         if self._config is None:
-            self._config = OmegaConf.merge(self.default_config, self.custom_config)
-            # set read-only flag (change .custom_config instead)
-            OmegaConf.set_readonly(self._config, True)
+            self._config = deep_merge(self.default_config, self.custom_config)
         return self._config
 
     @property
-    def default_config(self):
+    def default_config(self) -> dict:
         """
-        The default BBOT config (from `defaults.yml`). Read-only.
+        The default BBOT config (from `defaults.yml`).
         """
         global DEFAULT_CONFIG
         if DEFAULT_CONFIG is None:
@@ -111,16 +103,14 @@ def default_config(self):
         return DEFAULT_CONFIG
 
     @default_config.setter
-    def default_config(self, value):
+    def default_config(self, value: dict):
         # we temporarily clear out the config so it can be refreshed if/when default_config changes
         global DEFAULT_CONFIG
         self._config = None
-        DEFAULT_CONFIG = value
-        # set read-only flag (change .custom_config instead)
-        OmegaConf.set_readonly(DEFAULT_CONFIG, True)
+        DEFAULT_CONFIG = dict(value) if value else {}
 
     @property
-    def custom_config(self):
+    def custom_config(self) -> dict:
         """
         Custom BBOT config (from `~/.config/bbot/bbot.yml`)
         """
@@ -131,59 +121,59 @@ def custom_config(self):
         return self._custom_config
 
     @custom_config.setter
-    def custom_config(self, value):
-        # we temporarily clear out the config so it can be refreshed if/when custom_config changes
+    def custom_config(self, value: dict):
         self._config = None
-        # ensure the modules key is always a dictionary
-        modules_entry = value.get("modules", None)
-        if modules_entry is not None and not OmegaConf.is_dict(modules_entry):
-            value["modules"] = {}
-        self._custom_config = value
+        self._custom_config = dict(value) if value else {}
 
     def no_secrets_config(self, config):
-        from .helpers.misc import clean_dict
+        """Return a copy of `config` with every `sensitive=True` field removed.
 
-        with suppress(ValueError):
-            config = OmegaConf.to_object(config)
+        Sensitivity is read from the per-field `json_schema_extra["sensitive"]`
+        flag declared on `BBOTConfig` (and each module's `class Config`).
+        Module-level redaction uses the composite schema built lazily by
+        `MODULE_LOADER.config_schema`; if a key isn't covered by any schema
+        (e.g. an unknown module), it passes through unchanged.
+        """
+        from .config.models import partition_sensitive_config
 
-        return clean_dict(
-            config,
-            *self.secrets_strings,
-            fuzzy=True,
-            exclude_keys=self.secrets_exclude_keys,
-        )
+        return partition_sensitive_config(config, self._config_schema(), keep_sensitive=False)
 
     def secrets_only_config(self, config):
-        from .helpers.misc import filter_dict
+        """Return a copy of `config` containing only `sensitive=True` fields.
+
+        Inverse of `no_secrets_config()`. Useful for splitting a merged config
+        into a public `bbot.yml` and a private `secrets.yml`.
+        """
+        from .config.models import partition_sensitive_config
 
-        with suppress(ValueError):
-            config = OmegaConf.to_object(config)
+        return partition_sensitive_config(config, self._config_schema(), keep_sensitive=True)
 
-        return filter_dict(
-            config,
-            *self.secrets_strings,
-            fuzzy=True,
-            exclude_keys=self.secrets_exclude_keys,
-        )
+    def _config_schema(self):
+        """Resolve the runtime BBOTConfig schema (with per-module configs)."""
+        try:
+            from bbot.core.modules import MODULE_LOADER
+
+            return MODULE_LOADER.config_schema
+        except Exception:
+            from .config.models import BBOTConfig
+
+            return BBOTConfig
 
     def merge_custom(self, config):
-        """
-        Merge a config into the custom config.
-        """
-        self.custom_config = OmegaConf.merge(self.custom_config, OmegaConf.create(config))
+        """Merge a config dict into the custom config."""
+        self.custom_config = deep_merge(self.custom_config, dict(config) if config else {})
 
     def merge_default(self, config):
-        """
-        Merge a config into the default config.
-        """
-        self.default_config = OmegaConf.merge(self.default_config, OmegaConf.create(config))
+        """Merge a config dict into the default config."""
+        self.default_config = deep_merge(self.default_config, dict(config) if config else {})
 
     def copy(self):
         """
         Return a semi-shallow copy of self. (`custom_config` is copied, but `default_config` stays the same)
         """
         core_copy = copy(self)
-        core_copy._custom_config = self._custom_config.copy()
+        core_copy._custom_config = deepcopy(self._custom_config) if self._custom_config else {}
+        core_copy._config = None
         return core_copy
 
     @property
diff --git a/bbot/core/helpers/misc.py b/bbot/core/helpers/misc.py
index da34e051fc..8ae4238ce7 100644
--- a/bbot/core/helpers/misc.py
+++ b/bbot/core/helpers/misc.py
@@ -2818,36 +2818,23 @@ def truncate_filename(file_path, max_length=255):
 
 
 def get_keys_in_dot_syntax(config):
-    """Retrieve all keys in an OmegaConf configuration in dot notation.
-
-    This function converts an OmegaConf configuration into a list of keys
-    represented in dot notation.
+    """Retrieve all leaf keys in a nested dict in dot notation.
 
     Args:
-        config (DictConfig): The OmegaConf configuration object.
+        config (dict): A nested dict.
 
     Returns:
-        List[str]: A list of keys in dot notation.
+        List[str]: A list of leaf keys in dot notation.
 
     Examples:
-        >>> config = OmegaConf.create({
-        ...     "web": {
-        ...         "test": True
-        ...     },
-        ...     "db": {
-        ...         "host": "localhost",
-        ...         "port": 5432
-        ...     }
-        ... })
-        >>> get_keys_in_dot_syntax(config)
+        >>> get_keys_in_dot_syntax({"web": {"test": True}, "db": {"host": "localhost", "port": 5432}})
         ['web.test', 'db.host', 'db.port']
     """
-    from omegaconf import OmegaConf
-
-    container = OmegaConf.to_container(config, resolve=True)
     keys = []
 
     def recursive_keys(d, parent_key=""):
+        if not isinstance(d, dict):
+            return
         for k, v in d.items():
             full_key = f"{parent_key}.{k}" if parent_key else k
             if isinstance(v, dict):
@@ -2855,7 +2842,7 @@ def recursive_keys(d, parent_key=""):
             else:
                 keys.append(full_key)
 
-    recursive_keys(container)
+    recursive_keys(config)
     return keys
 
 
diff --git a/bbot/core/helpers/names_generator.py b/bbot/core/helpers/names_generator.py
index 31501aec72..13d43c007b 100644
--- a/bbot/core/helpers/names_generator.py
+++ b/bbot/core/helpers/names_generator.py
@@ -237,6 +237,7 @@
     "rapid_unscheduled",
     "raving",
     "reckless",
+    "recursive",
     "reductive",
     "ripped",
     "ruthless",
@@ -720,6 +721,7 @@
     "theoden",
     "theon",
     "theresa",
+    "thetechromancer",
     "thomas",
     "tiffany",
     "timothy",
diff --git a/bbot/core/helpers/validators.py b/bbot/core/helpers/validators.py
index 27c8bd0fea..577f124756 100644
--- a/bbot/core/helpers/validators.py
+++ b/bbot/core/helpers/validators.py
@@ -7,7 +7,7 @@
 from bbot.core.helpers import regexes
 from bbot.errors import ValidationError
 from bbot.core.helpers.url import parse_url, hash_url
-from bbot.core.helpers.misc import smart_encode_punycode, split_host_port, make_netloc, is_ip
+from bbot.core.helpers.misc import smart_encode_punycode, split_host_port, make_netloc, is_dns_name, is_ip
 
 log = logging.getLogger("bbot.core.helpers.validators")
 
@@ -129,6 +129,38 @@ def validate_host(host: Union[str, ipaddress.IPv4Address, ipaddress.IPv6Address]
     raise ValidationError(f'Invalid hostname: "{host}"')
 
 
+def validate_fqdn_or_ip(host):
+    """Strict FQDN-or-IP check. Accepts an IPv4/IPv6 address or a hostname
+    containing at least one dot. Rejects single-label values (e.g.
+    `localhost`, or a domain typed without its TLD), so domain-shaped
+    config fields fail at preset-load time instead of surfacing as runtime
+    errors deep in a scan.
+
+    `None` and the empty string pass through to support optional config
+    fields with `null` defaults.
+
+    Unlike `validate_host`, this function does not normalize the input
+    (no port-stripping, lowercasing, or punycode conversion); it returns
+    the value as supplied. Use it as a pydantic `field_validator` on
+    schema fields that must be an FQDN or IP and nothing else.
+
+    Examples:
+        >>> validate_fqdn_or_ip("example.com")
+        'example.com'
+        >>> validate_fqdn_or_ip("192.168.1.1")
+        '192.168.1.1'
+        >>> validate_fqdn_or_ip("localhost")
+        ValueError: not a valid FQDN or IP address: 'localhost'
+    """
+    if host is None or host == "":
+        return host
+    if is_ip(host):
+        return host
+    if isinstance(host, str) and "." in host and is_dns_name(host):
+        return host
+    raise ValueError(f"not a valid FQDN or IP address: {host!r}")
+
+
 FINDING_SEVERITY_LEVELS = ("INFO", "LOW", "MEDIUM", "HIGH", "CRITICAL")
 
 
diff --git a/bbot/core/modules.py b/bbot/core/modules.py
index f89f114fe7..f0ec78aa04 100644
--- a/bbot/core/modules.py
+++ b/bbot/core/modules.py
@@ -1,15 +1,14 @@
 import re
 import ast
 import sys
+import yaml
 import atexit
 import pickle
 import logging
 import importlib
-import omegaconf
 import traceback
 from copy import copy
 from pathlib import Path
-from omegaconf import OmegaConf
 from contextlib import suppress
 
 from bbot.core import CORE
@@ -34,6 +33,229 @@
 bbot_code_dir = Path(__file__).parent.parent
 
 
+# Bump when the preloader's output schema or validation rules change. Folded
+# into the per-module cache_key so stale entries from older bbot versions get
+# rebuilt instead of silently bypassing new checks.
+PRELOAD_CACHE_VERSION = 3
+
+
+_UNEVALUATED = object()
+
+
+def _eval_ast_default(node):
+    """
+    Extract a literal default value from an AST node. Returns _UNEVALUATED if
+    the node can't be resolved statically (e.g. `default_factory=lambda: ...`
+    or a non-constant expression). Preload uses this for display-time defaults
+    only; actual validation happens at bake time against the real pydantic
+    Config class.
+    """
+    if node is None:
+        return _UNEVALUATED
+    try:
+        return ast.literal_eval(node)
+    except (ValueError, TypeError, SyntaxError):
+        # Recognize a few common default_factory values.
+        if isinstance(node, ast.Name):
+            return {"list": [], "dict": {}, "set": set(), "tuple": (), "str": "", "int": 0, "float": 0.0}.get(
+                node.id, _UNEVALUATED
+            )
+        return _UNEVALUATED
+
+
+def _exec_config_class(source: str, module_name: str):
+    """
+    Execute a `class Config(BaseModuleConfig):` snippet in a controlled
+    namespace and return the resulting class. The namespace provides exactly
+    what a Config block is allowed to reference: the typing primitives,
+    pydantic's `Field` factory and validator decorators, and `BaseModuleConfig`.
+
+    This replaces parsing annotations as strings: pydantic handles every
+    valid type expression (`Optional[str]`, `Literal["a", "b"]`,
+    `list[Union[int, str]]`, …) without any hand-rolled resolver.
+    """
+    from typing import Annotated, Any, Dict, List, Literal, Optional, Set, Tuple, Union
+    from pydantic import AfterValidator, BeforeValidator, field_validator, model_validator
+    from bbot.core.config.models import BaseModuleConfig, ConfidenceLiteral, Field, SeverityLiteral
+
+    namespace: dict = {
+        "Annotated": Annotated,
+        "Any": Any,
+        "Dict": Dict,
+        "List": List,
+        "Literal": Literal,
+        "Optional": Optional,
+        "Set": Set,
+        "Tuple": Tuple,
+        "Union": Union,
+        "Field": Field,
+        "field_validator": field_validator,
+        "model_validator": model_validator,
+        "BeforeValidator": BeforeValidator,
+        "AfterValidator": AfterValidator,
+        "BaseModuleConfig": BaseModuleConfig,
+        "SeverityLiteral": SeverityLiteral,
+        "ConfidenceLiteral": ConfidenceLiteral,
+    }
+    try:
+        exec(source, namespace)
+    except Exception as e:
+        raise BBOTError(
+            f'module "{module_name}" has an invalid Config class ({type(e).__name__}: {e}). '
+            "Config blocks may only reference: Optional, Union, Literal, Any, List, Dict, Tuple, Set, "
+            "Field, field_validator, model_validator, BeforeValidator, AfterValidator, BaseModuleConfig, "
+            "and Python builtins."
+        ) from e
+    cfg = namespace.get("Config")
+    if cfg is None:
+        raise BBOTError(f'module "{module_name}": Config snippet did not define a class named "Config"')
+    return cfg
+
+
+def _build_validation_schema(preloaded: dict):
+    """
+    Build the composite preset validation schema.
+
+    Structure:
+        FullPresetSchema
+          ├── (all PresetSchema fields — target, modules, flags, …)
+          └── config: FullBBOTConfig
+                      ├── (all BBOTConfig fields — scope, dns, web, …)
+                      └── modules: ModulesSchema
+                                   ├── nuclei:  NucleiModuleConfig
+                                   ├── httpx:   HttpxModuleConfig
+                                   ├── sslcert: SslcertModuleConfig
+                                   └── … one field per known module
+
+    A single `FullPresetSchema.model_validate(preset_dict)` call then catches
+    every class of error in one pass:
+      - top-level preset typos (extra='forbid' on PresetSchema)
+      - global config typos / wrong types (extra='forbid' on BBOTConfig)
+      - unknown module names (extra='forbid' on ModulesSchema)
+      - wrong module option names / wrong types (extra='forbid' per module)
+    """
+    import warnings
+    from typing import Optional
+    from pydantic import ConfigDict, Field, create_model
+    from bbot.core.config.models import BaseModuleConfig, BBOTConfig, PresetSchema
+
+    module_fields = {}
+    for name, data in preloaded.items():
+        source = data.get("config_source")
+        if not source:
+            # Module declares no Config — only the universal options apply.
+            field_type = BaseModuleConfig
+        else:
+            try:
+                field_type = _exec_config_class(source, name)
+            except BBOTError as e:
+                # The Config references a name not available in the isolated exec
+                # namespace (a module-level constant, imported type, Enum, …); it's
+                # valid at real import time. Don't reject the module — accept any
+                # config for it (its own options just aren't strictly validated here).
+                log.debug(f"{e} -- accepting any config for module '{name}'")
+                field_type = dict
+        module_fields[name] = (Optional[field_type], Field(default=None))
+
+    # Some module names (e.g. `json`) shadow BaseModel's deprecated method
+    # names and trigger a UserWarning. The field still validates correctly;
+    # silence the noise.
+    with warnings.catch_warnings():
+        warnings.filterwarnings(
+            "ignore",
+            message=r'Field name ".+" in ".+" shadows an attribute in parent "BaseModel"',
+            category=UserWarning,
+        )
+        ModulesSchema = create_model(
+            "ModulesSchema",
+            __config__=ConfigDict(extra="forbid"),
+            **module_fields,
+        )
+        FullBBOTConfig = create_model(
+            "FullBBOTConfig",
+            __base__=BBOTConfig,
+            modules=(Optional[ModulesSchema], Field(default=None)),
+        )
+        FullPresetSchema = create_model(
+            "FullPresetSchema",
+            __base__=PresetSchema,
+            config=(Optional[FullBBOTConfig], Field(default=None)),
+        )
+    return FullPresetSchema
+
+
+def _extract_pydantic_config(config_class: ast.ClassDef) -> tuple[dict, dict, set, set, dict]:
+    """
+    Walk a `class Config(BaseModuleConfig):` block and extract
+    `(defaults, descriptions, sensitive, mandatory, types)` -- cheap metadata
+    used for `bbot -l`, type-directed config coercion, and similar listing
+    paths, without importing or exec-ing anything.
+
+    `types` maps each field name to its raw annotation string (e.g.
+    `"bool"`, `"Union[str, list[str]]"`, `"Literal['manual', 'severe']"`).
+    The actual typed pydantic class is built later via `_exec_config_class`
+    on the captured source text.
+    """
+    defaults: dict = {}
+    descriptions: dict = {}
+    sensitive: set = set()
+    mandatory: set = set()
+    types: dict = {}
+    for node in config_class.body:
+        # `model_config = ConfigDict(...)` etc. are plain assigns, not typed -- skip.
+        if not isinstance(node, ast.AnnAssign) or not isinstance(node.target, ast.Name):
+            continue
+        name = node.target.id
+        if name.startswith("_"):
+            continue
+
+        types[name] = ast.unparse(node.annotation)
+        default = _UNEVALUATED
+        description = ""
+        is_sensitive = False
+        is_mandatory = False
+
+        value = node.value
+        if isinstance(value, ast.Call) and isinstance(value.func, ast.Name) and value.func.id == "Field":
+            # Field(default, description="...", default_factory=..., sensitive=..., mandatory=..., ...)
+            # - first positional arg is the default, if given
+            if value.args:
+                default = _eval_ast_default(value.args[0])
+            for kw in value.keywords:
+                if kw.arg == "default":
+                    default = _eval_ast_default(kw.value)
+                elif kw.arg == "default_factory":
+                    default = _eval_ast_default(kw.value)
+                elif kw.arg == "description":
+                    with suppress(ValueError, TypeError, SyntaxError):
+                        description = ast.literal_eval(kw.value)
+                elif kw.arg == "sensitive":
+                    with suppress(ValueError, TypeError, SyntaxError):
+                        is_sensitive = bool(ast.literal_eval(kw.value))
+                elif kw.arg == "mandatory":
+                    with suppress(ValueError, TypeError, SyntaxError):
+                        is_mandatory = bool(ast.literal_eval(kw.value))
+                elif kw.arg == "json_schema_extra":
+                    with suppress(ValueError, TypeError, SyntaxError):
+                        extra = ast.literal_eval(kw.value)
+                        if isinstance(extra, dict):
+                            is_sensitive = is_sensitive or bool(extra.get("sensitive"))
+                            is_mandatory = is_mandatory or bool(extra.get("mandatory"))
+        elif value is not None:
+            default = _eval_ast_default(value)
+
+        if default is _UNEVALUATED:
+            # couldn't statically determine; fall back to None so listing still works
+            default = None
+        defaults[name] = default
+        descriptions[name] = description
+        if is_sensitive:
+            sensitive.add(name)
+        if is_mandatory:
+            mandatory.add(name)
+    return defaults, descriptions, sensitive, mandatory, types
+
+
 class ModuleLoader:
     """
     Main class responsible for preloading BBOT modules.
@@ -64,6 +286,10 @@ def __init__(self):
         self.internal_module_choices = set()
 
         self._preload_cache = None
+        # Composite preset-validation schema, built from preloaded modules.
+        # Invalidated whenever a new module is preloaded.
+        self._validation_schema = None
+        self._config_type_index = None
 
         self._module_dirs = set()
         self._module_dirs_preloaded = set()
@@ -145,7 +371,7 @@ def preload(self, module_dirs=None):
                 module_file = module_file.resolve()
 
                 # try to load from cache
-                module_cache_key = (str(module_file), tuple(module_file.stat()))
+                module_cache_key = (PRELOAD_CACHE_VERSION, str(module_file), tuple(module_file.stat()))
                 preloaded = self.preload_cache.get(module_name, {})
                 cache_key = preloaded.get("cache_key", ())
                 if preloaded and module_cache_key == cache_key:
@@ -178,6 +404,12 @@ def preload(self, module_dirs=None):
                         preloaded["namespace"] = namespace
                         preloaded["cache_key"] = module_cache_key
 
+                    except BBOTError as e:
+                        # Intentional, user-facing errors raised from preload_module
+                        # (e.g. the pre-3.0 options-dict migration message). Skip the
+                        # traceback so the message reads cleanly.
+                        log_to_stderr(str(e), level="CRITICAL")
+                        sys.exit(1)
                     except Exception:
                         log_to_stderr(f"Error preloading {module_file}\n\n{traceback.format_exc()}", level="CRITICAL")
                         log_to_stderr(f"Error in {module_file.name}", level="CRITICAL")
@@ -196,18 +428,18 @@ def preload(self, module_dirs=None):
                 self.flag_choices.update(set(flags))
 
                 self.__preloaded[module_name] = preloaded
-                config = OmegaConf.create(preloaded.get("config", {}))
-                self._configs[module_name] = config
+                self._configs[module_name] = dict(preloaded.get("config", {}))
 
             self._module_dirs_preloaded.add(module_dir)
 
         # update default config with module defaults
-        module_config = omegaconf.OmegaConf.create(
-            {
-                "modules": self.configs(),
-            }
-        )
-        self.core.merge_default(module_config)
+        self.core.merge_default({"modules": self.configs()})
+
+        # invalidate the composite validation schema; it'll rebuild lazily
+        # on next access now that the set of modules has changed
+        if new_modules:
+            self._validation_schema = None
+            self._config_type_index = None
 
         return new_modules
 
@@ -254,12 +486,94 @@ def preloaded(self, type=None):
         return preloaded
 
     def configs(self, type=None):
-        configs = {}
         if type is not None:
-            configs = {k: v for k, v in self._configs.items() if self.check_type(k, type)}
-        else:
-            configs = dict(self._configs)
-        return OmegaConf.create(configs)
+            return {k: dict(v) for k, v in self._configs.items() if self.check_type(k, type)}
+        return {k: dict(v) for k, v in self._configs.items()}
+
+    @property
+    def validation_schema(self):
+        """
+        The composite pydantic schema for validating a full preset dict.
+
+        Built lazily from preloaded module metadata and cached. Rebuilt when
+        `preload()` discovers new modules (e.g. after `add_module_dir`).
+        """
+        if self._validation_schema is None:
+            self._validation_schema = _build_validation_schema(self._preloaded)
+        return self._validation_schema
+
+    @property
+    def config_schema(self):
+        """
+        The runtime `BBOTConfig` schema with per-module configs grafted in.
+
+        This is `validation_schema.config` (i.e. `FullBBOTConfig`) and is the
+        right model to walk a config dict against — used by
+        `BBOTCore.no_secrets_config()` and `BBOTCore.secrets_only_config()` to
+        partition sensitive fields.
+        """
+        from bbot.core.config.models import _unwrap_optional
+
+        field = self.validation_schema.model_fields.get("config")
+        if field is None:
+            from bbot.core.config.models import BBOTConfig
+
+            return BBOTConfig
+        return _unwrap_optional(field.annotation)
+
+    @property
+    def config_type_index(self):
+        """{dotted_config_path: TypeAdapter} for every known config option.
+
+        Built by walking the materialized config schema (`config_schema`, i.e.
+        global config + every module's exec'd Config), so a single pydantic
+        TypeAdapter per leaf field drives coercion -- no hand-rolled type-name
+        parsing. Adapters are memoized by annotation (many fields share e.g.
+        `Optional[str]`). Nested models are recursed into via `_field_submodel`,
+        so `modules.<name>.<option>` keys fall out of the same walk.
+        """
+        if self._config_type_index is None:
+            from pydantic import ConfigDict, TypeAdapter
+            from bbot.core.config.models import _field_submodel
+
+            # coerce_numbers_to_str lets a numeric YAML value (e.g. password: 12345678)
+            # validate against a str field; pydantic is otherwise lax-but-not-that-lax.
+            adapter_config = ConfigDict(coerce_numbers_to_str=True)
+            adapter_cache = {}
+
+            def make_adapter(annotation):
+                try:
+                    if annotation in adapter_cache:
+                        return adapter_cache[annotation]
+                    hashable = True
+                except TypeError:
+                    hashable = False
+                try:
+                    adapter = TypeAdapter(annotation, config=adapter_config)
+                except Exception as e:
+                    log.debug(f"config_type_index: no TypeAdapter for {annotation!r}: {e}")
+                    adapter = None
+                if hashable:
+                    adapter_cache[annotation] = adapter
+                return adapter
+
+            index = {}
+
+            def walk(model, prefix=""):
+                for fname, field in model.model_fields.items():
+                    sub = _field_submodel(field)
+                    for key in {fname, getattr(field, "alias", None)} - {None}:
+                        dotted = f"{prefix}.{key}" if prefix else key
+                        if sub is not None:
+                            walk(sub, dotted)
+                        else:
+                            adapter = make_adapter(field.annotation)
+                            if adapter is not None:
+                                index[dotted] = adapter
+
+            walk(self.config_schema)
+            self._config_type_index = index
+        return self._config_type_index
 
     def find_and_replace(self, **kwargs):
         self.__preloaded = search_format_dict(self.__preloaded, **kwargs)
@@ -329,6 +643,12 @@ def preload_module(self, module_file):
         ansible_tasks = []
         config = {}
         options_desc = {}
+        options_sensitive: set = set()
+        options_mandatory: set = set()
+        options_types: dict = {}
+        config_source: str | None = None
+        legacy_options_keyword: str | None = None
+        legacy_options_line: int | None = None
         disable_auto_module_deps = False
         with open(module_file) as f:
             python_code = f.read()
@@ -355,19 +675,46 @@ def preload_module(self, module_file):
             # look for classes
             if type(root_element) == ast.ClassDef:
                 for class_attr in root_element.body:
+                    # nested `class Config(BaseModuleConfig): ...` — the module's config schema
+                    if type(class_attr) == ast.ClassDef and class_attr.name == "Config":
+                        config_fields, config_descs, config_sens, config_mand, config_types = _extract_pydantic_config(
+                            class_attr
+                        )
+                        config.update(config_fields)
+                        options_desc.update(config_descs)
+                        options_sensitive.update(config_sens)
+                        options_mandatory.update(config_mand)
+                        options_types.update(config_types)
+                        # capture the class source verbatim; schema build re-execs it
+                        config_source = ast.get_source_segment(python_code, class_attr)
+                        continue
+
+                    # annotated legacy form (`options: dict = {...}` -> ast.AnnAssign) must
+                    # also be caught, otherwise it slips the 3.0 legacy-options rejection below
+                    if (
+                        legacy_options_keyword is None
+                        and isinstance(class_attr, ast.AnnAssign)
+                        and isinstance(class_attr.target, ast.Name)
+                        and class_attr.target.id in ("options", "options_desc")
+                    ):
+                        legacy_options_keyword = class_attr.target.id
+                        legacy_options_line = class_attr.lineno
+
                     if not type(class_attr) == ast.Assign:
                         continue
 
-                    # class attributes that are dictionaries
+                    # legacy options/options_desc dict: record so we can fail
+                    # with a migration hint after the walk completes
+                    if legacy_options_keyword is None:
+                        for target in class_attr.targets:
+                            if isinstance(target, ast.Name) and target.id in ("options", "options_desc"):
+                                legacy_options_keyword = target.id
+                                legacy_options_line = class_attr.lineno
+                                break
+
+                    # module metadata
                     if type(class_attr.value) == ast.Dict:
-                        # module options
-                        if any(target.id == "options" for target in class_attr.targets):
-                            config.update(ast.literal_eval(class_attr.value))
-                        # module options
-                        elif any(target.id == "options_desc" for target in class_attr.targets):
-                            options_desc.update(ast.literal_eval(class_attr.value))
-                        # module metadata
-                        elif any(target.id == "meta" for target in class_attr.targets):
+                        if any(target.id == "meta" for target in class_attr.targets):
                             meta = ast.literal_eval(class_attr.value)
 
                     # class attributes that are lists
@@ -426,6 +773,25 @@ def preload_module(self, module_file):
                             if type(class_attr.value.value) == bool:
                                 disable_auto_module_deps = class_attr.value.value
 
+        # Reject the pre-3.0 options/options_desc dict format. Those dicts are
+        # silently ignored by the new loader: defaults disappear and setting
+        # them via -c or YAML emits misleading "did you mean ...?" suggestions
+        # pointing at unrelated modules.
+        module_name = module_file.stem
+        if legacy_options_keyword is not None and config_source is None:
+            raise BBOTError(
+                f'Module "{module_name}" ({module_file}:{legacy_options_line}) declares a legacy '
+                f"`{legacy_options_keyword}` dict, which is no longer supported in BBOT 3.0+.\n\n"
+                f"Replace the `options` / `options_desc` dicts with a nested\n"
+                f"`class Config(BaseModuleConfig)` schema. For example:\n\n"
+                f"    from bbot.core.config.models import BaseModuleConfig, Field\n\n"
+                f"    class {module_name}(BaseModule):\n"
+                f"        ...\n"
+                f"        class Config(BaseModuleConfig):\n"
+                f'            api_key: str = Field("", description="API key", sensitive=True)\n'
+                f'            max_results: int = Field(100, description="Max results to return")\n'
+            )
+
         for task in ansible_tasks:
             if "become" not in task:
                 task["become"] = False
@@ -441,6 +807,10 @@ def preload_module(self, module_file):
             "meta": meta,
             "config": config,
             "options_desc": options_desc,
+            "options_sensitive": sorted(options_sensitive),
+            "options_mandatory": sorted(options_mandatory),
+            "options_types": options_types,
+            "config_source": config_source,
             "hash": module_hash,
             "deps": {
                 "modules": sorted(deps_modules),
@@ -575,9 +945,8 @@ def modules_table(self, modules=None, mod_type=None, include_author=False, inclu
             consumed_events = sorted(preloaded.get("watched_events", []))
             produced_events = sorted(preloaded.get("produced_events", []))
             flags = sorted(preloaded.get("flags", []))
-            api_key_required = ""
             meta = preloaded.get("meta", {})
-            api_key_required = "Yes" if meta.get("auth_required", False) else "No"
+            api_key_required = "Yes" if preloaded.get("options_mandatory") else "No"
             description = meta.get("description", "")
             row = [
                 module_name,
@@ -606,9 +975,10 @@ def modules_options(self, modules=None, mod_type=None):
             modules_options[module_name] = []
             module_options = preloaded["config"]
             module_options_desc = preloaded["options_desc"]
+            module_options_types = preloaded.get("options_types", {})
             for k, v in sorted(module_options.items(), key=lambda x: x[0]):
                 option_name = f"modules.{module_name}.{k}"
-                option_type = type(v).__name__
+                option_type = module_options_types.get(k, type(v).__name__)
                 option_description = module_options_desc[k]
                 modules_options[module_name].append((option_name, option_type, option_description, str(v)))
         return modules_options
@@ -692,25 +1062,25 @@ def ensure_config_files(self):
             + "# Please be sure to uncomment when inserting API keys, etc.\n"
         )
 
-        config_obj = OmegaConf.to_object(self.core.default_config)
+        config_obj = dict(self.core.default_config)
 
         # ensure bbot.yml
         if not files.config_filename.exists():
             log_to_stderr(f"Creating BBOT config at {files.config_filename}")
             no_secrets_config = self.core.no_secrets_config(config_obj)
-            yaml = OmegaConf.to_yaml(no_secrets_config)
-            yaml = comment_notice + "\n".join(f"# {line}" for line in yaml.splitlines())
+            yaml_str = yaml.dump(no_secrets_config, sort_keys=False)
+            yaml_str = comment_notice + "\n".join(f"# {line}" for line in yaml_str.splitlines())
             with open(str(files.config_filename), "w") as f:
-                f.write(yaml)
+                f.write(yaml_str)
 
         # ensure secrets.yml
         if not files.secrets_filename.exists():
             log_to_stderr(f"Creating BBOT secrets at {files.secrets_filename}")
             secrets_only_config = self.core.secrets_only_config(config_obj)
-            yaml = OmegaConf.to_yaml(secrets_only_config)
-            yaml = comment_notice + "\n".join(f"# {line}" for line in yaml.splitlines())
+            yaml_str = yaml.dump(secrets_only_config, sort_keys=False)
+            yaml_str = comment_notice + "\n".join(f"# {line}" for line in yaml_str.splitlines())
             with open(str(files.secrets_filename), "w") as f:
-                f.write(yaml)
+                f.write(yaml_str)
             files.secrets_filename.chmod(0o600)
 
 
diff --git a/bbot/modules/anubisdb.py b/bbot/modules/anubisdb.py
index ae1ceb02fc..c69e976596 100644
--- a/bbot/modules/anubisdb.py
+++ b/bbot/modules/anubisdb.py
@@ -1,4 +1,5 @@
 from bbot.modules.templates.subdomain_enum import subdomain_enum
+from bbot.core.config.models import BaseModuleConfig, Field
 
 
 class anubisdb(subdomain_enum):
@@ -10,10 +11,12 @@ class anubisdb(subdomain_enum):
         "created_date": "2022-10-04",
         "author": "@TheTechromancer",
     }
-    options = {"limit": 1000}
-    options_desc = {
-        "limit": "Limit the number of subdomains returned per query (increasing this may slow the scan due to garbage results from this API)"
-    }
+
+    class Config(BaseModuleConfig):
+        limit: int = Field(
+            1000,
+            description="Limit the number of subdomains returned per query (increasing this may slow the scan due to garbage results from this API)",
+        )
 
     base_url = "https://anubisdb.com/anubis/subdomains"
     dns_abort_depth = 5
diff --git a/bbot/modules/apkpure.py b/bbot/modules/apkpure.py
index 8364a918e1..41fbda3da3 100644
--- a/bbot/modules/apkpure.py
+++ b/bbot/modules/apkpure.py
@@ -1,6 +1,7 @@
 import re
 from pathlib import Path
 from bbot.modules.base import BaseModule
+from bbot.core.config.models import BaseModuleConfig, Field
 
 
 class apkpure(BaseModule):
@@ -12,10 +13,12 @@ class apkpure(BaseModule):
         "created_date": "2024-10-11",
         "author": "@domwhewell-sage",
     }
-    options = {"output_folder": ""}
-    options_desc = {
-        "output_folder": "Folder to download APKs to. If not specified, downloaded APKs will be deleted when the scan completes, to minimize disk usage."
-    }
+
+    class Config(BaseModuleConfig):
+        output_folder: str = Field(
+            "",
+            description="Folder to download APKs to. If not specified, downloaded APKs will be deleted when the scan completes, to minimize disk usage.",
+        )
 
     async def setup(self):
         output_folder = self.config.get("output_folder", "")
diff --git a/bbot/modules/baddns.py b/bbot/modules/baddns.py
index 4a8e3c27c8..fc643dc74a 100644
--- a/bbot/modules/baddns.py
+++ b/bbot/modules/baddns.py
@@ -3,6 +3,8 @@
 from .base import BaseModule
 
 import logging
+from pydantic import Field
+from bbot.core.config.models import BaseModuleConfig, SeverityLiteral, ConfidenceLiteral
 
 SEVERITY_LEVELS = ("INFO", "LOW", "MEDIUM", "HIGH", "CRITICAL")
 CONFIDENCE_LEVELS = ("UNKNOWN", "LOW", "MEDIUM", "HIGH", "CONFIRMED")
@@ -45,13 +47,18 @@ class baddns(BaseModule):
         "created_date": "2024-01-18",
         "author": "@liquidsec",
     }
-    options = {"custom_nameservers": [], "min_severity": "LOW", "min_confidence": "MEDIUM", "enabled_submodules": []}
-    options_desc = {
-        "custom_nameservers": "Force BadDNS to use a list of custom nameservers",
-        "min_severity": "Minimum severity to emit (INFO, LOW, MEDIUM, HIGH, CRITICAL)",
-        "min_confidence": "Minimum confidence to emit (UNKNOWN, LOW, MEDIUM, HIGH, CONFIRMED)",
-        "enabled_submodules": "A list of submodules to enable. Empty list (default) enables CNAME, TXT and MX Only",
-    }
+
+    class Config(BaseModuleConfig):
+        custom_nameservers: list[str] = Field(
+            default_factory=list, description="Force BadDNS to use a list of custom nameservers"
+        )
+        min_severity: SeverityLiteral = Field("LOW", description="Minimum severity to emit")
+        min_confidence: ConfidenceLiteral = Field("MEDIUM", description="Minimum confidence to emit")
+        enabled_submodules: list[str] = Field(
+            default_factory=list,
+            description="A list of submodules to enable. Empty list (default) enables CNAME, TXT and MX Only",
+        )
+
     module_threads = 8
     deps_pip = ["baddns~=2.3.0"]
 
@@ -95,14 +102,13 @@ async def setup(self):
         self.custom_nameservers = self.config.get("custom_nameservers", []) or None
         if self.custom_nameservers:
             self.custom_nameservers = self.helpers.chain_lists(self.custom_nameservers)
-        min_severity = self.config.get("min_severity", "LOW").upper()
-        min_confidence = self.config.get("min_confidence", "MEDIUM").upper()
+        min_severity = self.config.get("min_severity").upper()
+        min_confidence = self.config.get("min_confidence").upper()
+        # guard the unvalidated programmatic path (Scanner(config=...) skips validation)
         if min_severity not in SEVERITY_LEVELS:
-            self.warning(f"Invalid min_severity: {min_severity}, defaulting to LOW")
-            min_severity = "LOW"
+            return False, f"Invalid min_severity {min_severity!r}; must be one of {', '.join(SEVERITY_LEVELS)}"
         if min_confidence not in CONFIDENCE_LEVELS:
-            self.warning(f"Invalid min_confidence: {min_confidence}, defaulting to MEDIUM")
-            min_confidence = "MEDIUM"
+            return False, f"Invalid min_confidence {min_confidence!r}; must be one of {', '.join(CONFIDENCE_LEVELS)}"
         self._min_sev_idx = SEVERITY_LEVELS.index(min_severity)
         self._min_conf_idx = CONFIDENCE_LEVELS.index(min_confidence)
         self.signatures = load_signatures()
diff --git a/bbot/modules/baddns_direct.py b/bbot/modules/baddns_direct.py
index b50ab7ddf2..6bfadcc48a 100644
--- a/bbot/modules/baddns_direct.py
+++ b/bbot/modules/baddns_direct.py
@@ -1,4 +1,5 @@
 from .baddns import baddns as baddns_module
+from bbot.core.config.models import BaseModuleConfig, Field, SeverityLiteral, ConfidenceLiteral
 
 
 class baddns_direct(baddns_module):
@@ -10,12 +11,16 @@ class baddns_direct(baddns_module):
         "created_date": "2024-01-29",
         "author": "@liquidsec",
     }
-    options = {"custom_nameservers": [], "min_severity": "LOW", "min_confidence": "MEDIUM"}
-    options_desc = {
-        "custom_nameservers": "Force BadDNS to use a list of custom nameservers",
-        "min_severity": "Minimum severity to emit (INFO, LOW, MEDIUM, HIGH, CRITICAL)",
-        "min_confidence": "Minimum confidence to emit (UNKNOWN, LOW, MEDIUM, HIGH, CONFIRMED)",
-    }
+
+    class Config(BaseModuleConfig):
+        custom_nameservers: list = Field([], description="Force BadDNS to use a list of custom nameservers")
+        min_severity: SeverityLiteral = Field(
+            "LOW", description="Minimum severity to emit (INFO, LOW, MEDIUM, HIGH, CRITICAL)"
+        )
+        min_confidence: ConfidenceLiteral = Field(
+            "MEDIUM", description="Minimum confidence to emit (UNKNOWN, LOW, MEDIUM, HIGH, CONFIRMED)"
+        )
+
     module_threads = 8
     deps_pip = ["baddns~=2.3.0"]
 
diff --git a/bbot/modules/baddns_zone.py b/bbot/modules/baddns_zone.py
index f9e46cf85e..972b73384b 100644
--- a/bbot/modules/baddns_zone.py
+++ b/bbot/modules/baddns_zone.py
@@ -1,4 +1,5 @@
 from .baddns import baddns as baddns_module
+from bbot.core.config.models import BaseModuleConfig, Field, SeverityLiteral, ConfidenceLiteral
 
 
 class baddns_zone(baddns_module):
@@ -10,12 +11,16 @@ class baddns_zone(baddns_module):
         "created_date": "2024-01-29",
         "author": "@liquidsec",
     }
-    options = {"custom_nameservers": [], "min_severity": "INFO", "min_confidence": "MEDIUM"}
-    options_desc = {
-        "custom_nameservers": "Force BadDNS to use a list of custom nameservers",
-        "min_severity": "Minimum severity to emit (INFO, LOW, MEDIUM, HIGH, CRITICAL)",
-        "min_confidence": "Minimum confidence to emit (UNKNOWN, LOW, MEDIUM, HIGH, CONFIRMED)",
-    }
+
+    class Config(BaseModuleConfig):
+        custom_nameservers: list = Field([], description="Force BadDNS to use a list of custom nameservers")
+        min_severity: SeverityLiteral = Field(
+            "INFO", description="Minimum severity to emit (INFO, LOW, MEDIUM, HIGH, CRITICAL)"
+        )
+        min_confidence: ConfidenceLiteral = Field(
+            "MEDIUM", description="Minimum confidence to emit (UNKNOWN, LOW, MEDIUM, HIGH, CONFIRMED)"
+        )
+
     module_threads = 8
     deps_pip = ["baddns~=2.3.0"]
 
diff --git a/bbot/modules/badsecrets.py b/bbot/modules/badsecrets.py
index 582fb45b99..a0a3319307 100644
--- a/bbot/modules/badsecrets.py
+++ b/bbot/modules/badsecrets.py
@@ -2,6 +2,8 @@
 from pathlib import Path
 from .base import BaseModule
 from badsecrets.base import carve_all_modules
+from bbot.core.config.models import BaseModuleConfig, Field
+from typing import Optional
 
 
 class badsecrets(BaseModule):
@@ -13,10 +15,10 @@ class badsecrets(BaseModule):
         "created_date": "2022-11-19",
         "author": "@liquidsec",
     }
-    options = {"custom_secrets": None}
-    options_desc = {
-        "custom_secrets": "Include custom secrets loaded from a local file",
-    }
+
+    class Config(BaseModuleConfig):
+        custom_secrets: Optional[str] = Field(None, description="Include custom secrets loaded from a local file")
+
     deps_pip = ["badsecrets~=1.0.0"]
 
     async def setup(self):
diff --git a/bbot/modules/base.py b/bbot/modules/base.py
index 470bed9335..50274cf936 100644
--- a/bbot/modules/base.py
+++ b/bbot/modules/base.py
@@ -18,7 +18,7 @@ class BaseModule:
 
         produced_events (List): Event types to produce.
 
-        meta (Dict): Metadata about the module, such as whether authentication is required and a description.
+        meta (Dict): Metadata about the module — description, author, created_date, etc.
 
         flags (List): Flags indicating the type of module (must have at least "passive" or "active").
 
@@ -86,7 +86,7 @@ class BaseModule:
 
     watched_events = []
     produced_events = []
-    meta = {"auth_required": False, "description": "Base module"}
+    meta = {"description": "Base module"}
     flags = []
     options = {}
     options_desc = {}
@@ -1502,7 +1502,13 @@ def priority(self):
 
     @property
     def auth_required(self):
-        return self.meta.get("auth_required", False)
+        """True iff this module's `class Config` declares any `mandatory=True` field."""
+        cfg = getattr(type(self), "Config", None)
+        if cfg is None:
+            return False
+        from bbot.core.config.models import is_mandatory
+
+        return any(is_mandatory(f) for f in getattr(cfg, "model_fields", {}).values())
 
     @property
     def http_timeout(self):
@@ -1775,21 +1781,21 @@ def critical(self, *args, trace=True, **kwargs):
             self.trace()
 
     @classmethod
-    def help_text(self):
+    def help_text(cls):
         """
         Returns a string containing help text for the module.
         This includes the module's description, metadata, events, flags, and available options.
         """
-        # Retrieve the module's metadata, options, events, and flags
-        meta = getattr(self, "meta", {})
-        options = getattr(self, "options", {})
-        options_desc = getattr(self, "options_desc", {})
-        watched_events = getattr(self, "watched_events", [])
-        produced_events = getattr(self, "produced_events", [])
-        flags = getattr(self, "flags", [])
+        from pydantic_core import PydanticUndefined
+
+        # Retrieve the module's metadata, events, and flags
+        meta = getattr(cls, "meta", {})
+        watched_events = getattr(cls, "watched_events", [])
+        produced_events = getattr(cls, "produced_events", [])
+        flags = getattr(cls, "flags", [])
 
         help_text = "\n" + "=" * 40 + "\n"
-        help_text += f"Module Help: {self.__name__}\n"
+        help_text += f"Module Help: {cls.__name__}\n"
         help_text += "=" * 40 + "\n\n"
 
         for key, value in meta.items():
@@ -1804,12 +1810,24 @@ def help_text(self):
         help_text += "\nFlags:\n"
         help_text += "  " + ", ".join(flags) + "\n" if flags else "  None\n"
 
+        # Options come from the module's `class Config`; show only its own declared fields
+        # (mirrors `--list-module-options`), not inherited universal options.
+        config_cls = getattr(cls, "Config", None)
+        own_options = (
+            [name for name in getattr(config_cls, "__annotations__", {}) if name in config_cls.model_fields]
+            if config_cls is not None
+            else []
+        )
         help_text += "\nOptions:\n"
-        if options:
-            for option, default_value in options.items():
-                option_description = options_desc.get(option, "No description available.")
+        if own_options:
+            for option in sorted(own_options):
+                field = config_cls.model_fields[option]
+                default_value = field.get_default(call_default_factory=True)
+                if default_value is PydanticUndefined:
+                    default_value = ""
+                description = field.description or "No description available."
                 help_text += f"  - {option}:\n"
-                help_text += f"      Description: {option_description}\n"
+                help_text += f"      Description: {description}\n"
                 help_text += f"      Default: {default_value}\n"
         else:
             help_text += "  No options available."
diff --git a/bbot/modules/bevigil.py b/bbot/modules/bevigil.py
index 82d9e00c90..e5fd13202d 100644
--- a/bbot/modules/bevigil.py
+++ b/bbot/modules/bevigil.py
@@ -1,4 +1,5 @@
 from bbot.modules.templates.subdomain_enum import subdomain_enum_apikey
+from bbot.core.config.models import BaseModuleConfig, Field
 
 
 class bevigil(subdomain_enum_apikey):
@@ -13,10 +14,11 @@ class bevigil(subdomain_enum_apikey):
         "description": "Retrieve OSINT data from mobile applications using BeVigil",
         "created_date": "2022-10-26",
         "author": "@alt-glitch",
-        "auth_required": True,
     }
-    options = {"api_key": "", "urls": False}
-    options_desc = {"api_key": "BeVigil OSINT API Key", "urls": "Emit URLs in addition to DNS_NAMEs"}
+
+    class Config(BaseModuleConfig):
+        api_key: str | list[str] = Field("", description="BeVigil OSINT API Key", sensitive=True, mandatory=True)
+        urls: bool = Field(False, description="Emit URLs in addition to DNS_NAMEs")
 
     base_url = "https://osint.bevigil.com/api"
 
diff --git a/bbot/modules/bucket_amazon.py b/bbot/modules/bucket_amazon.py
index 1b9d7fd788..94008fa7bb 100644
--- a/bbot/modules/bucket_amazon.py
+++ b/bbot/modules/bucket_amazon.py
@@ -1,4 +1,5 @@
 from bbot.modules.templates.bucket import bucket_template
+from bbot.core.config.models import BaseModuleConfig, Field
 
 
 class bucket_amazon(bucket_template):
@@ -10,10 +11,10 @@ class bucket_amazon(bucket_template):
         "created_date": "2022-11-04",
         "author": "@TheTechromancer",
     }
-    options = {"permutations": False}
-    options_desc = {
-        "permutations": "Whether to try permutations",
-    }
+
+    class Config(BaseModuleConfig):
+        permutations: bool = Field(False, description="Whether to try permutations")
+
     scope_distance_modifier = 3
 
     cloudcheck_provider_name = "Amazon"
diff --git a/bbot/modules/bucket_digitalocean.py b/bbot/modules/bucket_digitalocean.py
index cd0e90a90c..1c462bd727 100644
--- a/bbot/modules/bucket_digitalocean.py
+++ b/bbot/modules/bucket_digitalocean.py
@@ -1,4 +1,5 @@
 from bbot.modules.templates.bucket import bucket_template
+from bbot.core.config.models import BaseModuleConfig, Field
 
 
 class bucket_digitalocean(bucket_template):
@@ -10,10 +11,9 @@ class bucket_digitalocean(bucket_template):
         "created_date": "2022-11-08",
         "author": "@TheTechromancer",
     }
-    options = {"permutations": False}
-    options_desc = {
-        "permutations": "Whether to try permutations",
-    }
+
+    class Config(BaseModuleConfig):
+        permutations: bool = Field(False, description="Whether to try permutations")
 
     cloudcheck_provider_name = "DigitalOcean"
     delimiters = ("", "-")
diff --git a/bbot/modules/bucket_file_enum.py b/bbot/modules/bucket_file_enum.py
index 8849970e4b..a464316d80 100644
--- a/bbot/modules/bucket_file_enum.py
+++ b/bbot/modules/bucket_file_enum.py
@@ -1,5 +1,6 @@
 from bbot.modules.base import BaseModule
 import xml.etree.ElementTree as ET
+from bbot.core.config.models import BaseModuleConfig, Field
 
 
 class bucket_file_enum(BaseModule):
@@ -17,10 +18,10 @@ class bucket_file_enum(BaseModule):
         "author": "@TheTechromancer",
     }
     flags = ["safe", "passive", "cloud-enum"]
-    options = {
-        "file_limit": 50,
-    }
-    options_desc = {"file_limit": "Limit the number of files downloaded per bucket"}
+
+    class Config(BaseModuleConfig):
+        file_limit: int = Field(50, description="Limit the number of files downloaded per bucket")
+
     scope_distance_modifier = 2
 
     async def setup(self):
diff --git a/bbot/modules/bucket_firebase.py b/bbot/modules/bucket_firebase.py
index 4859911a68..dbe64bf475 100644
--- a/bbot/modules/bucket_firebase.py
+++ b/bbot/modules/bucket_firebase.py
@@ -1,4 +1,5 @@
 from bbot.modules.templates.bucket import bucket_template
+from bbot.core.config.models import BaseModuleConfig, Field
 
 
 class bucket_firebase(bucket_template):
@@ -10,10 +11,9 @@ class bucket_firebase(bucket_template):
         "created_date": "2023-03-20",
         "author": "@TheTechromancer",
     }
-    options = {"permutations": False}
-    options_desc = {
-        "permutations": "Whether to try permutations",
-    }
+
+    class Config(BaseModuleConfig):
+        permutations: bool = Field(False, description="Whether to try permutations")
 
     cloudcheck_provider_name = "Google"
     delimiters = ("", "-")
diff --git a/bbot/modules/bucket_google.py b/bbot/modules/bucket_google.py
index 338db450c4..edaf864f0c 100644
--- a/bbot/modules/bucket_google.py
+++ b/bbot/modules/bucket_google.py
@@ -1,4 +1,5 @@
 from bbot.modules.templates.bucket import bucket_template
+from bbot.core.config.models import BaseModuleConfig, Field
 
 
 class bucket_google(bucket_template):
@@ -14,10 +15,9 @@ class bucket_google(bucket_template):
         "created_date": "2022-11-04",
         "author": "@TheTechromancer",
     }
-    options = {"permutations": False}
-    options_desc = {
-        "permutations": "Whether to try permutations",
-    }
+
+    class Config(BaseModuleConfig):
+        permutations: bool = Field(False, description="Whether to try permutations")
 
     cloudcheck_provider_name = "Google"
     delimiters = ("", "-", ".", "_")
diff --git a/bbot/modules/bucket_hetzner.py b/bbot/modules/bucket_hetzner.py
index c49134b411..192e1502c1 100644
--- a/bbot/modules/bucket_hetzner.py
+++ b/bbot/modules/bucket_hetzner.py
@@ -1,4 +1,5 @@
 from bbot.modules.templates.bucket import bucket_template
+from bbot.core.config.models import BaseModuleConfig, Field
 
 
 class bucket_hetzner(bucket_template):
@@ -10,10 +11,9 @@ class bucket_hetzner(bucket_template):
         "created_date": "2026-05-04",
         "author": "@ChrisJr404",
     }
-    options = {"permutations": False}
-    options_desc = {
-        "permutations": "Whether to try permutations",
-    }
+
+    class Config(BaseModuleConfig):
+        permutations: bool = Field(False, description="Whether to try permutations")
 
     cloudcheck_provider_name = "Hetzner"
     delimiters = ("", "-")
diff --git a/bbot/modules/bucket_microsoft.py b/bbot/modules/bucket_microsoft.py
index 9dc5924c0a..a565fdfe01 100644
--- a/bbot/modules/bucket_microsoft.py
+++ b/bbot/modules/bucket_microsoft.py
@@ -1,4 +1,5 @@
 from bbot.modules.templates.bucket import bucket_template
+from bbot.core.config.models import BaseModuleConfig, Field
 
 
 class bucket_microsoft(bucket_template):
@@ -10,10 +11,9 @@ class bucket_microsoft(bucket_template):
         "created_date": "2022-11-04",
         "author": "@TheTechromancer",
     }
-    options = {"permutations": False}
-    options_desc = {
-        "permutations": "Whether to try permutations",
-    }
+
+    class Config(BaseModuleConfig):
+        permutations: bool = Field(False, description="Whether to try permutations")
 
     cloudcheck_provider_name = "Microsoft"
     delimiters = ("", "-")
diff --git a/bbot/modules/bufferoverrun.py b/bbot/modules/bufferoverrun.py
index 18b10b2e56..baeb1bad58 100644
--- a/bbot/modules/bufferoverrun.py
+++ b/bbot/modules/bufferoverrun.py
@@ -1,4 +1,5 @@
 from bbot.modules.templates.subdomain_enum import subdomain_enum_apikey
+from bbot.core.config.models import BaseModuleConfig, Field
 
 
 class BufferOverrun(subdomain_enum_apikey):
@@ -9,10 +10,11 @@ class BufferOverrun(subdomain_enum_apikey):
         "description": "Query BufferOverrun's TLS API for subdomains",
         "created_date": "2024-10-23",
         "author": "@TheTechromancer",
-        "auth_required": True,
     }
-    options = {"api_key": "", "commercial": False}
-    options_desc = {"api_key": "BufferOverrun API key", "commercial": "Use commercial API"}
+
+    class Config(BaseModuleConfig):
+        api_key: str | list[str] = Field("", description="BufferOverrun API key", sensitive=True, mandatory=True)
+        commercial: bool = Field(False, description="Use commercial API")
 
     base_url = "https://tls.bufferover.run/dns"
     commercial_base_url = "https://bufferover-run-tls.p.rapidapi.com/ipv4/dns"
diff --git a/bbot/modules/builtwith.py b/bbot/modules/builtwith.py
index 054818c942..cc7fd28ce7 100644
--- a/bbot/modules/builtwith.py
+++ b/bbot/modules/builtwith.py
@@ -11,6 +11,7 @@
 ############################################################
 
 from bbot.modules.templates.subdomain_enum import subdomain_enum_apikey
+from bbot.core.config.models import BaseModuleConfig, Field
 
 
 class builtwith(subdomain_enum_apikey):
@@ -21,10 +22,12 @@ class builtwith(subdomain_enum_apikey):
         "description": "Query Builtwith.com for subdomains",
         "created_date": "2022-08-23",
         "author": "@TheTechromancer",
-        "auth_required": True,
     }
-    options = {"api_key": "", "redirects": True}
-    options_desc = {"api_key": "Builtwith API key", "redirects": "Also look up inbound and outbound redirects"}
+
+    class Config(BaseModuleConfig):
+        api_key: str | list[str] = Field("", description="Builtwith API key", sensitive=True, mandatory=True)
+        redirects: bool = Field(True, description="Also look up inbound and outbound redirects")
+
     base_url = "https://api.builtwith.com"
 
     async def handle_event(self, event):
diff --git a/bbot/modules/c99.py b/bbot/modules/c99.py
index 84b3eafc6c..6b40a2b8e4 100644
--- a/bbot/modules/c99.py
+++ b/bbot/modules/c99.py
@@ -1,4 +1,5 @@
 from bbot.modules.templates.subdomain_enum import subdomain_enum_apikey
+from bbot.core.config.models import BaseModuleConfig, Field
 
 
 class c99(subdomain_enum_apikey):
@@ -9,10 +10,10 @@ class c99(subdomain_enum_apikey):
         "description": "Query the C99 API for subdomains",
         "created_date": "2022-07-08",
         "author": "@TheTechromancer",
-        "auth_required": True,
     }
-    options = {"api_key": ""}
-    options_desc = {"api_key": "c99.nl API key"}
+
+    class Config(BaseModuleConfig):
+        api_key: str | list[str] = Field("", description="c99.nl API key", sensitive=True, mandatory=True)
 
     base_url = "https://api.c99.nl"
     ping_url = f"{base_url}/randomnumber?key={{api_key}}&between=1,100&json"
diff --git a/bbot/modules/censys_dns.py b/bbot/modules/censys_dns.py
index 7e4a397eb8..f035ff36ff 100644
--- a/bbot/modules/censys_dns.py
+++ b/bbot/modules/censys_dns.py
@@ -1,4 +1,5 @@
 from bbot.modules.templates.censys import censys
+from bbot.core.config.models import BaseModuleConfig, Field
 
 
 class censys_dns(censys):
@@ -14,14 +15,14 @@ class censys_dns(censys):
         "description": "Query the Censys API for subdomains",
         "created_date": "2022-08-04",
         "author": "@TheTechromancer",
-        "auth_required": True,
-    }
-    options = {"api_key": "", "max_pages": 5}
-    options_desc = {
-        "api_key": "Censys.io API Key in the format of 'key:secret'",
-        "max_pages": "Maximum number of pages to fetch (100 results per page)",
     }
 
+    class Config(BaseModuleConfig):
+        api_key: str | list[str] = Field(
+            "", description="Censys.io API Key in the format of 'key:secret'", sensitive=True, mandatory=True
+        )
+        max_pages: int = Field(5, description="Maximum number of pages to fetch (100 results per page)")
+
     async def setup(self):
         self.max_pages = self.config.get("max_pages", 5)
         return await super().setup()
diff --git a/bbot/modules/censys_ip.py b/bbot/modules/censys_ip.py
index 374323b8fe..078dce65f2 100644
--- a/bbot/modules/censys_ip.py
+++ b/bbot/modules/censys_ip.py
@@ -1,4 +1,5 @@
 from bbot.modules.templates.censys import censys
+from bbot.core.config.models import BaseModuleConfig, Field
 
 
 class censys_ip(censys):
@@ -21,14 +22,19 @@ class censys_ip(censys):
         "description": "Query the Censys API for hosts by IP address",
         "created_date": "2026-01-26",
         "author": "@TheTechromancer",
-        "auth_required": True,
-    }
-    options = {"api_key": "", "dns_names_limit": 100, "in_scope_only": True}
-    options_desc = {
-        "api_key": "Censys.io API Key in the format of 'key:secret'",
-        "dns_names_limit": "Maximum number of DNS names to extract from dns.names (default 100)",
-        "in_scope_only": "Only query in-scope IPs. If False, will query up to distance 1.",
     }
+
+    class Config(BaseModuleConfig):
+        api_key: str | list[str] = Field(
+            "", description="Censys.io API Key in the format of 'key:secret'", sensitive=True, mandatory=True
+        )
+        dns_names_limit: int = Field(
+            100, description="Maximum number of DNS names to extract from dns.names (default 100)"
+        )
+        in_scope_only: bool = Field(
+            True, description="Only query in-scope IPs. If False, will query up to distance 1."
+        )
+
     scope_distance_modifier = 1
 
     async def setup(self):
diff --git a/bbot/modules/chaos.py b/bbot/modules/chaos.py
index 9c4255e542..c43a192a63 100644
--- a/bbot/modules/chaos.py
+++ b/bbot/modules/chaos.py
@@ -1,4 +1,5 @@
 from bbot.modules.templates.subdomain_enum import subdomain_enum_apikey
+from bbot.core.config.models import BaseModuleConfig, Field
 
 
 class chaos(subdomain_enum_apikey):
@@ -9,10 +10,10 @@ class chaos(subdomain_enum_apikey):
         "description": "Query ProjectDiscovery's Chaos API for subdomains",
         "created_date": "2022-08-14",
         "author": "@TheTechromancer",
-        "auth_required": True,
     }
-    options = {"api_key": ""}
-    options_desc = {"api_key": "Chaos API key"}
+
+    class Config(BaseModuleConfig):
+        api_key: str | list[str] = Field("", description="Chaos API key", sensitive=True, mandatory=True)
 
     base_url = "https://dns.projectdiscovery.io/dns"
     ping_url = f"{base_url}/example.com"
diff --git a/bbot/modules/credshed.py b/bbot/modules/credshed.py
index ea1bf707c1..c2c477990e 100644
--- a/bbot/modules/credshed.py
+++ b/bbot/modules/credshed.py
@@ -1,6 +1,7 @@
 from contextlib import suppress
 
 from bbot.modules.templates.subdomain_enum import subdomain_enum
+from bbot.core.config.models import BaseModuleConfig, Field
 
 
 class credshed(subdomain_enum):
@@ -11,14 +12,13 @@ class credshed(subdomain_enum):
         "description": "Send queries to your own credshed server to check for known credentials of your targets",
         "created_date": "2023-10-12",
         "author": "@SpamFaux",
-        "auth_required": True,
-    }
-    options = {"username": "", "password": "", "credshed_url": ""}
-    options_desc = {
-        "username": "Credshed username",
-        "password": "Credshed password",
-        "credshed_url": "URL of credshed server",
     }
+
+    class Config(BaseModuleConfig):
+        username: str = Field("", description="Credshed username", sensitive=True, mandatory=True)
+        password: str = Field("", description="Credshed password", sensitive=True, mandatory=True)
+        credshed_url: str = Field("", description="URL of credshed server", mandatory=True)
+
     target_only = True
 
     async def setup(self):
diff --git a/bbot/modules/dehashed.py b/bbot/modules/dehashed.py
index 701425407f..7ad01a8c1e 100644
--- a/bbot/modules/dehashed.py
+++ b/bbot/modules/dehashed.py
@@ -1,6 +1,7 @@
 from contextlib import suppress
 
 from bbot.modules.templates.subdomain_enum import subdomain_enum
+from bbot.core.config.models import BaseModuleConfig, Field
 
 
 class dehashed(subdomain_enum):
@@ -11,10 +12,11 @@ class dehashed(subdomain_enum):
         "description": "Execute queries against dehashed.com for exposed credentials",
         "created_date": "2023-10-12",
         "author": "@SpamFaux",
-        "auth_required": True,
     }
-    options = {"api_key": ""}
-    options_desc = {"api_key": "DeHashed API Key"}
+
+    class Config(BaseModuleConfig):
+        api_key: str | list[str] = Field("", description="DeHashed API Key", sensitive=True, mandatory=True)
+
     target_only = True
 
     base_url = "https://api.dehashed.com/v2/search"
diff --git a/bbot/modules/dnsbimi.py b/bbot/modules/dnsbimi.py
index d301857d30..3a5c38f38e 100644
--- a/bbot/modules/dnsbimi.py
+++ b/bbot/modules/dnsbimi.py
@@ -28,6 +28,7 @@
 from bbot.core.helpers.dns.helpers import record_to_text, service_record
 
 import re
+from bbot.core.config.models import BaseModuleConfig, Field
 
 # Handle "v=BIMI1; l=; a=;" == RFC conformant explicit declination to publish, e.g. useful on a sub-domain if you don't want the sub-domain to have a BIMI logo, yet your registered domain does?
 # Handle "v=BIMI1; l=; a=" == RFC non-conformant explicit declination to publish
@@ -52,16 +53,11 @@ class dnsbimi(BaseModule):
         "author": "@colin-stubbs",
         "created_date": "2024-11-15",
     }
-    options = {
-        "emit_raw_dns_records": False,
-        "emit_urls": True,
-        "selectors": "default,email,mail,bimi",
-    }
-    options_desc = {
-        "emit_raw_dns_records": "Emit RAW_DNS_RECORD events",
-        "emit_urls": "Emit URL_UNVERIFIED events",
-        "selectors": "CSV list of BIMI selectors to check",
-    }
+
+    class Config(BaseModuleConfig):
+        emit_raw_dns_records: bool = Field(False, description="Emit RAW_DNS_RECORD events")
+        emit_urls: bool = Field(True, description="Emit URL_UNVERIFIED events")
+        selectors: str = Field("default,email,mail,bimi", description="CSV list of BIMI selectors to check")
 
     async def setup(self):
         self.emit_raw_dns_records = self.config.get("emit_raw_dns_records", False)
diff --git a/bbot/modules/dnsbrute.py b/bbot/modules/dnsbrute.py
index 079d8f59f4..7b56ae1408 100644
--- a/bbot/modules/dnsbrute.py
+++ b/bbot/modules/dnsbrute.py
@@ -1,4 +1,7 @@
+from typing import Union
+
 from bbot.modules.templates.subdomain_enum import subdomain_enum
+from bbot.core.config.models import BaseModuleConfig, Field
 
 
 class dnsbrute(subdomain_enum):
@@ -10,16 +13,18 @@ class dnsbrute(subdomain_enum):
         "author": "@TheTechromancer",
         "created_date": "2024-04-24",
     }
-    options = {
-        "wordlist": "https://raw.githubusercontent.com/danielmiessler/SecLists/master/Discovery/DNS/subdomains-top1million-5000.txt",
-        "max_depth": 5,
-        "recursive_mutations": False,
-    }
-    options_desc = {
-        "wordlist": "Subdomain wordlist URL or file path. Accepts a list of URLs/paths to merge multiple wordlists (duplicates are removed).",
-        "max_depth": "How many subdomains deep to brute force, i.e. 5.4.3.2.1.evilcorp.com",
-        "recursive_mutations": "If True, brute-force hosts discovered by dnsbrute_mutations. The default (False) skips them because the static wordlist heavily overlaps with the mutation algorithm's own output.",
-    }
+
+    class Config(BaseModuleConfig):
+        wordlist: Union[str, list[str]] = Field(
+            "https://raw.githubusercontent.com/danielmiessler/SecLists/master/Discovery/DNS/subdomains-top1million-5000.txt",
+            description="Subdomain wordlist URL or file path. Accepts a list of URLs/paths to merge multiple wordlists (duplicates are removed).",
+        )
+        max_depth: int = Field(5, description="How many subdomains deep to brute force, i.e. 5.4.3.2.1.evilcorp.com")
+        recursive_mutations: bool = Field(
+            False,
+            description="If True, brute-force hosts discovered by dnsbrute_mutations. The default (False) skips them because the static wordlist heavily overlaps with the mutation algorithm's own output.",
+        )
+
     deps_common = ["massdns"]
     reject_wildcards = "strict"
     dedup_strategy = "lowest_parent"
diff --git a/bbot/modules/dnsbrute_mutations.py b/bbot/modules/dnsbrute_mutations.py
index 76b85d5055..b4784f6ea6 100644
--- a/bbot/modules/dnsbrute_mutations.py
+++ b/bbot/modules/dnsbrute_mutations.py
@@ -1,6 +1,7 @@
 import time
 
 from bbot.modules.base import BaseModule
+from bbot.core.config.models import BaseModuleConfig, Field
 
 
 class dnsbrute_mutations(BaseModule):
@@ -12,12 +13,10 @@ class dnsbrute_mutations(BaseModule):
         "author": "@TheTechromancer",
         "created_date": "2024-04-25",
     }
-    options = {
-        "max_mutations": 100,
-    }
-    options_desc = {
-        "max_mutations": "Maximum number of target-specific mutations to try per subdomain",
-    }
+
+    class Config(BaseModuleConfig):
+        max_mutations: int = Field(100, description="Maximum number of target-specific mutations to try per subdomain")
+
     deps_common = ["massdns"]
     _qsize = 10000
 
diff --git a/bbot/modules/dnscaa.py b/bbot/modules/dnscaa.py
index 0f8fa9ee96..c132f6af5e 100644
--- a/bbot/modules/dnscaa.py
+++ b/bbot/modules/dnscaa.py
@@ -22,6 +22,7 @@
 from bbot.modules.base import BaseModule
 
 from bbot.core.helpers.regexes import dns_name_extraction_regex, email_regex, url_regexes
+from bbot.core.config.models import BaseModuleConfig, Field
 
 
 class dnscaa(BaseModule):
@@ -29,18 +30,13 @@ class dnscaa(BaseModule):
     produced_events = ["DNS_NAME", "EMAIL_ADDRESS", "URL_UNVERIFIED"]
     flags = ["safe", "subdomain-enum", "email-enum", "passive"]
     meta = {"description": "Check for CAA records", "author": "@colin-stubbs", "created_date": "2024-05-26"}
-    options = {
-        "in_scope_only": True,
-        "dns_names": True,
-        "emails": True,
-        "urls": True,
-    }
-    options_desc = {
-        "in_scope_only": "Only check in-scope domains",
-        "dns_names": "emit DNS_NAME events",
-        "emails": "emit EMAIL_ADDRESS events",
-        "urls": "emit URL_UNVERIFIED events",
-    }
+
+    class Config(BaseModuleConfig):
+        in_scope_only: bool = Field(True, description="Only check in-scope domains")
+        dns_names: bool = Field(True, description="emit DNS_NAME events")
+        emails: bool = Field(True, description="emit EMAIL_ADDRESS events")
+        urls: bool = Field(True, description="emit URL_UNVERIFIED events")
+
     # accept DNS_NAMEs out to 2 hops if in_scope_only is False
     scope_distance_modifier = 2
 
diff --git a/bbot/modules/dnscommonsrv.py b/bbot/modules/dnscommonsrv.py
index c53358868f..36ce8fb89b 100644
--- a/bbot/modules/dnscommonsrv.py
+++ b/bbot/modules/dnscommonsrv.py
@@ -1,5 +1,6 @@
 from bbot.core.helpers.dns.helpers import common_srvs
 from bbot.modules.templates.subdomain_enum import subdomain_enum
+from bbot.core.config.models import BaseModuleConfig, Field
 
 
 class dnscommonsrv(subdomain_enum):
@@ -10,11 +11,12 @@ class dnscommonsrv(subdomain_enum):
     dedup_strategy = "lowest_parent"
     deps_common = ["massdns"]
 
-    options = {"max_depth": 2, "recursive_mutations": False}
-    options_desc = {
-        "max_depth": "The maximum subdomain depth to brute-force SRV records",
-        "recursive_mutations": "If True, brute-force SRV records on hosts discovered by dnsbrute_mutations. Default False skips them.",
-    }
+    class Config(BaseModuleConfig):
+        max_depth: int = Field(2, description="The maximum subdomain depth to brute-force SRV records")
+        recursive_mutations: bool = Field(
+            False,
+            description="If True, brute-force SRV records on hosts discovered by dnsbrute_mutations. Default False skips them.",
+        )
 
     async def setup(self):
         self.max_subdomain_depth = self.config.get("max_depth", 2)
diff --git a/bbot/modules/dnstlsrpt.py b/bbot/modules/dnstlsrpt.py
index 7c45759478..ead85169c5 100644
--- a/bbot/modules/dnstlsrpt.py
+++ b/bbot/modules/dnstlsrpt.py
@@ -20,6 +20,7 @@
 import re
 
 from bbot.core.helpers.regexes import email_regex, url_regexes
+from bbot.core.config.models import BaseModuleConfig, Field
 
 _tlsrpt_regex = r"^v=(?P<v>TLSRPTv[0-9]+); *(?P<kvps>.*)$"
 tlsrpt_regex = re.compile(_tlsrpt_regex, re.I)
@@ -40,16 +41,11 @@ class dnstlsrpt(BaseModule):
         "author": "@colin-stubbs",
         "created_date": "2024-07-26",
     }
-    options = {
-        "emit_emails": True,
-        "emit_raw_dns_records": False,
-        "emit_urls": True,
-    }
-    options_desc = {
-        "emit_emails": "Emit EMAIL_ADDRESS events",
-        "emit_raw_dns_records": "Emit RAW_DNS_RECORD events",
-        "emit_urls": "Emit URL_UNVERIFIED events",
-    }
+
+    class Config(BaseModuleConfig):
+        emit_emails: bool = Field(True, description="Emit EMAIL_ADDRESS events")
+        emit_raw_dns_records: bool = Field(False, description="Emit RAW_DNS_RECORD events")
+        emit_urls: bool = Field(True, description="Emit URL_UNVERIFIED events")
 
     async def setup(self):
         self.emit_emails = self.config.get("emit_emails", True)
diff --git a/bbot/modules/docker_pull.py b/bbot/modules/docker_pull.py
index ad702cc5e3..28180499aa 100644
--- a/bbot/modules/docker_pull.py
+++ b/bbot/modules/docker_pull.py
@@ -3,6 +3,7 @@
 import tarfile
 from pathlib import Path
 from bbot.modules.base import BaseModule
+from bbot.core.config.models import BaseModuleConfig, Field
 
 
 class docker_pull(BaseModule):
@@ -14,11 +15,13 @@ class docker_pull(BaseModule):
         "created_date": "2024-03-24",
         "author": "@domwhewell-sage",
     }
-    options = {"all_tags": False, "output_folder": ""}
-    options_desc = {
-        "all_tags": "Download all tags from each registry (Default False)",
-        "output_folder": "Folder to download docker repositories to. If not specified, downloaded docker images will be deleted when the scan completes, to minimize disk usage.",
-    }
+
+    class Config(BaseModuleConfig):
+        all_tags: bool = Field(False, description="Download all tags from each registry (Default False)")
+        output_folder: str = Field(
+            "",
+            description="Folder to download docker repositories to. If not specified, downloaded docker images will be deleted when the scan completes, to minimize disk usage.",
+        )
 
     scope_distance_modifier = 2
 
diff --git a/bbot/modules/filedownload.py b/bbot/modules/filedownload.py
index adb50f7857..b43e58be0c 100644
--- a/bbot/modules/filedownload.py
+++ b/bbot/modules/filedownload.py
@@ -2,6 +2,7 @@
 from pathlib import Path
 
 from bbot.modules.base import BaseModule
+from bbot.core.config.models import BaseModuleConfig, Field
 
 
 class filedownload(BaseModule):
@@ -20,77 +21,78 @@ class filedownload(BaseModule):
         "created_date": "2023-10-11",
         "author": "@TheTechromancer",
     }
-    options = {
-        "extensions": [
-            "bak",  #  Backup File
-            "bash",  #  Bash Script or Configuration
-            "bashrc",  #  Bash Script or Configuration
-            "cfg",  #  Configuration File
-            "conf",  #  Configuration File
-            "crt",  #  Certificate File
-            "csv",  #  Comma Separated Values File
-            "db",  #  SQLite Database File
-            "dll",  #  Windows Dynamic Link Library
-            "doc",  #  Microsoft Word Document (Old Format)
-            "docx",  #  Microsoft Word Document
-            "exe",  #  Windows PE executable
-            "ica",  #  Citrix Independent Computing Architecture File
-            "indd",  #  Adobe InDesign Document
-            "ini",  #  Initialization File
-            "jar",  #  Java Archive
-            "json",  #  JSON File
-            "key",  #  Private Key File
-            "log",  #  Log File
-            "markdown",  #  Markdown File
-            "md",  #  Markdown File
-            "msi",  # Windows setup file
-            "odg",  #  OpenDocument Graphics (LibreOffice, OpenOffice)
-            "odp",  #  OpenDocument Presentation (LibreOffice, OpenOffice)
-            "ods",  #  OpenDocument Spreadsheet (LibreOffice, OpenOffice)
-            "odt",  #  OpenDocument Text (LibreOffice, OpenOffice)
-            "pdf",  #  Adobe Portable Document Format
-            "pem",  #  Privacy Enhanced Mail (SSL certificate)
-            "pps",  #  Microsoft PowerPoint Slideshow (Old Format)
-            "ppsx",  #  Microsoft PowerPoint Slideshow
-            "ppt",  #  Microsoft PowerPoint Presentation (Old Format)
-            "pptx",  #  Microsoft PowerPoint Presentation
-            "ps1",  #  PowerShell Script
-            "pub",  #  Public Key File
-            "raw",  #  Raw Image File Format
-            "rdp",  #  Remote Desktop Protocol File
-            "rsa",  #  RSA Private Key File
-            "sh",  #  Shell Script
-            "sql",  #  SQL Database Dump
-            "sqlite",  #  SQLite Database File
-            "swp",  #  Swap File (temporary file, often Vim)
-            "sxw",  #  OpenOffice.org Writer document
-            "tar.gz",  # Gzip-Compressed Tar Archive
-            "tgz",  #  Gzip-Compressed Tar Archive
-            "tar",  #  Tar Archive
-            "txt",  #  Plain Text Document
-            "vbs",  #  Visual Basic Script
-            "war",  #  Java Web Archive
-            "wpd",  #  WordPerfect Document
-            "xls",  #  Microsoft Excel Spreadsheet (Old Format)
-            "xlsx",  #  Microsoft Excel Spreadsheet
-            "xml",  #  eXtensible Markup Language File
-            "yaml",  #  YAML Ain't Markup Language
-            "yml",  #  YAML Ain't Markup Language
-            "zip",  #  Zip Archive
-            "lzma",  #  LZMA Compressed File
-            "rar",  #  RAR Compressed File
-            "7z",  #  7-Zip Compressed File
-            "xz",  #  XZ Compressed File
-            "bz2",  #  Bzip2 Compressed File
-        ],
-        "max_filesize": "10MB",
-        "output_folder": "",
-    }
-    options_desc = {
-        "extensions": "File extensions to download",
-        "max_filesize": "Cancel download if filesize is greater than this size",
-        "output_folder": "Folder to download files to. If not specified, downloaded files will be deleted when the scan completes, to minimize disk usage.",
-    }
+
+    class Config(BaseModuleConfig):
+        extensions: list[str] = Field(
+            [
+                "bak",
+                "bash",
+                "bashrc",
+                "cfg",
+                "conf",
+                "crt",
+                "csv",
+                "db",
+                "dll",
+                "doc",
+                "docx",
+                "exe",
+                "ica",
+                "indd",
+                "ini",
+                "jar",
+                "json",
+                "key",
+                "log",
+                "markdown",
+                "md",
+                "msi",
+                "odg",
+                "odp",
+                "ods",
+                "odt",
+                "pdf",
+                "pem",
+                "pps",
+                "ppsx",
+                "ppt",
+                "pptx",
+                "ps1",
+                "pub",
+                "raw",
+                "rdp",
+                "rsa",
+                "sh",
+                "sql",
+                "sqlite",
+                "swp",
+                "sxw",
+                "tar.gz",
+                "tgz",
+                "tar",
+                "txt",
+                "vbs",
+                "war",
+                "wpd",
+                "xls",
+                "xlsx",
+                "xml",
+                "yaml",
+                "yml",
+                "zip",
+                "lzma",
+                "rar",
+                "7z",
+                "xz",
+                "bz2",
+            ],
+            description="File extensions to download",
+        )
+        max_filesize: str = Field("10MB", description="Cancel download if filesize is greater than this size")
+        output_folder: str = Field(
+            "",
+            description="Folder to download files to. If not specified, downloaded files will be deleted when the scan completes, to minimize disk usage.",
+        )
 
     scope_distance_modifier = 3
 
diff --git a/bbot/modules/fingerprintx.py b/bbot/modules/fingerprintx.py
index 7727b1e6e5..4bbac86970 100644
--- a/bbot/modules/fingerprintx.py
+++ b/bbot/modules/fingerprintx.py
@@ -1,6 +1,7 @@
 import json
 import subprocess
 from bbot.modules.base import BaseModule
+from bbot.core.config.models import BaseModuleConfig, Field
 
 
 class fingerprintx(BaseModule):
@@ -12,14 +13,13 @@ class fingerprintx(BaseModule):
         "created_date": "2023-01-30",
         "author": "@TheTechromancer",
     }
-    options = {"version": "1.1.4"}
-    options_desc = {"version": "fingerprintx version"}
     _batch_size = 10
     _module_threads = 2
     _priority = 2
 
-    options = {"skip_common_web": True}
-    options_desc = {"skip_common_web": "Skip common web ports such as 80, 443, 8080, 8443, etc."}
+    class Config(BaseModuleConfig):
+        version: str = Field("1.1.4", description="fingerprintx version")
+        skip_common_web: bool = Field(True, description="Skip common web ports such as 80, 443, 8080, 8443, etc.")
 
     deps_ansible = [
         {
diff --git a/bbot/modules/fullhunt.py b/bbot/modules/fullhunt.py
index 584dafb143..d6a12cf03f 100644
--- a/bbot/modules/fullhunt.py
+++ b/bbot/modules/fullhunt.py
@@ -1,4 +1,5 @@
 from bbot.modules.templates.subdomain_enum import subdomain_enum_apikey
+from bbot.core.config.models import BaseModuleConfig, Field
 
 
 class fullhunt(subdomain_enum_apikey):
@@ -9,10 +10,10 @@ class fullhunt(subdomain_enum_apikey):
         "description": "Query the fullhunt.io API for subdomains",
         "created_date": "2022-08-24",
         "author": "@TheTechromancer",
-        "auth_required": True,
     }
-    options = {"api_key": ""}
-    options_desc = {"api_key": "FullHunt API Key"}
+
+    class Config(BaseModuleConfig):
+        api_key: str | list[str] = Field("", description="FullHunt API Key", sensitive=True, mandatory=True)
 
     base_url = "https://fullhunt.io/api/v1"
 
diff --git a/bbot/modules/generic_ssrf.py b/bbot/modules/generic_ssrf.py
index 773965e617..66f2abaf7c 100644
--- a/bbot/modules/generic_ssrf.py
+++ b/bbot/modules/generic_ssrf.py
@@ -1,5 +1,6 @@
 from bbot.errors import InteractshError
 from bbot.modules.base import BaseModule
+from bbot.core.config.models import BaseModuleConfig, Field
 
 
 ssrf_params = [
@@ -158,12 +159,10 @@ class generic_ssrf(BaseModule):
     produced_events = ["FINDING"]
     flags = ["active", "invasive", "web-heavy"]
     meta = {"description": "Check for generic SSRFs", "created_date": "2022-07-30", "author": "@liquidsec"}
-    options = {
-        "skip_dns_interaction": False,
-    }
-    options_desc = {
-        "skip_dns_interaction": "Do not report DNS interactions (only HTTP interaction)",
-    }
+
+    class Config(BaseModuleConfig):
+        skip_dns_interaction: bool = Field(False, description="Do not report DNS interactions (only HTTP interaction)")
+
     in_scope_only = True
 
     async def setup(self):
diff --git a/bbot/modules/git_clone.py b/bbot/modules/git_clone.py
index ad4bbe40a5..38f946f334 100644
--- a/bbot/modules/git_clone.py
+++ b/bbot/modules/git_clone.py
@@ -1,6 +1,7 @@
 from pathlib import Path
 from subprocess import CalledProcessError
 from bbot.modules.templates.github import github
+from bbot.core.config.models import BaseModuleConfig, Field
 
 
 class git_clone(github):
@@ -12,11 +13,13 @@ class git_clone(github):
         "created_date": "2024-03-08",
         "author": "@domwhewell-sage",
     }
-    options = {"api_key": "", "output_folder": ""}
-    options_desc = {
-        "api_key": "Github token",
-        "output_folder": "Folder to clone repositories to. If not specified, cloned repositories will be deleted when the scan completes, to minimize disk usage.",
-    }
+
+    class Config(BaseModuleConfig):
+        api_key: str | list[str] = Field("", description="Github token", sensitive=True)
+        output_folder: str = Field(
+            "",
+            description="Folder to clone repositories to. If not specified, cloned repositories will be deleted when the scan completes, to minimize disk usage.",
+        )
 
     deps_apt = ["git"]
 
diff --git a/bbot/modules/gitdumper.py b/bbot/modules/gitdumper.py
index 9fe23a20af..62c6f4d288 100644
--- a/bbot/modules/gitdumper.py
+++ b/bbot/modules/gitdumper.py
@@ -2,6 +2,7 @@
 from pathlib import Path
 from subprocess import CalledProcessError
 from bbot.modules.base import BaseModule
+from bbot.core.config.models import BaseModuleConfig, Field
 
 
 class gitdumper(BaseModule):
@@ -13,16 +14,16 @@ class gitdumper(BaseModule):
         "created_date": "2025-02-11",
         "author": "@domwhewell-sage",
     }
-    options = {
-        "output_folder": "",
-        "fuzz_tags": False,
-        "max_semanic_version": 10,
-    }
-    options_desc = {
-        "output_folder": "Folder to download repositories to. If not specified, downloaded repositories will be deleted when the scan completes, to minimize disk usage.",
-        "fuzz_tags": "Fuzz for common git tag names (v0.0.1, 0.0.2, etc.) up to the max_semanic_version",
-        "max_semanic_version": "Maximum version number to fuzz for (default < v10.10.10)",
-    }
+
+    class Config(BaseModuleConfig):
+        output_folder: str = Field(
+            "",
+            description="Folder to download repositories to. If not specified, downloaded repositories will be deleted when the scan completes, to minimize disk usage.",
+        )
+        fuzz_tags: bool = Field(
+            False, description="Fuzz for common git tag names (v0.0.1, 0.0.2, etc.) up to the max_semanic_version"
+        )
+        max_semanic_version: int = Field(10, description="Maximum version number to fuzz for (default < v10.10.10)")
 
     scope_distance_modifier = 2
 
diff --git a/bbot/modules/github_codesearch.py b/bbot/modules/github_codesearch.py
index e5e941478b..538f159b2e 100644
--- a/bbot/modules/github_codesearch.py
+++ b/bbot/modules/github_codesearch.py
@@ -1,5 +1,6 @@
 from bbot.modules.templates.github import github
 from bbot.modules.templates.subdomain_enum import subdomain_enum
+from bbot.core.config.models import BaseModuleConfig, Field
 
 
 class github_codesearch(github, subdomain_enum):
@@ -10,10 +11,11 @@ class github_codesearch(github, subdomain_enum):
         "description": "Query Github's API for code containing the target domain name",
         "created_date": "2023-12-14",
         "author": "@domwhewell-sage",
-        "auth_required": True,
     }
-    options = {"api_key": "", "limit": 100}
-    options_desc = {"api_key": "Github token", "limit": "Limit code search to this many results"}
+
+    class Config(BaseModuleConfig):
+        api_key: str | list[str] = Field("", description="Github token", sensitive=True, mandatory=True)
+        limit: int = Field(100, description="Limit code search to this many results")
 
     github_raw_url = "https://raw.githubusercontent.com/"
 
diff --git a/bbot/modules/github_org.py b/bbot/modules/github_org.py
index 6225c21710..327bbfae0c 100644
--- a/bbot/modules/github_org.py
+++ b/bbot/modules/github_org.py
@@ -1,4 +1,5 @@
 from bbot.modules.templates.github import github
+from bbot.core.config.models import BaseModuleConfig, Field
 
 
 class github_org(github):
@@ -10,12 +11,11 @@ class github_org(github):
         "created_date": "2023-12-14",
         "author": "@domwhewell-sage",
     }
-    options = {"api_key": "", "include_members": True, "include_member_repos": False}
-    options_desc = {
-        "api_key": "Github token",
-        "include_members": "Enumerate organization members",
-        "include_member_repos": "Also enumerate organization members' repositories",
-    }
+
+    class Config(BaseModuleConfig):
+        api_key: str | list[str] = Field("", description="Github token", sensitive=True)
+        include_members: bool = Field(True, description="Enumerate organization members")
+        include_member_repos: bool = Field(False, description="Also enumerate organization members' repositories")
 
     scope_distance_modifier = 2
 
diff --git a/bbot/modules/github_usersearch.py b/bbot/modules/github_usersearch.py
index 5e330c3e07..27125e7ce7 100644
--- a/bbot/modules/github_usersearch.py
+++ b/bbot/modules/github_usersearch.py
@@ -1,5 +1,6 @@
 from bbot.modules.templates.github import github
 from bbot.modules.templates.subdomain_enum import subdomain_enum
+from bbot.core.config.models import BaseModuleConfig, Field
 
 
 class github_usersearch(github, subdomain_enum):
@@ -10,10 +11,10 @@ class github_usersearch(github, subdomain_enum):
         "description": "Query Github's API for users with emails matching in scope domains that may not be discoverable by listing members of the organization.",
         "created_date": "2025-05-10",
         "author": "@domwhewell-sage",
-        "auth_required": True,
     }
-    options = {"api_key": ""}
-    options_desc = {"api_key": "Github token"}
+
+    class Config(BaseModuleConfig):
+        api_key: str | list[str] = Field("", description="Github token", sensitive=True, mandatory=True)
 
     async def handle_event(self, event):
         self.verbose("Searching for users with emails matching in scope domains")
diff --git a/bbot/modules/github_workflows.py b/bbot/modules/github_workflows.py
index e64a303022..de786b3e89 100644
--- a/bbot/modules/github_workflows.py
+++ b/bbot/modules/github_workflows.py
@@ -3,6 +3,7 @@
 from pathlib import Path
 
 from bbot.modules.templates.github import github
+from bbot.core.config.models import BaseModuleConfig, Field
 
 
 class github_workflows(github):
@@ -13,19 +14,17 @@ class github_workflows(github):
         "description": "Download a github repositories workflow logs and workflow artifacts",
         "created_date": "2024-04-29",
         "author": "@domwhewell-sage",
-        "auth_required": True,
-    }
-    options = {"api_key": "", "num_logs": 1, "output_folder": ""}
-    options_desc = {
-        "api_key": "Github token",
-        "num_logs": "For each workflow fetch the last N successful runs logs (max 100)",
-        "output_folder": "Folder to download workflow logs and artifacts to",
     }
 
+    class Config(BaseModuleConfig):
+        api_key: str | list[str] = Field("", description="Github token", sensitive=True, mandatory=True)
+        num_logs: int = Field(1, description="For each workflow fetch the last N successful runs logs (max 100)")
+        output_folder: str = Field("", description="Folder to download workflow logs and artifacts to")
+
     scope_distance_modifier = 2
 
     async def setup(self):
-        self.num_logs = int(self.config.get("num_logs", 1))
+        self.num_logs = self.config.get("num_logs", 1)
         if self.num_logs > 100:
             self.log.error("num_logs option is capped at 100")
             return False
diff --git a/bbot/modules/gitlab_com.py b/bbot/modules/gitlab_com.py
index c72f94cb57..3dd521eca2 100644
--- a/bbot/modules/gitlab_com.py
+++ b/bbot/modules/gitlab_com.py
@@ -1,4 +1,5 @@
 from bbot.modules.templates.gitlab import GitLabBaseModule
+from bbot.core.config.models import BaseModuleConfig, Field
 
 
 class gitlab_com(GitLabBaseModule):
@@ -13,8 +14,10 @@ class gitlab_com(GitLabBaseModule):
         "author": "@TheTechromancer",
     }
 
-    options = {"api_key": ""}
-    options_desc = {"api_key": "GitLab access token (for gitlab.com/org only)"}
+    class Config(BaseModuleConfig):
+        api_key: str | list[str] = Field(
+            "", description="GitLab access token (for gitlab.com/org only)", sensitive=True
+        )
 
     # This is needed because we are consuming SOCIAL events, which aren't in scope
     scope_distance_modifier = 2
diff --git a/bbot/modules/gitlab_onprem.py b/bbot/modules/gitlab_onprem.py
index 26fbf0a917..b6751302f8 100644
--- a/bbot/modules/gitlab_onprem.py
+++ b/bbot/modules/gitlab_onprem.py
@@ -1,4 +1,5 @@
 from bbot.modules.templates.gitlab import GitLabBaseModule
+from bbot.core.config.models import BaseModuleConfig, Field
 
 
 class gitlab_onprem(GitLabBaseModule):
@@ -18,8 +19,10 @@ class gitlab_onprem(GitLabBaseModule):
 
     # Optional GitLab access token (only required for gitlab.com, but still
     # supported for on-prem installations that expose private projects).
-    options = {"api_key": ""}
-    options_desc = {"api_key": "GitLab access token (for self-hosted instances only)"}
+    class Config(BaseModuleConfig):
+        api_key: str | list[str] = Field(
+            "", description="GitLab access token (for self-hosted instances only)", sensitive=True
+        )
 
     # Allow accepting events slightly beyond configured max distance so we can
     # discover repos on neighbouring infrastructure.
diff --git a/bbot/modules/gowitness.py b/bbot/modules/gowitness.py
index a33527e503..4c5ed57b3e 100644
--- a/bbot/modules/gowitness.py
+++ b/bbot/modules/gowitness.py
@@ -9,6 +9,7 @@
 from shutil import copyfile, copymode
 
 from bbot.modules.base import BaseModule
+from bbot.core.config.models import BaseModuleConfig, Field
 
 
 class gowitness(BaseModule):
@@ -16,28 +17,20 @@ class gowitness(BaseModule):
     produced_events = ["WEBSCREENSHOT", "URL", "URL_UNVERIFIED", "TECHNOLOGY"]
     flags = ["safe", "active", "web-screenshots"]
     meta = {"description": "Take screenshots of webpages", "created_date": "2022-07-08", "author": "@TheTechromancer"}
-    options = {
-        "version": "3.1.1",
-        "threads": 0,
-        "timeout": 10,
-        "resolution_x": 1440,
-        "resolution_y": 900,
-        "output_path": "",
-        "social": False,
-        "idle_timeout": 1800,
-        "chrome_path": "",
-    }
-    options_desc = {
-        "version": "Gowitness version",
-        "threads": "How many gowitness threads to spawn (default is number of CPUs x 2)",
-        "timeout": "Preflight check timeout",
-        "resolution_x": "Screenshot resolution x",
-        "resolution_y": "Screenshot resolution y",
-        "output_path": "Where to save screenshots",
-        "social": "Whether to screenshot social media webpages",
-        "idle_timeout": "Skip the current gowitness batch if it stalls for longer than this many seconds",
-        "chrome_path": "Path to chrome executable",
-    }
+
+    class Config(BaseModuleConfig):
+        version: str = Field("3.1.1", description="Gowitness version")
+        threads: int = Field(0, description="How many gowitness threads to spawn (default is number of CPUs x 2)")
+        timeout: int = Field(10, description="Preflight check timeout")
+        resolution_x: int = Field(1440, description="Screenshot resolution x")
+        resolution_y: int = Field(900, description="Screenshot resolution y")
+        output_path: str = Field("", description="Where to save screenshots")
+        social: bool = Field(False, description="Whether to screenshot social media webpages")
+        idle_timeout: int = Field(
+            1800, description="Skip the current gowitness batch if it stalls for longer than this many seconds"
+        )
+        chrome_path: str = Field("", description="Path to chrome executable")
+
     deps_common = ["chromium"]
     deps_pip = ["aiosqlite"]
     deps_ansible = [
diff --git a/bbot/modules/graphql_introspection.py b/bbot/modules/graphql_introspection.py
index 5cfcb7c16c..58552651d1 100644
--- a/bbot/modules/graphql_introspection.py
+++ b/bbot/modules/graphql_introspection.py
@@ -1,6 +1,7 @@
 import json
 from pathlib import Path
 from bbot.modules.base import BaseModule
+from bbot.core.config.models import BaseModuleConfig, Field
 
 
 class graphql_introspection(BaseModule):
@@ -12,14 +13,12 @@ class graphql_introspection(BaseModule):
         "created_date": "2025-07-01",
         "author": "@mukesh-dream11",
     }
-    options = {
-        "graphql_endpoint_urls": ["/", "/graphql", "/v1/graphql"],
-        "output_folder": "",
-    }
-    options_desc = {
-        "graphql_endpoint_urls": "List of GraphQL endpoint to suffix to the target URL",
-        "output_folder": "Folder to save the GraphQL schemas to",
-    }
+
+    class Config(BaseModuleConfig):
+        graphql_endpoint_urls: list[str] = Field(
+            ["/", "/graphql", "/v1/graphql"], description="List of GraphQL endpoint to suffix to the target URL"
+        )
+        output_folder: str = Field("", description="Folder to save the GraphQL schemas to")
 
     async def setup(self):
         output_folder = self.config.get("output_folder", "")
diff --git a/bbot/modules/http.py b/bbot/modules/http.py
index 7aa24c7d08..4bbb04a275 100644
--- a/bbot/modules/http.py
+++ b/bbot/modules/http.py
@@ -6,6 +6,7 @@
 
 from bbot.core.helpers.web.web import iter_batch_results
 from bbot.modules.base import BaseModule
+from bbot.core.config.models import BaseModuleConfig, Field
 
 
 class http(BaseModule):
@@ -18,18 +19,11 @@ class http(BaseModule):
         "author": "@liquidsec",
     }
 
-    options = {
-        "threads": 50,
-        "in_scope_only": True,
-        "max_response_size": 5242880,
-        "store_responses": False,
-    }
-    options_desc = {
-        "threads": "Number of concurrent requests",
-        "in_scope_only": "Only visit web resources that are in scope.",
-        "max_response_size": "Max response size in bytes",
-        "store_responses": "Save raw HTTP responses to scan folder",
-    }
+    class Config(BaseModuleConfig):
+        threads: int = Field(50, description="Number of concurrent requests")
+        in_scope_only: bool = Field(True, description="Only visit web resources that are in scope.")
+        max_response_size: int = Field(5242880, description="Max response size in bytes")
+        store_responses: bool = Field(False, description="Save raw HTTP responses to scan folder")
 
     scope_distance_modifier = 2
     _shuffle_incoming_queue = False
diff --git a/bbot/modules/hunterio.py b/bbot/modules/hunterio.py
index f732addf3e..6e51a612e4 100644
--- a/bbot/modules/hunterio.py
+++ b/bbot/modules/hunterio.py
@@ -1,18 +1,15 @@
 from bbot.modules.templates.subdomain_enum import subdomain_enum_apikey
+from bbot.core.config.models import BaseModuleConfig, Field
 
 
 class hunterio(subdomain_enum_apikey):
     watched_events = ["DNS_NAME"]
     produced_events = ["EMAIL_ADDRESS", "DNS_NAME", "URL_UNVERIFIED"]
     flags = ["safe", "passive", "email-enum", "subdomain-enum"]
-    meta = {
-        "description": "Query hunter.io for emails",
-        "created_date": "2022-04-25",
-        "author": "@TheTechromancer",
-        "auth_required": True,
-    }
-    options = {"api_key": ""}
-    options_desc = {"api_key": "Hunter.IO API key"}
+    meta = {"description": "Query hunter.io for emails", "created_date": "2022-04-25", "author": "@TheTechromancer"}
+
+    class Config(BaseModuleConfig):
+        api_key: str | list[str] = Field("", description="Hunter.IO API key", sensitive=True, mandatory=True)
 
     base_url = "https://api.hunter.io/v2"
     ping_url = f"{base_url}/account?api_key={{api_key}}"
diff --git a/bbot/modules/iis_shortnames.py b/bbot/modules/iis_shortnames.py
index 339cdcb418..92b93d848a 100644
--- a/bbot/modules/iis_shortnames.py
+++ b/bbot/modules/iis_shortnames.py
@@ -1,6 +1,7 @@
 import re
 
 from bbot.modules.base import BaseModule
+from bbot.core.config.models import BaseModuleConfig, Field
 
 valid_chars = "ETAONRISHDLFCMUGYPWBVKJXQZ0123456789_-$~()&!#%'@^`{}]]"
 
@@ -22,12 +23,16 @@ class iis_shortnames(BaseModule):
         "created_date": "2022-04-15",
         "author": "@liquidsec",
     }
-    options = {"detect_only": True, "max_node_count": 50, "speculate_magic_urls": True}
-    options_desc = {
-        "detect_only": "Only detect the vulnerability and do not run the shortname scanner",
-        "max_node_count": "Limit how many nodes to attempt to resolve on any given recursion branch",
-        "speculate_magic_urls": "Attempt to discover iis 'magic' special folders",
-    }
+
+    class Config(BaseModuleConfig):
+        detect_only: bool = Field(
+            True, description="Only detect the vulnerability and do not run the shortname scanner"
+        )
+        max_node_count: int = Field(
+            50, description="Limit how many nodes to attempt to resolve on any given recursion branch"
+        )
+        speculate_magic_urls: bool = Field(True, description="Attempt to discover iis 'magic' special folders")
+
     in_scope_only = True
 
     _module_threads = 4
diff --git a/bbot/modules/internal/excavate.py b/bbot/modules/internal/excavate.py
index 7a097c4c2c..68c5facdb1 100644
--- a/bbot/modules/internal/excavate.py
+++ b/bbot/modules/internal/excavate.py
@@ -10,6 +10,7 @@
 from bbot.modules.base import BaseInterceptModule
 from bbot.modules.internal.base import BaseInternalModule
 from urllib.parse import urlparse, urljoin, parse_qs, urlunparse, urldefrag
+from bbot.core.config.models import BaseModuleConfig, Field
 
 
 def find_subclasses(obj, base_class):
@@ -335,16 +336,15 @@ class excavateTestRule(ExcavateRule):
         "author": "@liquidsec",
     }
 
-    options = {
-        "yara_max_match_data": 2000,
-        "custom_yara_rules": "",
-        "speculate_params": False,
-    }
-    options_desc = {
-        "yara_max_match_data": "Sets the maximum amount of text that can extracted from a YARA regex",
-        "custom_yara_rules": "Include custom Yara rules",
-        "speculate_params": "Enable speculative parameter extraction from JSON and XML content",
-    }
+    class Config(BaseModuleConfig):
+        yara_max_match_data: int = Field(
+            2000, description="Sets the maximum amount of text that can extracted from a YARA regex"
+        )
+        custom_yara_rules: str = Field("", description="Include custom Yara rules")
+        speculate_params: bool = Field(
+            False, description="Enable speculative parameter extraction from JSON and XML content"
+        )
+
     scope_distance_modifier = None
     accept_dupes = False
 
@@ -1040,7 +1040,7 @@ async def setup(self):
         ]
 
         self.parameter_extraction = bool(modules_WEB_PARAMETER)
-        self.speculate_params = bool(self.config.get("speculate_params", False))
+        self.speculate_params = self.config.get("speculate_params", False)
         self.remove_querystring = self.scan.config.get("url_querystring_remove", True)
 
         for module in self.scan.modules.values():
@@ -1067,7 +1067,7 @@ async def setup(self):
             p.lower() for p in self.scan.config.get("parameter_blacklist_prefixes", [])
         )
 
-        self.custom_yara_rules = str(self.config.get("custom_yara_rules", ""))
+        self.custom_yara_rules = self.config.get("custom_yara_rules", "")
         if self.custom_yara_rules:
             custom_rules_count = 0
             if Path(self.custom_yara_rules).is_file():
diff --git a/bbot/modules/internal/speculate.py b/bbot/modules/internal/speculate.py
index fb132e0147..7a3d87b36b 100644
--- a/bbot/modules/internal/speculate.py
+++ b/bbot/modules/internal/speculate.py
@@ -3,6 +3,7 @@
 
 from bbot.core.helpers import validators
 from bbot.modules.internal.base import BaseInternalModule
+from bbot.core.config.models import BaseModuleConfig, Field
 
 
 class speculate(BaseInternalModule):
@@ -32,12 +33,15 @@ class speculate(BaseInternalModule):
         "author": "@liquidsec",
     }
 
-    options = {"ip_range_max_hosts": 65536, "ports": "80,443", "essential_only": False}
-    options_desc = {
-        "ip_range_max_hosts": "Max number of hosts an IP_RANGE can contain to allow conversion into IP_ADDRESS events",
-        "ports": "The set of ports to speculate on",
-        "essential_only": "Only enable essential speculate features (no extra discovery)",
-    }
+    class Config(BaseModuleConfig):
+        ip_range_max_hosts: int = Field(
+            65536, description="Max number of hosts an IP_RANGE can contain to allow conversion into IP_ADDRESS events"
+        )
+        ports: str = Field("80,443", description="The set of ports to speculate on")
+        essential_only: bool = Field(
+            False, description="Only enable essential speculate features (no extra discovery)"
+        )
+
     scope_distance_modifier = 1
     _priority = 4
 
diff --git a/bbot/modules/ip2location.py b/bbot/modules/ip2location.py
index 80625f2852..309ff65df6 100644
--- a/bbot/modules/ip2location.py
+++ b/bbot/modules/ip2location.py
@@ -1,4 +1,5 @@
 from bbot.modules.base import BaseModule
+from bbot.core.config.models import BaseModuleConfig, Field
 
 
 class IP2Location(BaseModule):
@@ -13,13 +14,15 @@ class IP2Location(BaseModule):
         "description": "Query IP2location.io's API for geolocation information. ",
         "created_date": "2023-09-12",
         "author": "@TheTechromancer",
-        "auth_required": True,
-    }
-    options = {"api_key": "", "lang": ""}
-    options_desc = {
-        "api_key": "IP2location.io API Key",
-        "lang": "Translation information(ISO639-1). The translation is only applicable for continent, country, region and city name.",
     }
+
+    class Config(BaseModuleConfig):
+        api_key: str | list[str] = Field("", description="IP2location.io API Key", sensitive=True, mandatory=True)
+        lang: str = Field(
+            "",
+            description="Translation information(ISO639-1). The translation is only applicable for continent, country, region and city name.",
+        )
+
     scope_distance_modifier = 1
     _priority = 2
     suppress_dupes = False
diff --git a/bbot/modules/ipneighbor.py b/bbot/modules/ipneighbor.py
index f5f1007b00..518d5510f6 100644
--- a/bbot/modules/ipneighbor.py
+++ b/bbot/modules/ipneighbor.py
@@ -1,6 +1,7 @@
 import ipaddress
 
 from bbot.modules.base import BaseModule
+from bbot.core.config.models import BaseModuleConfig, Field
 
 
 class ipneighbor(BaseModule):
@@ -12,13 +13,15 @@ class ipneighbor(BaseModule):
         "created_date": "2022-06-08",
         "author": "@TheTechromancer",
     }
-    options = {"num_bits": 4}
-    options_desc = {"num_bits": "Netmask size (in CIDR notation) to check. Default is 4 bits (16 hosts)"}
+
+    class Config(BaseModuleConfig):
+        num_bits: int = Field(4, description="Netmask size (in CIDR notation) to check. Default is 4 bits (16 hosts)")
+
     scope_distance_modifier = 1
 
     async def setup(self):
         self.processed = set()
-        self.num_bits = max(1, int(self.config.get("num_bits", 4)))
+        self.num_bits = max(1, self.config.get("num_bits", 4))
         return True
 
     async def filter_event(self, event):
diff --git a/bbot/modules/ipstack.py b/bbot/modules/ipstack.py
index 6a00935f96..e7b0745e0d 100644
--- a/bbot/modules/ipstack.py
+++ b/bbot/modules/ipstack.py
@@ -1,4 +1,5 @@
 from bbot.modules.base import BaseModule
+from bbot.core.config.models import BaseModuleConfig, Field
 
 
 class Ipstack(BaseModule):
@@ -10,14 +11,11 @@ class Ipstack(BaseModule):
     watched_events = ["IP_ADDRESS"]
     produced_events = ["GEOLOCATION"]
     flags = ["safe", "passive"]
-    meta = {
-        "description": "Query IPStack's GeoIP API",
-        "created_date": "2022-11-26",
-        "author": "@tycoonslive",
-        "auth_required": True,
-    }
-    options = {"api_key": ""}
-    options_desc = {"api_key": "IPStack GeoIP API Key"}
+    meta = {"description": "Query IPStack's GeoIP API", "created_date": "2022-11-26", "author": "@tycoonslive"}
+
+    class Config(BaseModuleConfig):
+        api_key: str | list[str] = Field("", description="IPStack GeoIP API Key", sensitive=True, mandatory=True)
+
     scope_distance_modifier = 1
     _priority = 2
     suppress_dupes = False
diff --git a/bbot/modules/jadx.py b/bbot/modules/jadx.py
index d2f8437af6..b3a1d2cb12 100644
--- a/bbot/modules/jadx.py
+++ b/bbot/modules/jadx.py
@@ -1,6 +1,7 @@
 from pathlib import Path
 from subprocess import CalledProcessError
 from bbot.modules.internal.base import BaseModule
+from bbot.core.config.models import BaseModuleConfig, Field
 
 
 class jadx(BaseModule):
@@ -12,12 +13,10 @@ class jadx(BaseModule):
         "created_date": "2024-11-04",
         "author": "@domwhewell-sage",
     }
-    options = {
-        "threads": 4,
-    }
-    options_desc = {
-        "threads": "Maximum jadx threads for extracting apk's, default: 4",
-    }
+
+    class Config(BaseModuleConfig):
+        threads: int = Field(4, description="Maximum jadx threads for extracting apk's, default: 4")
+
     deps_common = ["java"]
     deps_ansible = [
         {
diff --git a/bbot/modules/kreuzberg.py b/bbot/modules/kreuzberg.py
index 373168180c..ea30b2b453 100644
--- a/bbot/modules/kreuzberg.py
+++ b/bbot/modules/kreuzberg.py
@@ -2,6 +2,7 @@
 from kreuzberg import extract_file
 
 from bbot.modules.base import BaseModule
+from bbot.core.config.models import BaseModuleConfig, Field
 
 
 class kreuzberg(BaseModule):
@@ -13,58 +14,58 @@ class kreuzberg(BaseModule):
         "created_date": "2024-06-03",
         "author": "@domwhewell-sage",
     }
-    options = {
-        "extensions": [
-            "bak",  #  Backup File
-            "bash",  #  Bash Script or Configuration
-            "bashrc",  #  Bash Script or Configuration
-            "conf",  #  Configuration File
-            "cfg",  #  Configuration File
-            "crt",  #  Certificate File
-            "csv",  #  Comma Separated Values File
-            "db",  #  SQLite Database File
-            "sqlite",  #  SQLite Database File
-            "doc",  #  Microsoft Word Document (Old Format)
-            "docx",  #  Microsoft Word Document
-            "ica",  #  Citrix Independent Computing Architecture File
-            "indd",  #  Adobe InDesign Document
-            "ini",  #  Initialization File
-            "json",  #  JSON File
-            "key",  #  Private Key File
-            "pub",  #  Public Key File
-            "log",  #  Log File
-            "markdown",  #  Markdown File
-            "md",  #  Markdown File
-            "odg",  #  OpenDocument Graphics (LibreOffice, OpenOffice)
-            "odp",  #  OpenDocument Presentation (LibreOffice, OpenOffice)
-            "ods",  #  OpenDocument Spreadsheet (LibreOffice, OpenOffice)
-            "odt",  #  OpenDocument Text (LibreOffice, OpenOffice)
-            "pdf",  #  Adobe Portable Document Format
-            "pem",  #  Privacy Enhanced Mail (SSL certificate)
-            "pps",  #  Microsoft PowerPoint Slideshow (Old Format)
-            "ppsx",  #  Microsoft PowerPoint Slideshow
-            "ppt",  #  Microsoft PowerPoint Presentation (Old Format)
-            "pptx",  #  Microsoft PowerPoint Presentation
-            "ps1",  #  PowerShell Script
-            "rdp",  #  Remote Desktop Protocol File
-            "rsa",  #  RSA Private Key File
-            "sh",  #  Shell Script
-            "sql",  #  SQL Database Dump
-            "swp",  #  Swap File (temporary file, often Vim)
-            "sxw",  #  OpenOffice.org Writer document
-            "txt",  #  Plain Text Document
-            "vbs",  #  Visual Basic Script
-            "wpd",  #  WordPerfect Document
-            "xls",  #  Microsoft Excel Spreadsheet (Old Format)
-            "xlsx",  #  Microsoft Excel Spreadsheet
-            "xml",  #  eXtensible Markup Language File
-            "yml",  #  YAML Ain't Markup Language
-            "yaml",  #  YAML Ain't Markup Language
-        ],
-    }
-    options_desc = {
-        "extensions": "File extensions to parse",
-    }
+
+    class Config(BaseModuleConfig):
+        extensions: list[str] = Field(
+            [
+                "bak",
+                "bash",
+                "bashrc",
+                "conf",
+                "cfg",
+                "crt",
+                "csv",
+                "db",
+                "sqlite",
+                "doc",
+                "docx",
+                "ica",
+                "indd",
+                "ini",
+                "json",
+                "key",
+                "pub",
+                "log",
+                "markdown",
+                "md",
+                "odg",
+                "odp",
+                "ods",
+                "odt",
+                "pdf",
+                "pem",
+                "pps",
+                "ppsx",
+                "ppt",
+                "pptx",
+                "ps1",
+                "rdp",
+                "rsa",
+                "sh",
+                "sql",
+                "swp",
+                "sxw",
+                "txt",
+                "vbs",
+                "wpd",
+                "xls",
+                "xlsx",
+                "xml",
+                "yml",
+                "yaml",
+            ],
+            description="File extensions to parse",
+        )
 
     deps_pip = ["kreuzberg>=4.3,<4.5", "pypdfium2~=5.0"]
     scope_distance_modifier = 1
diff --git a/bbot/modules/leakix.py b/bbot/modules/leakix.py
index d56c606ddc..ee25642c1b 100644
--- a/bbot/modules/leakix.py
+++ b/bbot/modules/leakix.py
@@ -1,13 +1,15 @@
 from bbot.modules.templates.subdomain_enum import subdomain_enum_apikey
+from bbot.core.config.models import BaseModuleConfig, Field
 
 
 class leakix(subdomain_enum_apikey):
     watched_events = ["DNS_NAME"]
     produced_events = ["DNS_NAME"]
     flags = ["safe", "subdomain-enum", "passive"]
-    options = {"api_key": ""}
-    # NOTE: API key is not required (but having one will get you more results)
-    options_desc = {"api_key": "LeakIX API Key"}
+
+    class Config(BaseModuleConfig):
+        api_key: str | list[str] = Field("", description="LeakIX API Key", sensitive=True, mandatory=True)
+
     meta = {
         "description": "Query leakix.net for subdomains",
         "created_date": "2022-07-11",
@@ -17,17 +19,9 @@ class leakix(subdomain_enum_apikey):
     base_url = "https://leakix.net"
     ping_url = f"{base_url}/host/1.1.1.1"
 
-    async def setup(self):
-        ret = await super(subdomain_enum_apikey, self).setup()
-        self.api_key = self.config.get("api_key", "")
-        if self.api_key:
-            return await self.require_api_key()
-        return ret
-
     def prepare_api_request(self, url, kwargs):
-        if self.api_key:
-            kwargs["headers"]["api-key"] = self.api_key
-            kwargs["headers"]["Accept"] = "application/json"
+        kwargs["headers"]["api-key"] = self.api_key
+        kwargs["headers"]["Accept"] = "application/json"
         return url, kwargs
 
     async def request_url(self, query):
diff --git a/bbot/modules/legba.py b/bbot/modules/legba.py
index 826366c6a1..221229641e 100644
--- a/bbot/modules/legba.py
+++ b/bbot/modules/legba.py
@@ -1,7 +1,9 @@
 import json
+from typing import Union
 from pathlib import Path
 from bbot.errors import WordlistError
 from bbot.modules.base import BaseModule
+from bbot.core.config.models import BaseModuleConfig, Field
 
 # key: <common-protocol-name> value: <legba-protocol-plugin-name>
 # List with `legba -L`
@@ -28,31 +30,38 @@ class legba(BaseModule):
     _module_threads = 25
     scope_distance_modifier = None
 
-    options = {
-        "ssh_wordlist": "https://raw.githubusercontent.com/danielmiessler/SecLists/refs/heads/master/Passwords/Default-Credentials/ssh-betterdefaultpasslist.txt",
-        "ftp_wordlist": "https://raw.githubusercontent.com/danielmiessler/SecLists/refs/heads/master/Passwords/Default-Credentials/ftp-betterdefaultpasslist.txt",
-        "telnet_wordlist": "https://raw.githubusercontent.com/danielmiessler/SecLists/refs/heads/master/Passwords/Default-Credentials/telnet-betterdefaultpasslist.txt",
-        "vnc_wordlist": "https://raw.githubusercontent.com/danielmiessler/SecLists/refs/heads/master/Passwords/Default-Credentials/vnc-betterdefaultpasslist.txt",
-        "mssql_wordlist": "https://raw.githubusercontent.com/danielmiessler/SecLists/refs/heads/master/Passwords/Default-Credentials/mssql-betterdefaultpasslist.txt",
-        "mysql_wordlist": "https://raw.githubusercontent.com/danielmiessler/SecLists/refs/heads/master/Passwords/Default-Credentials/mysql-betterdefaultpasslist.txt",
-        "postgresql_wordlist": "https://raw.githubusercontent.com/danielmiessler/SecLists/refs/heads/master/Passwords/Default-Credentials/postgres-betterdefaultpasslist.txt",
-        "concurrency": 3,
-        "rate_limit": 3,
-        "version": "1.1.1",
-    }
-
-    options_desc = {
-        "ssh_wordlist": "Wordlist for SSH combined username:password, newline separated. Accepts a URL or local file path, or a list of URLs/paths to merge multiple wordlists (duplicates removed).",
-        "ftp_wordlist": "Wordlist for FTP combined username:password, newline separated. Accepts a URL or local file path, or a list of URLs/paths to merge multiple wordlists (duplicates removed).",
-        "telnet_wordlist": "Wordlist for TELNET combined username:password, newline separated. Accepts a URL or local file path, or a list of URLs/paths to merge multiple wordlists (duplicates removed).",
-        "vnc_wordlist": "Wordlist for VNC passwords, newline separated. Accepts a URL or local file path, or a list of URLs/paths to merge multiple wordlists (duplicates removed).",
-        "mssql_wordlist": "Wordlist for MSSQL combined username:password, newline separated. Accepts a URL or local file path, or a list of URLs/paths to merge multiple wordlists (duplicates removed).",
-        "mysql_wordlist": "Wordlist for MySQL combined username:password, newline separated. Accepts a URL or local file path, or a list of URLs/paths to merge multiple wordlists (duplicates removed).",
-        "postgresql_wordlist": "Wordlist for PostgreSQL combined username:password, newline separated. Accepts a URL or local file path, or a list of URLs/paths to merge multiple wordlists (duplicates removed).",
-        "concurrency": "Number of concurrent workers, gets overridden for SSH",
-        "rate_limit": "Limit the number of requests per second, gets overridden for SSH",
-        "version": "legba version",
-    }
+    class Config(BaseModuleConfig):
+        ssh_wordlist: Union[str, list[str]] = Field(
+            "https://raw.githubusercontent.com/danielmiessler/SecLists/refs/heads/master/Passwords/Default-Credentials/ssh-betterdefaultpasslist.txt",
+            description="Wordlist for SSH combined username:password, newline separated. Accepts a URL or local file path, or a list of URLs/paths to merge multiple wordlists (duplicates removed).",
+        )
+        ftp_wordlist: Union[str, list[str]] = Field(
+            "https://raw.githubusercontent.com/danielmiessler/SecLists/refs/heads/master/Passwords/Default-Credentials/ftp-betterdefaultpasslist.txt",
+            description="Wordlist for FTP combined username:password, newline separated. Accepts a URL or local file path, or a list of URLs/paths to merge multiple wordlists (duplicates removed).",
+        )
+        telnet_wordlist: Union[str, list[str]] = Field(
+            "https://raw.githubusercontent.com/danielmiessler/SecLists/refs/heads/master/Passwords/Default-Credentials/telnet-betterdefaultpasslist.txt",
+            description="Wordlist for TELNET combined username:password, newline separated. Accepts a URL or local file path, or a list of URLs/paths to merge multiple wordlists (duplicates removed).",
+        )
+        vnc_wordlist: Union[str, list[str]] = Field(
+            "https://raw.githubusercontent.com/danielmiessler/SecLists/refs/heads/master/Passwords/Default-Credentials/vnc-betterdefaultpasslist.txt",
+            description="Wordlist for VNC passwords, newline separated. Accepts a URL or local file path, or a list of URLs/paths to merge multiple wordlists (duplicates removed).",
+        )
+        mssql_wordlist: Union[str, list[str]] = Field(
+            "https://raw.githubusercontent.com/danielmiessler/SecLists/refs/heads/master/Passwords/Default-Credentials/mssql-betterdefaultpasslist.txt",
+            description="Wordlist for MSSQL combined username:password, newline separated. Accepts a URL or local file path, or a list of URLs/paths to merge multiple wordlists (duplicates removed).",
+        )
+        mysql_wordlist: Union[str, list[str]] = Field(
+            "https://raw.githubusercontent.com/danielmiessler/SecLists/refs/heads/master/Passwords/Default-Credentials/mysql-betterdefaultpasslist.txt",
+            description="Wordlist for MySQL combined username:password, newline separated. Accepts a URL or local file path, or a list of URLs/paths to merge multiple wordlists (duplicates removed).",
+        )
+        postgresql_wordlist: Union[str, list[str]] = Field(
+            "https://raw.githubusercontent.com/danielmiessler/SecLists/refs/heads/master/Passwords/Default-Credentials/postgres-betterdefaultpasslist.txt",
+            description="Wordlist for PostgreSQL combined username:password, newline separated. Accepts a URL or local file path, or a list of URLs/paths to merge multiple wordlists (duplicates removed).",
+        )
+        concurrency: int = Field(3, description="Number of concurrent workers, gets overridden for SSH")
+        rate_limit: int = Field(3, description="Limit the number of requests per second, gets overridden for SSH")
+        version: str = Field("1.1.1", description="legba version")
 
     deps_ansible = [
         {
@@ -218,6 +227,11 @@ async def construct_command(self, host, port, protocol):
                 "1",
             ]
         else:
-            cmd += ["--rate-limit", self.config.rate_limit, "--concurrency", self.config.concurrency]
+            cmd += [
+                "--rate-limit",
+                str(self.config.get("rate_limit")),
+                "--concurrency",
+                str(self.config.get("concurrency")),
+            ]
 
         return cmd, output_path
diff --git a/bbot/modules/lightfuzz/lightfuzz.py b/bbot/modules/lightfuzz/lightfuzz.py
index 231081006f..b0f7012edf 100644
--- a/bbot/modules/lightfuzz/lightfuzz.py
+++ b/bbot/modules/lightfuzz/lightfuzz.py
@@ -2,6 +2,7 @@
 from bbot.modules.base import BaseModule
 
 from bbot.errors import InteractshError
+from bbot.core.config.models import BaseModuleConfig, Field
 
 
 class lightfuzz(BaseModule):
@@ -9,22 +10,26 @@ class lightfuzz(BaseModule):
     produced_events = ["FINDING"]
     flags = ["active", "loud", "web-heavy", "invasive"]
 
-    options = {
-        "force_common_headers": False,
-        "enabled_submodules": ["sqli", "cmdi", "xss", "path", "ssti", "crypto", "serial", "esi", "ssrf"],
-        "disable_post": False,
-        "try_post_as_get": False,
-        "try_get_as_post": False,
-        "avoid_wafs": True,
-    }
-    options_desc = {
-        "force_common_headers": "Force emit commonly exploitable parameters that may be difficult to detect",
-        "enabled_submodules": "A list of submodules to enable. Empty list enabled all modules.",
-        "disable_post": "Disable processing of POST parameters, avoiding form submissions.",
-        "try_post_as_get": "For each POSTPARAM, also fuzz it as a GETPARAM (in addition to normal POST fuzzing).",
-        "try_get_as_post": "For each GETPARAM, also fuzz it as a POSTPARAM (in addition to normal GET fuzzing).",
-        "avoid_wafs": "Avoid running against confirmed WAFs, which are likely to block lightfuzz requests",
-    }
+    class Config(BaseModuleConfig):
+        force_common_headers: bool = Field(
+            False, description="Force emit commonly exploitable parameters that may be difficult to detect"
+        )
+        enabled_submodules: list[str] = Field(
+            ["sqli", "cmdi", "xss", "path", "ssti", "crypto", "serial", "esi", "ssrf"],
+            description="A list of submodules to enable. Empty list enabled all modules.",
+        )
+        disable_post: bool = Field(
+            False, description="Disable processing of POST parameters, avoiding form submissions."
+        )
+        try_post_as_get: bool = Field(
+            False, description="For each POSTPARAM, also fuzz it as a GETPARAM (in addition to normal POST fuzzing)."
+        )
+        try_get_as_post: bool = Field(
+            False, description="For each GETPARAM, also fuzz it as a POSTPARAM (in addition to normal GET fuzzing)."
+        )
+        avoid_wafs: bool = Field(
+            True, description="Avoid running against confirmed WAFs, which are likely to block lightfuzz requests"
+        )
 
     meta = {
         "description": "Find Web Parameters and Lightly Fuzz them using a heuristic based scanner",
@@ -233,14 +238,19 @@ async def filter_event(self, event):
         return True
 
     @classmethod
-    def help_text(self):
+    def help_text(cls):
         # Call the base class help_text method
         base_help_text = super().help_text()
 
         import importlib
 
+        # classmethod: read defaults from the Config schema (instance config isn't available here)
+        default_submodules = cls.Config.model_fields["enabled_submodules"].get_default(call_default_factory=True)
+        if not isinstance(default_submodules, (list, tuple)):
+            default_submodules = []
+
         submodules = {}
-        for submodule_name in self.options.get("enabled_submodules", []):
+        for submodule_name in default_submodules:
             try:
                 submodule_module = importlib.import_module(f"bbot.modules.lightfuzz.submodules.{submodule_name}")
                 submodule_class = getattr(submodule_module, submodule_name)
diff --git a/bbot/modules/medusa.py b/bbot/modules/medusa.py
index d8a4c013c4..2be1333f9c 100644
--- a/bbot/modules/medusa.py
+++ b/bbot/modules/medusa.py
@@ -1,5 +1,8 @@
 import re
+from typing import Union
+
 from bbot.modules.base import BaseModule
+from bbot.core.config.models import BaseModuleConfig, Field
 
 
 class medusa(BaseModule):
@@ -14,21 +17,22 @@ class medusa(BaseModule):
     }
     scope_distance_modifier = None
 
-    options = {
-        "snmp_wordlist": "https://raw.githubusercontent.com/danielmiessler/SecLists/refs/heads/master/Discovery/SNMP/common-snmp-community-strings.txt",
-        "snmp_versions": ["1", "2C"],  # Only 1 and 2C are available with medusa 2.3.
-        "wait_microseconds": 200,
-        "timeout_s": 5,
-        "threads": 5,
-    }
-
-    options_desc = {
-        "snmp_wordlist": "Wordlist url for SNMP community strings, newline separated (default https://raw.githubusercontent.com/danielmiessler/SecLists/refs/heads/master/Discovery/SNMP/snmp.txt). Accepts a list of URLs/paths to merge multiple wordlists (duplicates are removed).",
-        "snmp_versions": "List of SNMP versions to attempt against the SNMP server (default ['1', '2C'])",
-        "wait_microseconds": "Wait time after every SNMP request in microseconds (default 200)",
-        "timeout_s": "Wait time for the SNMP response(s) once at the end of all attempts (default 5)",
-        "threads": "Number of communities to be tested concurrently (default 5)",
-    }
+    class Config(BaseModuleConfig):
+        snmp_wordlist: Union[str, list[str]] = Field(
+            "https://raw.githubusercontent.com/danielmiessler/SecLists/refs/heads/master/Discovery/SNMP/common-snmp-community-strings.txt",
+            description="Wordlist url for SNMP community strings, newline separated (default https://raw.githubusercontent.com/danielmiessler/SecLists/refs/heads/master/Discovery/SNMP/snmp.txt). Accepts a list of URLs/paths to merge multiple wordlists (duplicates are removed).",
+        )
+        # Only 1 and 2C are available with medusa 2.3.
+        snmp_versions: list[str] = Field(
+            ["1", "2C"], description="List of SNMP versions to attempt against the SNMP server (default ['1', '2C'])"
+        )
+        wait_microseconds: int = Field(
+            200, description="Wait time after every SNMP request in microseconds (default 200)"
+        )
+        timeout_s: int = Field(
+            5, description="Wait time for the SNMP response(s) once at the end of all attempts (default 5)"
+        )
+        threads: int = Field(5, description="Number of communities to be tested concurrently (default 5)")
 
     deps_ansible = [
         {
diff --git a/bbot/modules/ntlm.py b/bbot/modules/ntlm.py
index 4478b1c482..f42c28e7af 100644
--- a/bbot/modules/ntlm.py
+++ b/bbot/modules/ntlm.py
@@ -1,5 +1,6 @@
 from bbot.errors import NTLMError
 from bbot.modules.base import BaseModule
+from bbot.core.config.models import BaseModuleConfig, Field
 
 ntlm_discovery_endpoints = [
     "",
@@ -74,8 +75,9 @@ class ntlm(BaseModule):
         "created_date": "2022-07-25",
         "author": "@liquidsec",
     }
-    options = {"try_all": False}
-    options_desc = {"try_all": "Try every NTLM endpoint"}
+
+    class Config(BaseModuleConfig):
+        try_all: bool = Field(False, description="Try every NTLM endpoint")
 
     in_scope_only = True
 
diff --git a/bbot/modules/nuclei.py b/bbot/modules/nuclei.py
index 85f8342e64..718ebe8d52 100644
--- a/bbot/modules/nuclei.py
+++ b/bbot/modules/nuclei.py
@@ -3,9 +3,11 @@
 import os
 import shutil
 import yaml
+from typing import Literal
 from itertools import islice
 
 from bbot.modules.base import BaseModule
+from bbot.core.config.models import BaseModuleConfig, Field
 
 
 class nuclei(BaseModule):
@@ -18,38 +20,31 @@ class nuclei(BaseModule):
         "author": "@TheTechromancer",
     }
 
-    options = {
-        "version": "3.8.0",
-        "tags": "",
-        "templates": "",
-        "severity": "",
-        "ratelimit": 150,
-        "concurrency": 25,
-        "mode": "manual",
-        "etags": "",
-        "budget": 1,
-        "silent": False,
-        "directory_only": True,
-        "retries": 0,
-        "batch_size": 200,
-        "module_timeout": 21600,  # 6 hours
-    }
-    options_desc = {
-        "version": "nuclei version",
-        "tags": "execute a subset of templates that contain the provided tags",
-        "templates": "template or template directory paths to include in the scan",
-        "severity": "Filter based on severity field available in the template.",
-        "ratelimit": "maximum number of requests to send per second (default 150)",
-        "concurrency": "maximum number of templates to be executed in parallel (default 25)",
-        "mode": "manual | technology | severe | budget. Technology: Only activate based on technology events that match nuclei tags (nuclei -as mode). Manual (DEFAULT): Fully manual settings. Severe: Only critical and high severity templates without intrusive. Budget: Limit Nuclei to a specified number of HTTP requests",
-        "etags": "tags to exclude from the scan",
-        "budget": "Used in budget mode to set the number of allowed requests per host",
-        "silent": "Don't display nuclei's banner or status messages",
-        "directory_only": "Filter out 'file' URL event (default True)",
-        "retries": "number of times to retry a failed request (default 0)",
-        "batch_size": "Number of targets to send to Nuclei per batch (default 200)",
-        "module_timeout": "Max time in seconds to spend handling each batch of events",
-    }
+    class Config(BaseModuleConfig):
+        version: str = Field("3.8.0", description="nuclei version")
+        tags: str = Field("", description="execute a subset of templates that contain the provided tags")
+        templates: str = Field("", description="template or template directory paths to include in the scan")
+        severity: str = Field("", description="Filter based on severity field available in the template.")
+        ratelimit: int = Field(150, description="maximum number of requests to send per second (default 150)")
+        concurrency: int = Field(25, description="maximum number of templates to be executed in parallel (default 25)")
+        mode: Literal["manual", "technology", "severe", "budget"] = Field(
+            "manual",
+            description=(
+                "manual | technology | severe | budget. "
+                "Technology: Only activate based on technology events that match nuclei tags (nuclei -as mode). "
+                "Manual (DEFAULT): Fully manual settings. "
+                "Severe: Only critical and high severity templates without intrusive. "
+                "Budget: Limit Nuclei to a specified number of HTTP requests"
+            ),
+        )
+        etags: str = Field("", description="tags to exclude from the scan")
+        budget: int = Field(1, description="Used in budget mode to set the number of allowed requests per host")
+        silent: bool = Field(False, description="Don't display nuclei's banner or status messages")
+        directory_only: bool = Field(True, description="Filter out 'file' URL event (default True)")
+        retries: int = Field(0, description="number of times to retry a failed request (default 0)")
+        batch_size: int = Field(200, description="Number of targets to send to Nuclei per batch (default 200)")
+        module_timeout: int = Field(21600, description="Max time in seconds to spend handling each batch of events")
+
     deps_ansible = [
         {
             "name": "Download nuclei",
@@ -88,11 +83,11 @@ async def setup(self):
             if not self._templates_installed():
                 return False, "Failed to install nuclei templates after retry"
         self.proxy = self.scan.web_config.get("http_proxy", "")
-        self.mode = self.config.get("mode", "severe").lower()
-        self.ratelimit = int(self.config.get("ratelimit", 150))
-        self.concurrency = int(self.config.get("concurrency", 25))
-        self.budget = int(self.config.get("budget", 1))
-        self.silent = self.config.get("silent", False)
+        self.mode = self.config.get("mode")
+        self.ratelimit = self.config.get("ratelimit")
+        self.concurrency = self.config.get("concurrency")
+        self.budget = self.config.get("budget")
+        self.silent = self.config.get("silent")
         self.templates = self.config.get("templates")
         if self.templates:
             self.info(f"Using custom template(s) at: [{self.templates}]")
@@ -107,11 +102,7 @@ async def setup(self):
             self.info(f"Limiting nuclei templates to the following severities: [{self.severity}]")
         self.iserver = self.scan.config.get("interactsh_server", None)
         self.itoken = self.scan.config.get("interactsh_token", None)
-        self.retries = int(self.config.get("retries", 0))
-
-        if self.mode not in ("technology", "severe", "manual", "budget"):
-            self.warning(f"Unable to initialize nuclei: invalid mode selected: [{self.mode}]")
-            return False
+        self.retries = self.config.get("retries")
 
         if self.mode == "technology":
             self.info(
diff --git a/bbot/modules/oauth.py b/bbot/modules/oauth.py
index 7bcbc972fa..4033d84e77 100644
--- a/bbot/modules/oauth.py
+++ b/bbot/modules/oauth.py
@@ -1,6 +1,7 @@
 from bbot.core.helpers.regexes import url_regexes
 
 from .base import BaseModule
+from bbot.core.config.models import BaseModuleConfig, Field
 
 
 class OAUTH(BaseModule):
@@ -12,8 +13,9 @@ class OAUTH(BaseModule):
         "created_date": "2023-07-12",
         "author": "@TheTechromancer",
     }
-    options = {"try_all": False}
-    options_desc = {"try_all": "Check for OAUTH/IODC on every subdomain and URL."}
+
+    class Config(BaseModuleConfig):
+        try_all: bool = Field(False, description="Check for OAUTH/IODC on every subdomain and URL.")
 
     in_scope_only = False
     scope_distance_modifier = 1
diff --git a/bbot/modules/otx.py b/bbot/modules/otx.py
index a22a5636b5..d126f6ccc9 100644
--- a/bbot/modules/otx.py
+++ b/bbot/modules/otx.py
@@ -1,4 +1,5 @@
 from bbot.modules.templates.subdomain_enum import subdomain_enum_apikey
+from bbot.core.config.models import BaseModuleConfig, Field
 
 
 class otx(subdomain_enum_apikey):
@@ -9,10 +10,10 @@ class otx(subdomain_enum_apikey):
         "description": "Query otx.alienvault.com for subdomains",
         "created_date": "2022-08-24",
         "author": "@TheTechromancer",
-        "auth_required": True,
     }
-    options = {"api_key": ""}
-    options_desc = {"api_key": "OTX API key"}
+
+    class Config(BaseModuleConfig):
+        api_key: str | list[str] = Field("", description="OTX API key", sensitive=True, mandatory=True)
 
     base_url = "https://otx.alienvault.com"
 
diff --git a/bbot/modules/output/asset_inventory.py b/bbot/modules/output/asset_inventory.py
index bd3b54370b..61229dbeab 100644
--- a/bbot/modules/output/asset_inventory.py
+++ b/bbot/modules/output/asset_inventory.py
@@ -4,6 +4,7 @@
 
 from .csv import CSV
 from bbot.core.helpers.misc import make_ip_type, is_ip, is_port, best_http_status
+from bbot.core.config.models import BaseModuleConfig, Field
 
 severity_map = {
     "INFO": 0,
@@ -37,13 +38,18 @@ class asset_inventory(CSV):
         "created_date": "2022-09-30",
         "author": "@liquidsec",
     }
-    options = {"output_file": "", "use_previous": False, "recheck": False, "summary_netmask": 16}
-    options_desc = {
-        "output_file": "Set a custom output file",
-        "use_previous": "Emit previous asset inventory as new events (use in conjunction with -n <old_scan_name>)",
-        "recheck": "When use_previous=True, don't retain past details like open ports or findings. Instead, allow them to be rediscovered by the new scan",
-        "summary_netmask": "Subnet mask to use when summarizing IP addresses at end of scan",
-    }
+
+    class Config(BaseModuleConfig):
+        output_file: str = Field("", description="Set a custom output file")
+        use_previous: bool = Field(
+            False,
+            description="Emit previous asset inventory as new events (use in conjunction with -n <old_scan_name>)",
+        )
+        recheck: bool = Field(
+            False,
+            description="When use_previous=True, don't retain past details like open ports or findings. Instead, allow them to be rediscovered by the new scan",
+        )
+        summary_netmask: int = Field(16, description="Subnet mask to use when summarizing IP addresses at end of scan")
 
     header_row = [
         "Host",
diff --git a/bbot/modules/output/csv.py b/bbot/modules/output/csv.py
index 9b7d4b4bd9..3a30650b53 100644
--- a/bbot/modules/output/csv.py
+++ b/bbot/modules/output/csv.py
@@ -2,13 +2,15 @@
 from contextlib import suppress
 
 from bbot.modules.output.base import BaseOutputModule
+from bbot.core.config.models import BaseModuleConfig, Field
 
 
 class CSV(BaseOutputModule):
     watched_events = ["*"]
     meta = {"description": "Output to CSV", "created_date": "2022-04-07", "author": "@TheTechromancer"}
-    options = {"output_file": ""}
-    options_desc = {"output_file": "Output to CSV file"}
+
+    class Config(BaseModuleConfig):
+        output_file: str = Field("", description="Output to CSV file")
 
     header_row = [
         "Event type",
diff --git a/bbot/modules/output/discord.py b/bbot/modules/output/discord.py
index 934d89e670..82656e0e30 100644
--- a/bbot/modules/output/discord.py
+++ b/bbot/modules/output/discord.py
@@ -1,4 +1,5 @@
 from bbot.modules.templates.webhook import WebhookOutputModule
+from bbot.core.config.models import BaseModuleConfig, Field
 
 
 class Discord(WebhookOutputModule):
@@ -8,10 +9,9 @@ class Discord(WebhookOutputModule):
         "created_date": "2023-08-14",
         "author": "@TheTechromancer",
     }
-    options = {"webhook_url": "", "event_types": ["FINDING"], "min_severity": "LOW", "retries": 10}
-    options_desc = {
-        "webhook_url": "Discord webhook URL",
-        "event_types": "Types of events to send",
-        "min_severity": "Only allow FINDING events of this severity or higher",
-        "retries": "Number of times to retry sending the message before skipping the event",
-    }
+
+    class Config(BaseModuleConfig):
+        webhook_url: str = Field("", description="Discord webhook URL", sensitive=True)
+        event_types: list[str] = Field(["FINDING"], description="Types of events to send")
+        min_severity: str = Field("LOW", description="Only allow FINDING events of this severity or higher")
+        retries: int = Field(10, description="Number of times to retry sending the message before skipping the event")
diff --git a/bbot/modules/output/elastic.py b/bbot/modules/output/elastic.py
index 317eebc3a1..768a48bb6d 100644
--- a/bbot/modules/output/elastic.py
+++ b/bbot/modules/output/elastic.py
@@ -1,4 +1,5 @@
 from .webhook import webhook
+from bbot.core.config.models import BaseModuleConfig, Field
 
 
 class Elastic(webhook):
@@ -12,18 +13,16 @@ class Elastic(webhook):
         "created_date": "2022-11-21",
         "author": "@TheTechromancer",
     }
-    options = {
-        "url": "https://localhost:9200/bbot_events/_doc",
-        "username": "elastic",
-        "password": "bbotislife",
-        "timeout": 10,
-    }
-    options_desc = {
-        "url": "Elastic URL (e.g. https://localhost:9200/<your_index>/_doc)",
-        "username": "Elastic username",
-        "password": "Elastic password",
-        "timeout": "HTTP timeout",
-    }
+
+    class Config(BaseModuleConfig):
+        url: str = Field(
+            "https://localhost:9200/bbot_events/_doc",
+            description="Elastic URL (e.g. https://localhost:9200/<your_index>/_doc)",
+            sensitive=True,
+        )
+        username: str = Field("elastic", description="Elastic username", sensitive=True)
+        password: str = Field("bbotislife", description="Elastic password", sensitive=True)
+        timeout: int = Field(10, description="HTTP timeout")
 
     async def cleanup(self):
         # refresh the index
diff --git a/bbot/modules/output/emails.py b/bbot/modules/output/emails.py
index 6bfe940689..1eb1718181 100644
--- a/bbot/modules/output/emails.py
+++ b/bbot/modules/output/emails.py
@@ -1,5 +1,6 @@
 from bbot.modules.output.txt import TXT
 from bbot.modules.base import BaseModule
+from bbot.core.config.models import BaseModuleConfig, Field
 
 
 class Emails(TXT):
@@ -10,8 +11,10 @@ class Emails(TXT):
         "created_date": "2023-12-23",
         "author": "@domwhewell-sage",
     }
-    options = {"output_file": ""}
-    options_desc = {"output_file": "Output to file"}
+
+    class Config(BaseModuleConfig):
+        output_file: str = Field("", description="Output to file")
+
     in_scope_only = True
     accept_dupes = False
 
diff --git a/bbot/modules/output/json.py b/bbot/modules/output/json.py
index b93d1e4e3f..7ac7c33c56 100644
--- a/bbot/modules/output/json.py
+++ b/bbot/modules/output/json.py
@@ -2,6 +2,7 @@
 from contextlib import suppress
 
 from bbot.modules.output.base import BaseOutputModule
+from bbot.core.config.models import BaseModuleConfig, Field
 
 
 class JSON(BaseOutputModule):
@@ -11,10 +12,10 @@ class JSON(BaseOutputModule):
         "created_date": "2022-04-07",
         "author": "@TheTechromancer",
     }
-    options = {"output_file": ""}
-    options_desc = {
-        "output_file": "Output to file",
-    }
+
+    class Config(BaseModuleConfig):
+        output_file: str = Field("", description="Output to file")
+
     _preserve_graph = True
 
     async def setup(self):
diff --git a/bbot/modules/output/kafka.py b/bbot/modules/output/kafka.py
index 01eeeb2fd6..101a38f59f 100644
--- a/bbot/modules/output/kafka.py
+++ b/bbot/modules/output/kafka.py
@@ -2,6 +2,7 @@
 from aiokafka import AIOKafkaProducer
 
 from bbot.modules.output.base import BaseOutputModule
+from bbot.core.config.models import BaseModuleConfig, Field
 
 
 class Kafka(BaseOutputModule):
@@ -11,14 +12,13 @@ class Kafka(BaseOutputModule):
         "created_date": "2024-11-22",
         "author": "@TheTechromancer",
     }
-    options = {
-        "bootstrap_servers": "localhost:9092",
-        "topic": "bbot_events",
-    }
-    options_desc = {
-        "bootstrap_servers": "A comma-separated list of Kafka server addresses",
-        "topic": "The Kafka topic to publish events to",
-    }
+
+    class Config(BaseModuleConfig):
+        bootstrap_servers: str = Field(
+            "localhost:9092", description="A comma-separated list of Kafka server addresses"
+        )
+        topic: str = Field("bbot_events", description="The Kafka topic to publish events to")
+
     deps_pip = ["aiokafka~=0.12.0"]
 
     async def setup(self):
diff --git a/bbot/modules/output/mongo.py b/bbot/modules/output/mongo.py
index 833eab2304..13f3e09fed 100644
--- a/bbot/modules/output/mongo.py
+++ b/bbot/modules/output/mongo.py
@@ -4,6 +4,7 @@
 
 from bbot.models.pydantic import Event, Scan, Target
 from bbot.modules.output.base import BaseOutputModule
+from bbot.core.config.models import BaseModuleConfig, Field
 
 
 class Mongo(BaseOutputModule):
@@ -17,20 +18,14 @@ class Mongo(BaseOutputModule):
         "created_date": "2024-11-17",
         "author": "@TheTechromancer",
     }
-    options = {
-        "uri": "mongodb://localhost:27017",
-        "database": "bbot",
-        "username": "",
-        "password": "",
-        "collection_prefix": "",
-    }
-    options_desc = {
-        "uri": "The URI of the MongoDB server",
-        "database": "The name of the database to use",
-        "username": "The username to use to connect to the database",
-        "password": "The password to use to connect to the database",
-        "collection_prefix": "Prefix the name of each collection with this string",
-    }
+
+    class Config(BaseModuleConfig):
+        uri: str = Field("mongodb://localhost:27017", description="The URI of the MongoDB server", sensitive=True)
+        database: str = Field("bbot", description="The name of the database to use")
+        username: str = Field("", description="The username to use to connect to the database", sensitive=True)
+        password: str = Field("", description="The password to use to connect to the database", sensitive=True)
+        collection_prefix: str = Field("", description="Prefix the name of each collection with this string")
+
     deps_pip = ["pymongo~=4.15"]
 
     async def setup(self):
diff --git a/bbot/modules/output/mysql.py b/bbot/modules/output/mysql.py
index 8d9a1f7f4c..b09d101b48 100644
--- a/bbot/modules/output/mysql.py
+++ b/bbot/modules/output/mysql.py
@@ -1,4 +1,5 @@
 from bbot.modules.templates.sql import SQLTemplate
+from bbot.core.config.models import BaseModuleConfig, Field
 
 
 class MySQL(SQLTemplate):
@@ -8,20 +9,17 @@ class MySQL(SQLTemplate):
         "created_date": "2024-11-13",
         "author": "@TheTechromancer",
     }
-    options = {
-        "username": "root",
-        "password": "bbotislife",
-        "host": "localhost",
-        "port": 3306,
-        "database": "bbot",
-    }
-    options_desc = {
-        "username": "The username to connect to MySQL",
-        "password": "The password to connect to MySQL",
-        "host": "The server running MySQL",
-        "port": "The port to connect to MySQL",
-        "database": "The database name to connect to",
-    }
+
+    class Config(BaseModuleConfig):
+        username: str = Field("root", description="The username to connect to MySQL", sensitive=True)
+        password: str = Field("bbotislife", description="The password to connect to MySQL", sensitive=True)
+        host: str = Field("localhost", description="The server running MySQL")
+        port: int = Field(3306, description="The port to connect to MySQL")
+        database: str = Field("bbot", description="The database name to connect to")
+        retries: int = Field(
+            10, description="Number of times to retry connecting to the database (1 second between retries)"
+        )
+
     deps_pip = ["sqlmodel", "aiomysql"]
     protocol = "mysql+aiomysql"
 
diff --git a/bbot/modules/output/nats.py b/bbot/modules/output/nats.py
index 569645cc3b..b699f20d80 100644
--- a/bbot/modules/output/nats.py
+++ b/bbot/modules/output/nats.py
@@ -1,6 +1,7 @@
 import json
 import nats
 from bbot.modules.output.base import BaseOutputModule
+from bbot.core.config.models import BaseModuleConfig, Field
 
 
 class NATS(BaseOutputModule):
@@ -10,14 +11,11 @@ class NATS(BaseOutputModule):
         "created_date": "2024-11-22",
         "author": "@TheTechromancer",
     }
-    options = {
-        "servers": [],
-        "subject": "bbot_events",
-    }
-    options_desc = {
-        "servers": "A list of NATS server addresses",
-        "subject": "The NATS subject to publish events to",
-    }
+
+    class Config(BaseModuleConfig):
+        servers: list = Field([], description="A list of NATS server addresses")
+        subject: str = Field("bbot_events", description="The NATS subject to publish events to")
+
     deps_pip = ["nats-py"]
 
     async def setup(self):
diff --git a/bbot/modules/output/neo4j.py b/bbot/modules/output/neo4j.py
index 28248296e8..290f6bdf92 100644
--- a/bbot/modules/output/neo4j.py
+++ b/bbot/modules/output/neo4j.py
@@ -4,6 +4,7 @@
 from neo4j import AsyncGraphDatabase
 
 from bbot.modules.output.base import BaseOutputModule
+from bbot.core.config.models import BaseModuleConfig, Field
 
 
 # silence annoying neo4j logger
@@ -33,12 +34,12 @@ class neo4j(BaseOutputModule):
 
     watched_events = ["*"]
     meta = {"description": "Output to Neo4j", "created_date": "2022-04-07", "author": "@TheTechromancer"}
-    options = {"uri": "bolt://localhost:7687", "username": "neo4j", "password": "bbotislife"}
-    options_desc = {
-        "uri": "Neo4j server + port",
-        "username": "Neo4j username",
-        "password": "Neo4j password",
-    }
+
+    class Config(BaseModuleConfig):
+        uri: str = Field("bolt://localhost:7687", description="Neo4j server + port", sensitive=True)
+        username: str = Field("neo4j", description="Neo4j username", sensitive=True)
+        password: str = Field("bbotislife", description="Neo4j password", sensitive=True)
+
     deps_pip = ["neo4j"]
     _batch_size = 500
     _preserve_graph = True
@@ -46,11 +47,8 @@ class neo4j(BaseOutputModule):
     async def setup(self):
         try:
             self.driver = AsyncGraphDatabase.driver(
-                uri=self.config.get("uri", self.options["uri"]),
-                auth=(
-                    self.config.get("username", self.options["username"]),
-                    self.config.get("password", self.options["password"]),
-                ),
+                uri=self.config.get("uri"),
+                auth=(self.config.get("username"), self.config.get("password")),
             )
             self.session = self.driver.session()
             await self.session.run("Match () Return 1 Limit 1")
diff --git a/bbot/modules/output/postgres.py b/bbot/modules/output/postgres.py
index 45beb7c7bc..a94ade61b8 100644
--- a/bbot/modules/output/postgres.py
+++ b/bbot/modules/output/postgres.py
@@ -1,4 +1,5 @@
 from bbot.modules.templates.sql import SQLTemplate
+from bbot.core.config.models import BaseModuleConfig, Field
 
 
 class Postgres(SQLTemplate):
@@ -8,20 +9,17 @@ class Postgres(SQLTemplate):
         "created_date": "2024-11-08",
         "author": "@TheTechromancer",
     }
-    options = {
-        "username": "postgres",
-        "password": "bbotislife",
-        "host": "localhost",
-        "port": 5432,
-        "database": "bbot",
-    }
-    options_desc = {
-        "username": "The username to connect to Postgres",
-        "password": "The password to connect to Postgres",
-        "host": "The server running Postgres",
-        "port": "The port to connect to Postgres",
-        "database": "The database name to connect to",
-    }
+
+    class Config(BaseModuleConfig):
+        username: str = Field("postgres", description="The username to connect to Postgres", sensitive=True)
+        password: str = Field("bbotislife", description="The password to connect to Postgres", sensitive=True)
+        host: str = Field("localhost", description="The server running Postgres")
+        port: int = Field(5432, description="The port to connect to Postgres")
+        database: str = Field("bbot", description="The database name to connect to")
+        retries: int = Field(
+            10, description="Number of times to retry connecting to the database (1 second between retries)"
+        )
+
     deps_pip = ["sqlmodel", "asyncpg"]
     protocol = "postgresql+asyncpg"
 
diff --git a/bbot/modules/output/rabbitmq.py b/bbot/modules/output/rabbitmq.py
index 3d8b470a37..f2f6150870 100644
--- a/bbot/modules/output/rabbitmq.py
+++ b/bbot/modules/output/rabbitmq.py
@@ -2,6 +2,7 @@
 import aio_pika
 
 from bbot.modules.output.base import BaseOutputModule
+from bbot.core.config.models import BaseModuleConfig, Field
 
 
 class RabbitMQ(BaseOutputModule):
@@ -11,14 +12,11 @@ class RabbitMQ(BaseOutputModule):
         "created_date": "2024-11-22",
         "author": "@TheTechromancer",
     }
-    options = {
-        "url": "amqp://guest:guest@localhost/",
-        "queue": "bbot_events",
-    }
-    options_desc = {
-        "url": "The RabbitMQ connection URL",
-        "queue": "The RabbitMQ queue to publish events to",
-    }
+
+    class Config(BaseModuleConfig):
+        url: str = Field("amqp://guest:guest@localhost/", description="The RabbitMQ connection URL", sensitive=True)
+        queue: str = Field("bbot_events", description="The RabbitMQ queue to publish events to")
+
     deps_pip = ["aio_pika~=9.5.0"]
 
     async def setup(self):
diff --git a/bbot/modules/output/slack.py b/bbot/modules/output/slack.py
index 299d7334cf..3b80daf9e1 100644
--- a/bbot/modules/output/slack.py
+++ b/bbot/modules/output/slack.py
@@ -1,6 +1,7 @@
 import yaml
 
 from bbot.modules.templates.webhook import WebhookOutputModule
+from bbot.core.config.models import BaseModuleConfig, Field
 
 
 class Slack(WebhookOutputModule):
@@ -10,13 +11,13 @@ class Slack(WebhookOutputModule):
         "created_date": "2023-08-14",
         "author": "@TheTechromancer",
     }
-    options = {"webhook_url": "", "event_types": ["FINDING"], "min_severity": "LOW", "retries": 10}
-    options_desc = {
-        "webhook_url": "Discord webhook URL",
-        "event_types": "Types of events to send",
-        "min_severity": "Only allow FINDING events of this severity or higher",
-        "retries": "Number of times to retry sending the message before skipping the event",
-    }
+
+    class Config(BaseModuleConfig):
+        webhook_url: str = Field("", description="Slack webhook URL", sensitive=True)
+        event_types: list[str] = Field(["FINDING"], description="Types of events to send")
+        min_severity: str = Field("LOW", description="Only allow FINDING events of this severity or higher")
+        retries: int = Field(10, description="Number of times to retry sending the message before skipping the event")
+
     content_key = "text"
 
     def format_message_str(self, event):
diff --git a/bbot/modules/output/splunk.py b/bbot/modules/output/splunk.py
index 0c0a0dd804..5ad09fa93a 100644
--- a/bbot/modules/output/splunk.py
+++ b/bbot/modules/output/splunk.py
@@ -1,5 +1,6 @@
 from bbot.errors import WebError
 from bbot.modules.output.base import BaseOutputModule
+from bbot.core.config.models import BaseModuleConfig, Field
 
 
 class Splunk(BaseOutputModule):
@@ -9,20 +10,13 @@ class Splunk(BaseOutputModule):
         "created_date": "2024-02-17",
         "author": "@w0Tx",
     }
-    options = {
-        "url": "",
-        "hectoken": "",
-        "index": "",
-        "source": "",
-        "timeout": 10,
-    }
-    options_desc = {
-        "url": "Web URL",
-        "hectoken": "HEC Token",
-        "index": "Index to send data to",
-        "source": "Source path to be added to the metadata",
-        "timeout": "HTTP timeout",
-    }
+
+    class Config(BaseModuleConfig):
+        url: str = Field("", description="Web URL", sensitive=True)
+        hectoken: str = Field("", description="HEC Token", sensitive=True)
+        index: str = Field("", description="Index to send data to")
+        source: str = Field("", description="Source path to be added to the metadata")
+        timeout: int = Field(10, description="HTTP timeout")
 
     async def setup(self):
         self.url = self.config.get("url", "")
diff --git a/bbot/modules/output/sqlite.py b/bbot/modules/output/sqlite.py
index 261b13b6e2..f48b800554 100644
--- a/bbot/modules/output/sqlite.py
+++ b/bbot/modules/output/sqlite.py
@@ -1,6 +1,7 @@
 from pathlib import Path
 
 from bbot.modules.templates.sql import SQLTemplate
+from bbot.core.config.models import BaseModuleConfig, Field
 
 
 class SQLite(SQLTemplate):
@@ -10,12 +11,13 @@ class SQLite(SQLTemplate):
         "created_date": "2024-11-07",
         "author": "@TheTechromancer",
     }
-    options = {
-        "database": "",
-    }
-    options_desc = {
-        "database": "The path to the sqlite database file",
-    }
+
+    class Config(BaseModuleConfig):
+        database: str = Field("", description="The path to the sqlite database file")
+        retries: int = Field(
+            10, description="Number of times to retry connecting to the database (1 second between retries)"
+        )
+
     deps_pip = ["sqlmodel", "aiosqlite"]
 
     async def setup(self):
diff --git a/bbot/modules/output/stdout.py b/bbot/modules/output/stdout.py
index 62c6b74dfe..0252856e9e 100644
--- a/bbot/modules/output/stdout.py
+++ b/bbot/modules/output/stdout.py
@@ -1,30 +1,43 @@
 import os
 import sys
 import json
+from typing import Literal
 
 from bbot.modules.output.base import BaseOutputModule
+from pydantic import Field, field_validator
+from bbot.core.config.models import BaseModuleConfig
 
 
 class Stdout(BaseOutputModule):
     watched_events = ["*"]
     meta = {"description": "Output to text", "created_date": "2024-04-03", "author": "@TheTechromancer"}
-    options = {"format": "text", "event_types": [], "event_fields": [], "in_scope_only": False, "accept_dupes": True}
-    options_desc = {
-        "format": "Which text format to display, choices: text,json",
-        "event_types": "Which events to display, default all event types",
-        "event_fields": "Which event fields to display",
-        "in_scope_only": "Whether to only show in-scope events",
-        "accept_dupes": "Whether to show duplicate events, default True",
+
+    class Config(BaseModuleConfig):
+        format: Literal["text", "json"] = Field("text", description="Which text format to display, choices: text,json")
+        event_types: list = Field([], description="Which events to display, default all event types")
+        event_fields: list = Field([], description="Which event fields to display")
+        in_scope_only: bool = Field(False, description="Whether to only show in-scope events")
+        accept_dupes: bool = Field(True, description="Whether to show duplicate events, default True")
+
+        @field_validator("format", mode="before")
+        @classmethod
+        def _normalize_case(cls, v):
+            return v.strip().lower() if isinstance(v, str) else v
+
+    vuln_severity_map = {
+        "INFO": "HUGEINFO",
+        "LOW": "HUGEWARNING",
+        "MEDIUM": "HUGEWARNING",
+        "HIGH": "CRITICAL",
+        "CRITICAL": "CRITICAL",
     }
-    format_choices = ["text", "json"]
 
     async def setup(self):
         self.text_format = self.config.get("format", "text").strip().lower()
-        if self.text_format not in self.format_choices:
-            return (
-                False,
-                f'Invalid text format choice, "{self.text_format}" (choices: {",".join(self.format_choices)})',
-            )
+        # guard the unvalidated programmatic path (Scanner(config=...) skips validation),
+        # otherwise an unknown format silently drops every event in handle_event
+        if self.text_format not in ("text", "json"):
+            return False, f"Invalid format {self.text_format!r}; must be 'text' or 'json'"
         self.accept_event_types = [str(s).upper() for s in self.config.get("event_types", [])]
         self.show_event_fields = [str(s) for s in self.config.get("event_fields", [])]
         self.in_scope_only = self.config.get("in_scope_only", False)
diff --git a/bbot/modules/output/subdomains.py b/bbot/modules/output/subdomains.py
index 65d082355e..64db0f37f1 100644
--- a/bbot/modules/output/subdomains.py
+++ b/bbot/modules/output/subdomains.py
@@ -1,5 +1,6 @@
 from bbot.modules.output.txt import TXT
 from bbot.modules.base import BaseModule
+from bbot.core.config.models import BaseModuleConfig, Field
 
 
 class Subdomains(TXT):
@@ -10,8 +11,11 @@ class Subdomains(TXT):
         "created_date": "2023-07-31",
         "author": "@TheTechromancer",
     }
-    options = {"output_file": "", "include_unresolved": False}
-    options_desc = {"output_file": "Output to file", "include_unresolved": "Include unresolved subdomains in output"}
+
+    class Config(BaseModuleConfig):
+        output_file: str = Field("", description="Output to file")
+        include_unresolved: bool = Field(False, description="Include unresolved subdomains in output")
+
     accept_dupes = False
     in_scope_only = True
 
diff --git a/bbot/modules/output/teams.py b/bbot/modules/output/teams.py
index 1ecd25f6d4..4954bea293 100644
--- a/bbot/modules/output/teams.py
+++ b/bbot/modules/output/teams.py
@@ -1,4 +1,5 @@
 from bbot.modules.templates.webhook import WebhookOutputModule
+from bbot.core.config.models import BaseModuleConfig, Field
 
 
 class Teams(WebhookOutputModule):
@@ -8,13 +9,12 @@ class Teams(WebhookOutputModule):
         "created_date": "2023-08-14",
         "author": "@TheTechromancer",
     }
-    options = {"webhook_url": "", "event_types": ["FINDING"], "min_severity": "LOW", "retries": 10}
-    options_desc = {
-        "webhook_url": "Teams webhook URL",
-        "event_types": "Types of events to send",
-        "min_severity": "Only allow FINDING events of this severity or higher",
-        "retries": "Number of times to retry sending the message before skipping the event",
-    }
+
+    class Config(BaseModuleConfig):
+        webhook_url: str = Field("", description="Teams webhook URL", sensitive=True)
+        event_types: list[str] = Field(["FINDING"], description="Types of events to send")
+        min_severity: str = Field("LOW", description="Only allow FINDING events of this severity or higher")
+        retries: int = Field(10, description="Number of times to retry sending the message before skipping the event")
 
     async def handle_event(self, event):
         data = self.format_message(event)
diff --git a/bbot/modules/output/txt.py b/bbot/modules/output/txt.py
index 2dfb14c106..02adefc895 100644
--- a/bbot/modules/output/txt.py
+++ b/bbot/modules/output/txt.py
@@ -1,13 +1,15 @@
 from contextlib import suppress
 
 from bbot.modules.output.base import BaseOutputModule
+from bbot.core.config.models import BaseModuleConfig, Field
 
 
 class TXT(BaseOutputModule):
     watched_events = ["*"]
     meta = {"description": "Output to text", "created_date": "2024-04-03", "author": "@TheTechromancer"}
-    options = {"output_file": ""}
-    options_desc = {"output_file": "Output to file"}
+
+    class Config(BaseModuleConfig):
+        output_file: str = Field("", description="Output to file")
 
     output_filename = "output.txt"
 
diff --git a/bbot/modules/output/web_parameters.py b/bbot/modules/output/web_parameters.py
index 634a623720..041f0ae29d 100644
--- a/bbot/modules/output/web_parameters.py
+++ b/bbot/modules/output/web_parameters.py
@@ -2,6 +2,7 @@
 from collections import defaultdict
 
 from bbot.modules.output.base import BaseOutputModule
+from bbot.core.config.models import BaseModuleConfig, Field
 
 
 class Web_parameters(BaseOutputModule):
@@ -11,11 +12,10 @@ class Web_parameters(BaseOutputModule):
         "created_date": "2025-01-25",
         "author": "@liquidsec",
     }
-    options = {"output_file": "", "include_count": False}
-    options_desc = {
-        "output_file": "Output to file",
-        "include_count": "Include the count of each parameter in the output",
-    }
+
+    class Config(BaseModuleConfig):
+        output_file: str = Field("", description="Output to file")
+        include_count: bool = Field(False, description="Include the count of each parameter in the output")
 
     output_filename = "web_parameters.txt"
 
diff --git a/bbot/modules/output/web_report.py b/bbot/modules/output/web_report.py
index a306e1bf70..8ea52b88ea 100644
--- a/bbot/modules/output/web_report.py
+++ b/bbot/modules/output/web_report.py
@@ -1,6 +1,7 @@
 from bbot.modules.output.base import BaseOutputModule
 import markdown
 import html
+from bbot.core.config.models import BaseModuleConfig, Field
 
 
 class web_report(BaseOutputModule):
@@ -10,11 +11,14 @@ class web_report(BaseOutputModule):
         "created_date": "2023-02-08",
         "author": "@liquidsec",
     }
-    options = {
-        "output_file": "",
-        "css_theme_file": "https://cdnjs.cloudflare.com/ajax/libs/github-markdown-css/5.1.0/github-markdown.min.css",
-    }
-    options_desc = {"output_file": "Output to file", "css_theme_file": "CSS theme URL for HTML output"}
+
+    class Config(BaseModuleConfig):
+        output_file: str = Field("", description="Output to file")
+        css_theme_file: str = Field(
+            "https://cdnjs.cloudflare.com/ajax/libs/github-markdown-css/5.1.0/github-markdown.min.css",
+            description="CSS theme URL for HTML output",
+        )
+
     deps_pip = ["markdown~=3.4.3"]
 
     async def setup(self):
diff --git a/bbot/modules/output/webhook.py b/bbot/modules/output/webhook.py
index 0070d91cf4..8d5d9f21f5 100644
--- a/bbot/modules/output/webhook.py
+++ b/bbot/modules/output/webhook.py
@@ -1,7 +1,6 @@
-from omegaconf import OmegaConf
-
 from bbot.models.pydantic import Event
 from bbot.modules.output.base import BaseOutputModule
+from bbot.core.config.models import BaseModuleConfig, Field
 
 
 class webhook(BaseOutputModule):
@@ -11,30 +10,21 @@ class webhook(BaseOutputModule):
         "created_date": "2022-04-13",
         "author": "@TheTechromancer",
     }
-    options = {
-        "url": "",
-        "method": "POST",
-        "bearer": "",
-        "username": "",
-        "password": "",
-        "headers": {},
-        "timeout": 10,
-    }
-    options_desc = {
-        "url": "Web URL",
-        "method": "HTTP method",
-        "bearer": "Authorization Bearer token",
-        "username": "Username (basic auth)",
-        "password": "Password (basic auth)",
-        "headers": "Additional headers to send with the request",
-        "timeout": "HTTP timeout",
-    }
+
+    class Config(BaseModuleConfig):
+        url: str = Field("", description="Web URL")
+        method: str = Field("POST", description="HTTP method")
+        bearer: str = Field("", description="Authorization Bearer token", sensitive=True)
+        username: str = Field("", description="Username (basic auth)")
+        password: str = Field("", description="Password (basic auth)", sensitive=True)
+        headers: dict = Field({}, description="Additional headers to send with the request", sensitive=True)
+        timeout: int = Field(10, description="HTTP timeout")
 
     async def setup(self):
         self.url = self.config.get("url", "")
         self.method = self.config.get("method", "POST")
         self.timeout = self.config.get("timeout", 10)
-        self.headers = OmegaConf.to_object(self.config.get("headers", OmegaConf.create()))
+        self.headers = dict(self.config.get("headers") or {})
         bearer = self.config.get("bearer", "")
         if bearer:
             self.headers["Authorization"] = f"Bearer {bearer}"
diff --git a/bbot/modules/output/websocket.py b/bbot/modules/output/websocket.py
index 13ff355014..8671d5bd0d 100644
--- a/bbot/modules/output/websocket.py
+++ b/bbot/modules/output/websocket.py
@@ -4,18 +4,22 @@
 import websockets
 
 from bbot.modules.output.base import BaseOutputModule
+from bbot.core.config.models import BaseModuleConfig, Field
 
 
 class Websocket(BaseOutputModule):
     watched_events = ["*"]
     meta = {"description": "Output to websockets", "created_date": "2022-04-15", "author": "@TheTechromancer"}
-    options = {"url": "", "token": "", "preserve_graph": True, "ignore_ssl": False}
-    options_desc = {
-        "url": "Web URL",
-        "token": "Authorization Bearer token",
-        "preserve_graph": "Preserve full chains of events in the graph (prevents orphans)",
-        "ignore_ssl": "Ignores all Websocket SSL related errors (like Self-Signed Certificates, etc.)",
-    }
+
+    class Config(BaseModuleConfig):
+        url: str = Field("", description="Web URL", sensitive=True)
+        token: str = Field("", description="Authorization Bearer token", sensitive=True)
+        preserve_graph: bool = Field(
+            True, description="Preserve full chains of events in the graph (prevents orphans)"
+        )
+        ignore_ssl: bool = Field(
+            False, description="Ignores all Websocket SSL related errors (like Self-Signed Certificates, etc.)"
+        )
 
     async def setup(self):
         self.url = self.config.get("url", "")
diff --git a/bbot/modules/output/zeromq.py b/bbot/modules/output/zeromq.py
index 938f234545..17c7bc4da6 100644
--- a/bbot/modules/output/zeromq.py
+++ b/bbot/modules/output/zeromq.py
@@ -2,6 +2,7 @@
 import json
 
 from bbot.modules.output.base import BaseOutputModule
+from bbot.core.config.models import BaseModuleConfig, Field
 
 
 class ZeroMQ(BaseOutputModule):
@@ -11,12 +12,11 @@ class ZeroMQ(BaseOutputModule):
         "created_date": "2024-11-22",
         "author": "@TheTechromancer",
     }
-    options = {
-        "zmq_address": "",
-    }
-    options_desc = {
-        "zmq_address": "The ZeroMQ socket address to publish events to (e.g. tcp://localhost:5555)",
-    }
+
+    class Config(BaseModuleConfig):
+        zmq_address: str = Field(
+            "", description="The ZeroMQ socket address to publish events to (e.g. tcp://localhost:5555)"
+        )
 
     async def setup(self):
         self.zmq_address = self.config.get("zmq_address", "")
diff --git a/bbot/modules/paramminer_cookies.py b/bbot/modules/paramminer_cookies.py
index 6c86859169..4c4db8dc0d 100644
--- a/bbot/modules/paramminer_cookies.py
+++ b/bbot/modules/paramminer_cookies.py
@@ -1,4 +1,7 @@
+from typing import Union
+
 from .paramminer_headers import paramminer_headers
+from bbot.core.config.models import BaseModuleConfig, Field
 
 
 class paramminer_cookies(paramminer_headers):
@@ -14,16 +17,17 @@ class paramminer_cookies(paramminer_headers):
         "created_date": "2022-06-27",
         "author": "@liquidsec",
     }
-    options = {
-        "wordlist": "",  # default is defined within setup function
-        "recycle_words": False,
-        "skip_boring_words": True,
-    }
-    options_desc = {
-        "wordlist": "Define the wordlist to be used to derive cookies. Accepts a list of URLs/paths to merge multiple wordlists (duplicates are removed).",
-        "recycle_words": "Attempt to use words found during the scan on all other endpoints",
-        "skip_boring_words": "Remove commonly uninteresting words from the wordlist",
-    }
+
+    class Config(BaseModuleConfig):
+        wordlist: Union[str, list[str]] = Field(
+            "",
+            description="Define the wordlist to be used to derive cookies. Accepts a list of URLs/paths to merge multiple wordlists (duplicates are removed).",
+        )
+        recycle_words: bool = Field(
+            False, description="Attempt to use words found during the scan on all other endpoints"
+        )
+        skip_boring_words: bool = Field(True, description="Remove commonly uninteresting words from the wordlist")
+
     scanned_hosts = []
     _module_threads = 4
     in_scope_only = True
diff --git a/bbot/modules/paramminer_getparams.py b/bbot/modules/paramminer_getparams.py
index 46783ab08c..54ca00a602 100644
--- a/bbot/modules/paramminer_getparams.py
+++ b/bbot/modules/paramminer_getparams.py
@@ -1,8 +1,11 @@
 import itertools
 import string
+from typing import Union
 from urllib.parse import urlparse
 
+
 from .paramminer_headers import paramminer_headers, _mutate_case
+from bbot.core.config.models import BaseModuleConfig, Field
 
 
 class paramminer_getparams(paramminer_headers):
@@ -19,27 +22,32 @@ class paramminer_getparams(paramminer_headers):
         "author": "@liquidsec",
     }
     scanned_hosts = []
-    options = {
-        "wordlist": "",  # default is defined within setup function
-        "recycle_words": False,
-        "skip_boring_words": True,
-        "mutate_case": False,
-        "brute_short": False,
-    }
-    options_desc = {
-        "wordlist": "Define the wordlist to be used to derive headers. Accepts a list of URLs/paths to merge multiple wordlists (duplicates are removed).",
-        "recycle_words": "Attempt to use words found during the scan on all other endpoints",
-        "skip_boring_words": "Remove commonly uninteresting words from the wordlist",
-        "mutate_case": (
-            "Also test case-mutated variants of each entry "
-            "(camelCase for snake_case/kebab-case, Title case for single words). "
-            "Skipped on URLs with case-insensitive backend extensions like .aspx/.cfm."
-        ),
-        "brute_short": (
-            "Generate every 1-, 2-, and 3-letter [a-z] combination and add to the wordlist. "
-            "Costs ~18,278 extra requests per host — opt-in for thorough scans."
-        ),
-    }
+
+    class Config(BaseModuleConfig):
+        wordlist: Union[str, list[str]] = Field(
+            "",
+            description="Define the wordlist to be used to derive headers. Accepts a list of URLs/paths to merge multiple wordlists (duplicates are removed).",
+        )
+        recycle_words: bool = Field(
+            False, description="Attempt to use words found during the scan on all other endpoints"
+        )
+        skip_boring_words: bool = Field(True, description="Remove commonly uninteresting words from the wordlist")
+        mutate_case: bool = Field(
+            False,
+            description=(
+                "Also test case-mutated variants of each entry "
+                "(camelCase for snake_case/kebab-case, Title case for single words). "
+                "Skipped on URLs with case-insensitive backend extensions like .aspx/.cfm."
+            ),
+        )
+        brute_short: bool = Field(
+            False,
+            description=(
+                "Generate every 1-, 2-, and 3-letter [a-z] combination and add to the wordlist. "
+                "Costs ~18,278 extra requests per host; opt-in for thorough scans."
+            ),
+        )
+
     boring_words = {"utm_source", "utm_campaign", "utm_medium", "utm_term", "utm_content"}
     in_scope_only = True
     compare_mode = "getparam"
diff --git a/bbot/modules/paramminer_headers.py b/bbot/modules/paramminer_headers.py
index d80d8aab51..48fac10a65 100644
--- a/bbot/modules/paramminer_headers.py
+++ b/bbot/modules/paramminer_headers.py
@@ -1,7 +1,9 @@
 import re
+from typing import Union
 
 from bbot.errors import HttpCompareError
 from bbot.modules.base import BaseModule
+from bbot.core.config.models import BaseModuleConfig, Field
 
 _case_split = re.compile(r"[-_]+")
 
@@ -39,16 +41,17 @@ class paramminer_headers(BaseModule):
         "created_date": "2022-04-15",
         "author": "@liquidsec",
     }
-    options = {
-        "wordlist": "",  # default is defined within setup function
-        "recycle_words": False,
-        "skip_boring_words": True,
-    }
-    options_desc = {
-        "wordlist": "Define the wordlist to be used to derive headers. Accepts a list of URLs/paths to merge multiple wordlists (duplicates are removed).",
-        "recycle_words": "Attempt to use words found during the scan on all other endpoints",
-        "skip_boring_words": "Remove commonly uninteresting words from the wordlist",
-    }
+
+    class Config(BaseModuleConfig):
+        wordlist: Union[str, list[str]] = Field(
+            "",
+            description="Define the wordlist to be used to derive headers. Accepts a list of URLs/paths to merge multiple wordlists (duplicates are removed).",
+        )
+        recycle_words: bool = Field(
+            False, description="Attempt to use words found during the scan on all other endpoints"
+        )
+        skip_boring_words: bool = Field(True, description="Remove commonly uninteresting words from the wordlist")
+
     # URLs ending with these extensions are known to be case-insensitive — skip case mutation.
     # (Used by paramminer_getparams and paramminer_cookies; HTTP headers are inherently
     # case-insensitive per RFC 7230 so this isn't relevant to paramminer_headers itself.)
diff --git a/bbot/modules/pgp.py b/bbot/modules/pgp.py
index 51c042a514..2a4f3f1da9 100644
--- a/bbot/modules/pgp.py
+++ b/bbot/modules/pgp.py
@@ -1,4 +1,5 @@
 from bbot.modules.templates.subdomain_enum import subdomain_enum
+from bbot.core.config.models import BaseModuleConfig, Field
 
 
 class pgp(subdomain_enum):
@@ -10,15 +11,17 @@ class pgp(subdomain_enum):
         "created_date": "2022-08-10",
         "author": "@TheTechromancer",
     }
-    options = {
-        "search_urls": [
-            "https://keyserver.ubuntu.com/pks/lookup?fingerprint=on&op=vindex&search=<query>",
-            "http://the.earth.li:11371/pks/lookup?fingerprint=on&op=vindex&search=<query>",
-            "https://pgpkeys.eu/pks/lookup?search=<query>&op=index",
-            "https://pgp.mit.edu/pks/lookup?search=<query>&op=index",
-        ]
-    }
-    options_desc = {"search_urls": "PGP key servers to search"}
+
+    class Config(BaseModuleConfig):
+        search_urls: list[str] = Field(
+            [
+                "https://keyserver.ubuntu.com/pks/lookup?fingerprint=on&op=vindex&search=<query>",
+                "http://the.earth.li:11371/pks/lookup?fingerprint=on&op=vindex&search=<query>",
+                "https://pgpkeys.eu/pks/lookup?search=<query>&op=index",
+                "https://pgp.mit.edu/pks/lookup?search=<query>&op=index",
+            ],
+            description="PGP key servers to search",
+        )
 
     async def handle_event(self, event):
         query = self.make_query(event)
diff --git a/bbot/modules/portfilter.py b/bbot/modules/portfilter.py
index 0bd41fab3f..65c110b10a 100644
--- a/bbot/modules/portfilter.py
+++ b/bbot/modules/portfilter.py
@@ -1,4 +1,5 @@
 from bbot.modules.base import BaseInterceptModule
+from bbot.core.config.models import BaseModuleConfig, Field
 
 
 class portfilter(BaseInterceptModule):
@@ -9,14 +10,12 @@ class portfilter(BaseInterceptModule):
         "created_date": "2025-01-06",
         "author": "@TheTechromancer",
     }
-    options = {
-        "cdn_tags": "cdn,waf",
-        "allowed_cdn_ports": "80,443",
-    }
-    options_desc = {
-        "cdn_tags": "Comma-separated list of tags to skip, e.g. 'cdn,waf'",
-        "allowed_cdn_ports": "Comma-separated list of ports that are allowed to be scanned for CDNs",
-    }
+
+    class Config(BaseModuleConfig):
+        cdn_tags: str = Field("cdn,waf", description="Comma-separated list of tags to skip, e.g. 'cdn,waf'")
+        allowed_cdn_ports: str = Field(
+            "80,443", description="Comma-separated list of ports that are allowed to be scanned for CDNs"
+        )
 
     _priority = 4
     # we consume URLs but we don't want to automatically enable blasthttp
diff --git a/bbot/modules/portscan.py b/bbot/modules/portscan.py
index 62e2a52ac1..8e064784e3 100644
--- a/bbot/modules/portscan.py
+++ b/bbot/modules/portscan.py
@@ -4,6 +4,7 @@
 from radixtarget import RadixTarget, host_size_key
 
 from bbot.modules.base import BaseModule
+from bbot.core.config.models import BaseModuleConfig, Field
 
 
 # TODO: this module is getting big. It should probably be two modules: one for ping and one for SYN.
@@ -18,35 +19,35 @@ class portscan(BaseModule):
         "created_date": "2024-05-15",
         "author": "@TheTechromancer",
     }
-    options = {
-        "top_ports": 100,
-        "ports": "",
-        # ping scan at 600 packets/s ~= private IP space in 8 hours
-        "rate": 300,
-        "wait": 5,
-        "ping_first": False,
-        "ping_only": False,
-        "adapter": "",
-        "adapter_ip": "",
-        "adapter_mac": "",
-        "router_mac": "",
-        "skip_tags": "",
-        "module_timeout": 259200,  # 3 days
-    }
-    options_desc = {
-        "top_ports": "Top ports to scan (default 100) (to override, specify 'ports')",
-        "ports": "Ports to scan",
-        "rate": "Rate in packets per second",
-        "wait": "Seconds to wait for replies after scan is complete",
-        "ping_first": "Only portscan hosts that reply to pings",
-        "ping_only": "Ping sweep only, no portscan",
-        "adapter": 'Manually specify a network interface, such as "eth0" or "tun0". If not specified, the first network interface found with a default gateway will be used.',
-        "adapter_ip": "Send packets using this IP address. Not needed unless masscan's autodetection fails",
-        "adapter_mac": "Send packets using this as the source MAC address. Not needed unless masscan's autodetection fails",
-        "router_mac": "Send packets to this MAC address as the destination. Not needed unless masscan's autodetection fails",
-        "skip_tags": "Comma-separated event tags that will be excluded from scanning (e.g. 'cdn,waf'). speculate will emit assumed-open ports for these instead.",
-        "module_timeout": "Max time in seconds to spend handling each batch of events",
-    }
+
+    class Config(BaseModuleConfig):
+        top_ports: int = Field(100, description="Top ports to scan (default 100) (to override, specify 'ports')")
+        ports: str = Field("", description="Ports to scan")
+        rate: int = Field(300, description="Rate in packets per second")
+        wait: int = Field(5, description="Seconds to wait for replies after scan is complete")
+        ping_first: bool = Field(False, description="Only portscan hosts that reply to pings")
+        ping_only: bool = Field(False, description="Ping sweep only, no portscan")
+        adapter: str = Field(
+            "",
+            description='Manually specify a network interface, such as "eth0" or "tun0". If not specified, the first network interface found with a default gateway will be used.',
+        )
+        adapter_ip: str = Field(
+            "", description="Send packets using this IP address. Not needed unless masscan's autodetection fails"
+        )
+        adapter_mac: str = Field(
+            "",
+            description="Send packets using this as the source MAC address. Not needed unless masscan's autodetection fails",
+        )
+        router_mac: str = Field(
+            "",
+            description="Send packets to this MAC address as the destination. Not needed unless masscan's autodetection fails",
+        )
+        skip_tags: str = Field(
+            "",
+            description="Comma-separated event tags that will be excluded from scanning (e.g. 'cdn,waf'). speculate will emit assumed-open ports for these instead.",
+        )
+        module_timeout: int = Field(259200, description="Max time in seconds to spend handling each batch of events")
+
     deps_common = ["masscan"]
     batch_size = 1000000
     _shuffle_incoming_queue = False
diff --git a/bbot/modules/postman.py b/bbot/modules/postman.py
index ee0bf25cd2..c6a429cc8f 100644
--- a/bbot/modules/postman.py
+++ b/bbot/modules/postman.py
@@ -1,4 +1,5 @@
 from bbot.modules.templates.postman import postman
+from bbot.core.config.models import BaseModuleConfig, Field
 
 
 class postman(postman):
@@ -10,8 +11,10 @@ class postman(postman):
         "created_date": "2024-09-07",
         "author": "@domwhewell-sage",
     }
-    options = {"api_key": ""}
-    options_desc = {"api_key": "Postman API Key"}
+
+    class Config(BaseModuleConfig):
+        api_key: str | list[str] = Field("", description="Postman API Key", sensitive=True, mandatory=True)
+
     reject_wildcards = False
 
     async def handle_event(self, event):
diff --git a/bbot/modules/postman_download.py b/bbot/modules/postman_download.py
index 77644435ad..3ddc0cd622 100644
--- a/bbot/modules/postman_download.py
+++ b/bbot/modules/postman_download.py
@@ -2,6 +2,7 @@
 import json
 from pathlib import Path
 from bbot.modules.templates.postman import postman
+from bbot.core.config.models import BaseModuleConfig, Field
 
 
 class postman_download(postman):
@@ -13,11 +14,14 @@ class postman_download(postman):
         "created_date": "2024-09-07",
         "author": "@domwhewell-sage",
     }
-    options = {"output_folder": "", "api_key": ""}
-    options_desc = {
-        "output_folder": "Folder to download postman workspaces to. If not specified, downloaded workspaces will be deleted when the scan completes, to minimize disk usage.",
-        "api_key": "Postman API Key",
-    }
+
+    class Config(BaseModuleConfig):
+        output_folder: str = Field(
+            "",
+            description="Folder to download postman workspaces to. If not specified, downloaded workspaces will be deleted when the scan completes, to minimize disk usage.",
+        )
+        api_key: str | list[str] = Field("", description="Postman API Key", sensitive=True, mandatory=True)
+
     scope_distance_modifier = 2
 
     async def setup(self):
diff --git a/bbot/modules/retirejs.py b/bbot/modules/retirejs.py
index b82153e856..f86eefe455 100644
--- a/bbot/modules/retirejs.py
+++ b/bbot/modules/retirejs.py
@@ -1,6 +1,9 @@
 import json
 from enum import IntEnum
+from typing import Literal
 from bbot.modules.base import BaseModule
+from pydantic import Field, field_validator
+from bbot.core.config.models import BaseModuleConfig
 
 
 class RetireJSSeverity(IntEnum):
@@ -27,16 +30,18 @@ class retirejs(BaseModule):
         "created_date": "2025-08-19",
         "author": "@liquidsec",
     }
-    options = {
-        "version": "5.3.0",
-        "node_version": "18.19.1",
-        "severity": "medium",
-    }
-    options_desc = {
-        "version": "retire.js version",
-        "node_version": "Node.js version to install locally",
-        "severity": "Minimum severity level to report (none, low, medium, high, critical)",
-    }
+
+    class Config(BaseModuleConfig):
+        version: str = Field("5.3.0", description="retire.js version")
+        node_version: str = Field("18.19.1", description="Node.js version to install locally")
+        severity: Literal["none", "low", "medium", "high", "critical"] = Field(
+            "medium", description="Minimum severity level to report (none, low, medium, high, critical)"
+        )
+
+        @field_validator("severity", mode="before")
+        @classmethod
+        def _normalize_case(cls, v):
+            return v.lower() if isinstance(v, str) else v
 
     deps_ansible = [
         # Download Node.js binary (Linux x64)
@@ -116,15 +121,6 @@ async def setup(self):
         if not excavate_enabled:
             return None, "retirejs will not function without excavate enabled"
 
-        # Validate severity level
-        valid_severities = ["none", "low", "medium", "high", "critical"]
-        configured_severity = self.config.get("severity", "medium").lower()
-        if configured_severity not in valid_severities:
-            return (
-                False,
-                f"Invalid severity level '{configured_severity}'. Valid options are: {', '.join(valid_severities)}",
-            )
-
         self.repofile = await self.helpers.download(
             "https://raw.githubusercontent.com/RetireJS/retire.js/master/repository/jsrepository-v4.json", cache_hrs=24
         )
diff --git a/bbot/modules/robots.py b/bbot/modules/robots.py
index 1240f11959..62199e8042 100644
--- a/bbot/modules/robots.py
+++ b/bbot/modules/robots.py
@@ -1,4 +1,5 @@
 from bbot.modules.base import BaseModule
+from bbot.core.config.models import BaseModuleConfig, Field
 
 
 class robots(BaseModule):
@@ -7,12 +8,10 @@ class robots(BaseModule):
     flags = ["safe", "active", "web"]
     meta = {"description": "Look for and parse robots.txt", "created_date": "2023-02-01", "author": "@liquidsec"}
 
-    options = {"include_sitemap": False, "include_allow": True, "include_disallow": True}
-    options_desc = {
-        "include_sitemap": "Include 'sitemap' entries",
-        "include_allow": "Include 'Allow' Entries",
-        "include_disallow": "Include 'Disallow' Entries",
-    }
+    class Config(BaseModuleConfig):
+        include_sitemap: bool = Field(False, description="Include 'sitemap' entries")
+        include_allow: bool = Field(True, description="Include 'Allow' Entries")
+        include_disallow: bool = Field(True, description="Include 'Disallow' Entries")
 
     in_scope_only = True
     per_hostport_only = True
diff --git a/bbot/modules/securitytrails.py b/bbot/modules/securitytrails.py
index 7ab333ee76..15fb4bf09e 100644
--- a/bbot/modules/securitytrails.py
+++ b/bbot/modules/securitytrails.py
@@ -1,4 +1,5 @@
 from bbot.modules.templates.subdomain_enum import subdomain_enum_apikey
+from bbot.core.config.models import BaseModuleConfig, Field
 
 
 class securitytrails(subdomain_enum_apikey):
@@ -9,10 +10,10 @@ class securitytrails(subdomain_enum_apikey):
         "description": "Query the SecurityTrails API for subdomains",
         "created_date": "2022-07-03",
         "author": "@TheTechromancer",
-        "auth_required": True,
     }
-    options = {"api_key": ""}
-    options_desc = {"api_key": "SecurityTrails API key"}
+
+    class Config(BaseModuleConfig):
+        api_key: str | list[str] = Field("", description="SecurityTrails API key", sensitive=True, mandatory=True)
 
     base_url = "https://api.securitytrails.com/v1"
     ping_url = f"{base_url}/ping?apikey={{api_key}}"
diff --git a/bbot/modules/securitytxt.py b/bbot/modules/securitytxt.py
index d8d3d4aea2..d6b0383007 100644
--- a/bbot/modules/securitytxt.py
+++ b/bbot/modules/securitytxt.py
@@ -50,6 +50,7 @@
 import re
 
 from bbot.core.helpers.regexes import email_regex, url_regexes
+from bbot.core.config.models import BaseModuleConfig, Field
 
 _securitytxt_regex = r"^(?P<k>\w+): *(?P<v>.*)$"
 securitytxt_regex = re.compile(_securitytxt_regex, re.I | re.M)
@@ -64,14 +65,10 @@ class securitytxt(BaseModule):
         "author": "@colin-stubbs",
         "created_date": "2024-05-26",
     }
-    options = {
-        "emails": True,
-        "urls": True,
-    }
-    options_desc = {
-        "emails": "emit EMAIL_ADDRESS events",
-        "urls": "emit URL_UNVERIFIED events",
-    }
+
+    class Config(BaseModuleConfig):
+        emails: bool = Field(True, description="emit EMAIL_ADDRESS events")
+        urls: bool = Field(True, description="emit URL_UNVERIFIED events")
 
     async def setup(self):
         self._emails = self.config.get("emails", True)
diff --git a/bbot/modules/shodan_dns.py b/bbot/modules/shodan_dns.py
index 4e68ed11d4..b636acb2ea 100644
--- a/bbot/modules/shodan_dns.py
+++ b/bbot/modules/shodan_dns.py
@@ -1,18 +1,15 @@
 from bbot.modules.templates.shodan import shodan
+from bbot.core.config.models import BaseModuleConfig, Field
 
 
 class shodan_dns(shodan):
     watched_events = ["DNS_NAME"]
     produced_events = ["DNS_NAME"]
     flags = ["safe", "subdomain-enum", "passive"]
-    meta = {
-        "description": "Query Shodan for subdomains",
-        "created_date": "2022-07-03",
-        "author": "@TheTechromancer",
-        "auth_required": True,
-    }
-    options = {"api_key": ""}
-    options_desc = {"api_key": "Shodan API key"}
+    meta = {"description": "Query Shodan for subdomains", "created_date": "2022-07-03", "author": "@TheTechromancer"}
+
+    class Config(BaseModuleConfig):
+        api_key: str | list[str] = Field("", description="Shodan API key", sensitive=True, mandatory=True)
 
     base_url = "https://api.shodan.io"
 
diff --git a/bbot/modules/shodan_enterprise.py b/bbot/modules/shodan_enterprise.py
index 273fe837da..b874428169 100644
--- a/bbot/modules/shodan_enterprise.py
+++ b/bbot/modules/shodan_enterprise.py
@@ -1,4 +1,5 @@
 from bbot.modules.base import BaseModule
+from bbot.core.config.models import BaseModuleConfig, Field
 
 
 class shodan_enterprise(BaseModule):
@@ -9,13 +10,14 @@ class shodan_enterprise(BaseModule):
         "created_date": "2026-01-27",
         "author": "@Control-Punk-Delete",
         "description": "Shodan Enterprise API integration module.",
-        "auth_required": True,
-    }
-    options = {"api_key": "", "in_scope_only": True}
-    options_desc = {
-        "api_key": "Shodan API Key",
-        "in_scope_only": "Only query in-scope IPs. If False, will query up to distance 1.",
     }
+
+    class Config(BaseModuleConfig):
+        api_key: str | list[str] = Field("", description="Shodan API Key", sensitive=True, mandatory=True)
+        in_scope_only: bool = Field(
+            True, description="Only query in-scope IPs. If False, will query up to distance 1."
+        )
+
     in_scope_only = True
 
     base_url = "https://api.shodan.io"
diff --git a/bbot/modules/shodan_idb.py b/bbot/modules/shodan_idb.py
index 59ad329d35..c705172db2 100644
--- a/bbot/modules/shodan_idb.py
+++ b/bbot/modules/shodan_idb.py
@@ -1,5 +1,7 @@
 from bbot.modules.base import BaseModule
 import time
+from bbot.core.config.models import BaseModuleConfig, Field
+from typing import Optional
 
 
 class shodan_idb(BaseModule):
@@ -47,10 +49,12 @@ class shodan_idb(BaseModule):
         "created_date": "2023-12-22",
         "author": "@TheTechromancer",
     }
-    options = {"retries": None}
-    options_desc = {
-        "retries": "How many times to retry API requests (e.g. after a 429 error). Overrides the global web.api_retries setting."
-    }
+
+    class Config(BaseModuleConfig):
+        retries: Optional[int] = Field(
+            None,
+            description="How many times to retry API requests (e.g. after a 429 error). Overrides the global web.api_retries setting.",
+        )
 
     # we typically don't want to abort this module
     _api_failure_abort_threshold = 9999999999
diff --git a/bbot/modules/subdomainradar.py b/bbot/modules/subdomainradar.py
index eaca2374c5..a99063b3d0 100644
--- a/bbot/modules/subdomainradar.py
+++ b/bbot/modules/subdomainradar.py
@@ -1,7 +1,10 @@
 import time
 import asyncio
+from typing import Literal
 
 from bbot.modules.templates.subdomain_enum import subdomain_enum_apikey
+from pydantic import Field, field_validator
+from bbot.core.config.models import BaseModuleConfig
 
 
 class SubdomainRadar(subdomain_enum_apikey):
@@ -12,18 +15,22 @@ class SubdomainRadar(subdomain_enum_apikey):
         "description": "Query the Subdomain API for subdomains",
         "created_date": "2022-07-08",
         "author": "@TheTechromancer",
-        "auth_required": True,
-    }
-    options = {"api_key": "", "group": "fast", "timeout": 120}
-    options_desc = {
-        "api_key": "SubDomainRadar.io API key",
-        "group": "The enumeration group to use. Choose from fast, medium, deep",
-        "timeout": "Timeout in seconds",
     }
 
+    class Config(BaseModuleConfig):
+        api_key: str | list[str] = Field("", description="SubDomainRadar.io API key", sensitive=True, mandatory=True)
+        group: Literal["fast", "medium", "deep"] = Field(
+            "fast", description="The enumeration group to use. Choose from fast, medium, deep"
+        )
+        timeout: int = Field(120, description="Timeout in seconds")
+
+        @field_validator("group", mode="before")
+        @classmethod
+        def _normalize_case(cls, v):
+            return v.strip().lower() if isinstance(v, str) else v
+
     base_url = "https://api.subdomainradar.io"
     ping_url = f"{base_url}/profile"
-    group_choices = ("fast", "medium", "deep")
 
     # set this really high so the poll loop finishes as soon as possible
     _qsize = 9999999
@@ -31,8 +38,6 @@ class SubdomainRadar(subdomain_enum_apikey):
     async def setup(self):
         self.group = self.config.get("group", "fast").strip().lower()
         self.timeout = self.config.get("timeout", 120)
-        if self.group not in self.group_choices:
-            return False, f'Invalid group: "{self.group}", please choose from {",".join(self.group_choices)}'
         success, reason = await self.require_api_key()
         if not success:
             return success, reason
@@ -70,8 +75,7 @@ async def setup(self):
         return True
 
     def prepare_api_request(self, url, kwargs):
-        if self.api_key:
-            kwargs["headers"] = {"Authorization": f"Bearer {self.api_key}"}
+        kwargs["headers"] = {"Authorization": f"Bearer {self.api_key}"}
         return url, kwargs
 
     async def handle_event(self, event):
diff --git a/bbot/modules/telerik.py b/bbot/modules/telerik.py
index 1b1ce0b347..8fc1462f6c 100644
--- a/bbot/modules/telerik.py
+++ b/bbot/modules/telerik.py
@@ -1,6 +1,7 @@
 from sys import executable
 
 from bbot.modules.base import BaseModule
+from bbot.core.config.models import BaseModuleConfig, Field
 
 
 class telerik(BaseModule):
@@ -153,11 +154,9 @@ class telerik(BaseModule):
 
     RAUConfirmed = []
 
-    options = {"exploit_RAU_crypto": False, "include_subdirs": False}
-    options_desc = {
-        "exploit_RAU_crypto": "Attempt to confirm any RAU AXD detections are vulnerable",
-        "include_subdirs": "Include subdirectories in the scan (off by default)",  # will create many finding events if used in conjunction with web spider or webbrute
-    }
+    class Config(BaseModuleConfig):
+        exploit_RAU_crypto: bool = Field(False, description="Attempt to confirm any RAU AXD detections are vulnerable")
+        include_subdirs: bool = Field(False, description="Include subdirectories in the scan (off by default)")
 
     in_scope_only = True
 
diff --git a/bbot/modules/templates/gitlab.py b/bbot/modules/templates/gitlab.py
index d53ac12596..a40832bc3a 100644
--- a/bbot/modules/templates/gitlab.py
+++ b/bbot/modules/templates/gitlab.py
@@ -16,8 +16,7 @@ class GitLabBaseModule(BaseModule):
     saas_domains = ["gitlab.com", "gitlab.org"]
 
     async def setup(self):
-        if self.options.get("api_key") is not None:
-            await self.require_api_key()
+        await self.require_api_key()
         return True
 
     async def handle_social(self, event):
diff --git a/bbot/modules/templates/postman.py b/bbot/modules/templates/postman.py
index 490c6e62eb..f5c2fdc811 100644
--- a/bbot/modules/templates/postman.py
+++ b/bbot/modules/templates/postman.py
@@ -19,7 +19,6 @@ class postman(BaseModule):
         "Origin": "https://www.postman.com",
         "Referer": "https://www.postman.com/search?q=&scope=public&type=all",
     }
-    auth_required = True
 
     async def setup(self):
         await super().setup()
diff --git a/bbot/modules/templates/subdomain_enum.py b/bbot/modules/templates/subdomain_enum.py
index e6de184f04..357d54f9ff 100644
--- a/bbot/modules/templates/subdomain_enum.py
+++ b/bbot/modules/templates/subdomain_enum.py
@@ -201,7 +201,7 @@ class subdomain_enum_apikey(subdomain_enum):
     watched_events = ["DNS_NAME"]
     produced_events = ["DNS_NAME"]
     flags = ["subdomain-enum", "passive"]
-    meta = {"description": "Query API for subdomains", "auth_required": True}
+    meta = {"description": "Query API for subdomains"}
     options = {"api_key": ""}
     options_desc = {"api_key": "API key"}
 
diff --git a/bbot/modules/trajan.py b/bbot/modules/trajan.py
index dec96d94fa..a136ed06eb 100644
--- a/bbot/modules/trajan.py
+++ b/bbot/modules/trajan.py
@@ -2,6 +2,7 @@
 from urllib.parse import urlparse
 
 from bbot.modules.base import BaseModule
+from bbot.core.config.models import BaseModuleConfig, Field
 
 
 class trajan(BaseModule):
@@ -15,26 +16,17 @@ class trajan(BaseModule):
     }
 
     # Configuration options
-    options = {
-        "version": "1.0.0",
-        "github_token": "",
-        "gitlab_token": "",
-        "ado_token": "",
-        "jfrog_token": "",
-        "jenkins_username": "",
-        "jenkins_password": "",
-        "jenkins_token": "",
-    }
-    options_desc = {
-        "version": "Trajan version to download and use",
-        "github_token": "GitHub API token for rate-limiting and private repo access",
-        "gitlab_token": "GitLab API token for private repo access",
-        "ado_token": "Azure DevOps Personal Access Token (PAT)",
-        "jfrog_token": "JFrog API token",
-        "jenkins_username": "Jenkins username for basic auth",
-        "jenkins_password": "Jenkins password for basic auth",
-        "jenkins_token": "Jenkins API token",
-    }
+    class Config(BaseModuleConfig):
+        version: str = Field("1.0.0", description="Trajan version to download and use")
+        github_token: str = Field(
+            "", description="GitHub API token for rate-limiting and private repo access", sensitive=True
+        )
+        gitlab_token: str = Field("", description="GitLab API token for private repo access", sensitive=True)
+        ado_token: str = Field("", description="Azure DevOps Personal Access Token (PAT)", sensitive=True)
+        jfrog_token: str = Field("", description="JFrog API token", sensitive=True)
+        jenkins_username: str = Field("", description="Jenkins username for basic auth", sensitive=True)
+        jenkins_password: str = Field("", description="Jenkins password for basic auth", sensitive=True)
+        jenkins_token: str = Field("", description="Jenkins API token", sensitive=True)
 
     deps_ansible = [
         {
diff --git a/bbot/modules/trickest.py b/bbot/modules/trickest.py
index 7cbbfda3c4..ff44e06a52 100644
--- a/bbot/modules/trickest.py
+++ b/bbot/modules/trickest.py
@@ -1,22 +1,15 @@
 from bbot.modules.templates.subdomain_enum import subdomain_enum_apikey
+from bbot.core.config.models import BaseModuleConfig, Field
 
 
 class Trickest(subdomain_enum_apikey):
     watched_events = ["DNS_NAME"]
     produced_events = ["DNS_NAME"]
     flags = ["safe", "affiliates", "subdomain-enum", "passive"]
-    meta = {
-        "description": "Query Trickest's API for subdomains",
-        "author": "@amiremami",
-        "created_date": "2024-07-27",
-        "auth_required": True,
-    }
-    options = {
-        "api_key": "",
-    }
-    options_desc = {
-        "api_key": "Trickest API key",
-    }
+    meta = {"description": "Query Trickest's API for subdomains", "author": "@amiremami", "created_date": "2024-07-27"}
+
+    class Config(BaseModuleConfig):
+        api_key: str | list[str] = Field("", description="Trickest API key", sensitive=True, mandatory=True)
 
     base_url = "https://api.trickest.io/solutions/v1/public/solution/a7cba1f1-df07-4a5c-876a-953f178996be"
     ping_url = f"{base_url}/dataset"
diff --git a/bbot/modules/trufflehog.py b/bbot/modules/trufflehog.py
index 21a233262a..2002cd7adf 100644
--- a/bbot/modules/trufflehog.py
+++ b/bbot/modules/trufflehog.py
@@ -1,6 +1,7 @@
 import json
 from functools import partial
 from bbot.modules.base import BaseModule
+from bbot.core.config.models import BaseModuleConfig, Field
 
 
 class trufflehog(BaseModule):
@@ -13,20 +14,16 @@ class trufflehog(BaseModule):
         "author": "@domwhewell-sage",
     }
 
-    options = {
-        "version": "3.90.8",
-        "config": "",
-        "only_verified": True,
-        "concurrency": 8,
-        "deleted_forks": False,
-    }
-    options_desc = {
-        "version": "trufflehog version",
-        "config": "File path or URL to YAML trufflehog config",
-        "only_verified": "Only report credentials that have been verified",
-        "concurrency": "Number of concurrent workers",
-        "deleted_forks": "Scan for deleted github forks. WARNING: This is SLOW. For a smaller repository, this process can take 20 minutes. For a larger repository, it could take hours.",
-    }
+    class Config(BaseModuleConfig):
+        version: str = Field("3.90.8", description="trufflehog version")
+        config: str = Field("", description="File path or URL to YAML trufflehog config")
+        only_verified: bool = Field(True, description="Only report credentials that have been verified")
+        concurrency: int = Field(8, description="Number of concurrent workers")
+        deleted_forks: bool = Field(
+            False,
+            description="Scan for deleted github forks. WARNING: This is SLOW. For a smaller repository, this process can take 20 minutes. For a larger repository, it could take hours.",
+        )
+
     deps_ansible = [
         {
             "name": "Download trufflehog",
@@ -49,7 +46,7 @@ async def setup_deps(self):
 
     async def setup(self):
         self.verified = self.config.get("only_verified", True)
-        self.concurrency = int(self.config.get("concurrency", 8))
+        self.concurrency = self.config.get("concurrency", 8)
 
         self.deleted_forks = self.config.get("deleted_forks", False)
         self.github_token = ""
diff --git a/bbot/modules/url_manipulation.py b/bbot/modules/url_manipulation.py
index caf8bffcac..b0e8c85859 100644
--- a/bbot/modules/url_manipulation.py
+++ b/bbot/modules/url_manipulation.py
@@ -1,5 +1,6 @@
 from bbot.errors import HttpCompareError
 from bbot.modules.base import BaseModule
+from bbot.core.config.models import BaseModuleConfig, Field
 
 
 class url_manipulation(BaseModule):
@@ -13,10 +14,11 @@ class url_manipulation(BaseModule):
     }
     in_scope_only = True
 
-    options = {"allow_redirects": True}
-    options_desc = {
-        "allow_redirects": "Allowing redirects will sometimes create false positives. Disallowing will sometimes create false negatives. Allowed by default."
-    }
+    class Config(BaseModuleConfig):
+        allow_redirects: bool = Field(
+            True,
+            description="Allowing redirects will sometimes create false positives. Disallowing will sometimes create false negatives. Allowed by default.",
+        )
 
     async def setup(self):
         # ([string]method,[string]path,[bool]strip trailing slash)
diff --git a/bbot/modules/urlscan.py b/bbot/modules/urlscan.py
index 9a09222fe2..b49870e7f6 100644
--- a/bbot/modules/urlscan.py
+++ b/bbot/modules/urlscan.py
@@ -1,4 +1,5 @@
 from bbot.modules.templates.subdomain_enum import subdomain_enum
+from bbot.core.config.models import BaseModuleConfig, Field
 
 
 class urlscan(subdomain_enum):
@@ -10,8 +11,9 @@ class urlscan(subdomain_enum):
         "created_date": "2022-06-09",
         "author": "@TheTechromancer",
     }
-    options = {"urls": False}
-    options_desc = {"urls": "Emit URLs in addition to DNS_NAMEs"}
+
+    class Config(BaseModuleConfig):
+        urls: bool = Field(False, description="Emit URLs in addition to DNS_NAMEs")
 
     base_url = "https://urlscan.io/api/v1"
 
diff --git a/bbot/modules/virustotal.py b/bbot/modules/virustotal.py
index 75766b38d8..fac3738062 100644
--- a/bbot/modules/virustotal.py
+++ b/bbot/modules/virustotal.py
@@ -1,4 +1,5 @@
 from bbot.modules.templates.subdomain_enum import subdomain_enum_apikey
+from bbot.core.config.models import BaseModuleConfig, Field
 
 
 class virustotal(subdomain_enum_apikey):
@@ -9,10 +10,10 @@ class virustotal(subdomain_enum_apikey):
         "description": "Query VirusTotal's API for subdomains",
         "created_date": "2022-08-25",
         "author": "@TheTechromancer",
-        "auth_required": True,
     }
-    options = {"api_key": ""}
-    options_desc = {"api_key": "VirusTotal API Key"}
+
+    class Config(BaseModuleConfig):
+        api_key: str | list[str] = Field("", description="VirusTotal API Key", sensitive=True, mandatory=True)
 
     base_url = "https://www.virustotal.com/api/v3"
     api_page_iter_kwargs = {"json": False, "next_key": lambda r: r.json().get("links", {}).get("next", "")}
diff --git a/bbot/modules/wafw00f.py b/bbot/modules/wafw00f.py
index 59083b7d34..42236f16d5 100644
--- a/bbot/modules/wafw00f.py
+++ b/bbot/modules/wafw00f.py
@@ -3,6 +3,7 @@
 
 # disable wafw00f logging
 import logging
+from bbot.core.config.models import BaseModuleConfig, Field
 
 wafw00f_logger = logging.getLogger("wafw00f")
 wafw00f_logger.setLevel(logging.CRITICAL + 100)
@@ -24,8 +25,10 @@ class wafw00f(BaseModule):
 
     deps_pip = ["wafw00f~=2.3.1"]
 
-    options = {"generic_detect": True}
-    options_desc = {"generic_detect": "When no specific WAF detections are made, try to perform a generic detect"}
+    class Config(BaseModuleConfig):
+        generic_detect: bool = Field(
+            True, description="When no specific WAF detections are made, try to perform a generic detect"
+        )
 
     in_scope_only = True
     per_hostport_only = True
diff --git a/bbot/modules/wayback.py b/bbot/modules/wayback.py
index d8d0d57175..d23ad2a981 100644
--- a/bbot/modules/wayback.py
+++ b/bbot/modules/wayback.py
@@ -1,6 +1,7 @@
 from datetime import datetime
 
 from bbot.modules.templates.subdomain_enum import subdomain_enum
+from bbot.core.config.models import BaseModuleConfig, Field
 
 
 class wayback(subdomain_enum):
@@ -12,11 +13,14 @@ class wayback(subdomain_enum):
         "created_date": "2022-04-01",
         "author": "@liquidsec",
     }
-    options = {"urls": False, "garbage_threshold": 10}
-    options_desc = {
-        "urls": "emit URLs in addition to DNS_NAMEs",
-        "garbage_threshold": "Dedupe similar urls if they are in a group of this size or higher (lower values == less garbage data)",
-    }
+
+    class Config(BaseModuleConfig):
+        urls: bool = Field(False, description="emit URLs in addition to DNS_NAMEs")
+        garbage_threshold: int = Field(
+            10,
+            description="Dedupe similar urls if they are in a group of this size or higher (lower values == less garbage data)",
+        )
+
     in_scope_only = True
 
     base_url = "http://web.archive.org"
diff --git a/bbot/modules/webbrute.py b/bbot/modules/webbrute.py
index 90dfa87da0..b3e9631ccf 100644
--- a/bbot/modules/webbrute.py
+++ b/bbot/modules/webbrute.py
@@ -1,10 +1,12 @@
 import random
 import string
+from typing import Union
 
 import blasthttp
 
 from bbot.core.helpers.web.web import iter_batch_results
 from bbot.modules.base import BaseModule
+from bbot.core.config.models import BaseModuleConfig, Field
 
 
 class webbrute(BaseModule):
@@ -17,25 +19,20 @@ class webbrute(BaseModule):
         "author": "@liquidsec",
     }
 
-    options = {
-        "wordlist": "https://raw.githubusercontent.com/danielmiessler/SecLists/master/Discovery/Web-Content/raft-small-directories.txt",
-        "lines": 5000,
-        "max_depth": 0,
-        "extensions": "",
-        "ignore_case": False,
-        "rate": 0,
-        "concurrency": 50,
-    }
-
-    options_desc = {
-        "wordlist": "Specify wordlist to use when finding directories. Accepts a list of URLs/paths to merge multiple wordlists (duplicates are removed).",
-        "lines": "take only the first N lines from the wordlist when finding directories",
-        "max_depth": "the maximum directory depth to attempt to solve",
-        "extensions": "Optionally include a list of extensions to extend the keyword with (comma separated)",
-        "ignore_case": "Only put lowercase words into the wordlist",
-        "rate": "Maximum requests per second (0 = unlimited)",
-        "concurrency": "Number of concurrent requests per URL being fuzzed",
-    }
+    class Config(BaseModuleConfig):
+        wordlist: Union[str, list[str]] = Field(
+            "https://raw.githubusercontent.com/danielmiessler/SecLists/master/Discovery/Web-Content/raft-small-directories.txt",
+            description="Specify wordlist to use when finding directories. Accepts a list of URLs/paths to merge multiple wordlists (duplicates are removed).",
+        )
+        lines: int = Field(5000, description="take only the first N lines from the wordlist when finding directories")
+        max_depth: int = Field(0, description="the maximum directory depth to attempt to solve")
+        extensions: Union[str, list[str]] = Field(
+            "",
+            description="Optionally include a list of extensions to extend the keyword with (comma separated or YAML list)",
+        )
+        ignore_case: bool = Field(False, description="Only put lowercase words into the wordlist")
+        rate: int = Field(0, description="Maximum requests per second (0 = unlimited)")
+        concurrency: int = Field(50, description="Number of concurrent requests per URL being fuzzed")
 
     banned_characters = {" "}
     blacklist = ["images", "css", "image"]
diff --git a/bbot/modules/webbrute_shortnames.py b/bbot/modules/webbrute_shortnames.py
index 613d884e38..a74294f6d1 100644
--- a/bbot/modules/webbrute_shortnames.py
+++ b/bbot/modules/webbrute_shortnames.py
@@ -2,8 +2,10 @@
 import re
 import random
 import string
+from typing import Union
 
 from bbot.modules.webbrute import webbrute
+from bbot.core.config.models import BaseModuleConfig, Field
 
 
 class webbrute_shortnames(webbrute):
@@ -16,27 +18,29 @@ class webbrute_shortnames(webbrute):
         "author": "@liquidsec",
     }
 
-    options = {
-        "wordlist_extensions": "",  # default is defined within setup function
-        "max_depth": 1,
-        "extensions": "",
-        "find_common_prefixes": False,
-        "find_delimiters": True,
-        "find_subwords": False,
-        "max_predictions": 250,
-        "rate": 0,
-    }
-
-    options_desc = {
-        "wordlist_extensions": "Specify wordlist to use when making extension lists. Accepts a list of URLs/paths to merge multiple wordlists (duplicates are removed).",
-        "max_depth": "the maximum directory depth to attempt to solve",
-        "extensions": "Optionally include a list of extensions to extend the keyword with (comma separated)",
-        "find_common_prefixes": "Attempt to automatically detect common prefixes and make additional runs against them",
-        "find_delimiters": "Attempt to detect common delimiters and make additional runs against them",
-        "find_subwords": "Attempt to detect subwords and make additional runs against them",
-        "max_predictions": "The maximum number of predictions to generate per shortname prefix",
-        "rate": "Rate of requests per second (default: 0)",
-    }
+    class Config(BaseModuleConfig):
+        wordlist_extensions: Union[str, list[str]] = Field(
+            "",
+            description="Specify wordlist to use when making extension lists. Accepts a list of URLs/paths to merge multiple wordlists (duplicates are removed).",
+        )
+        max_depth: int = Field(1, description="the maximum directory depth to attempt to solve")
+        extensions: str = Field(
+            "", description="Optionally include a list of extensions to extend the keyword with (comma separated)"
+        )
+        find_common_prefixes: bool = Field(
+            False,
+            description="Attempt to automatically detect common prefixes and make additional runs against them",
+        )
+        find_delimiters: bool = Field(
+            True, description="Attempt to detect common delimiters and make additional runs against them"
+        )
+        find_subwords: bool = Field(
+            False, description="Attempt to detect subwords and make additional runs against them"
+        )
+        max_predictions: int = Field(
+            250, description="The maximum number of predictions to generate per shortname prefix"
+        )
+        rate: int = Field(0, description="Rate of requests per second (default: 0)")
 
     deps_pip = ["numpy"]
     in_scope_only = True
diff --git a/bbot/modules/wpscan.py b/bbot/modules/wpscan.py
index b7bffb8dae..8005a6e3e3 100644
--- a/bbot/modules/wpscan.py
+++ b/bbot/modules/wpscan.py
@@ -1,5 +1,6 @@
 import json
 from bbot.modules.base import BaseModule
+from bbot.core.config.models import BaseModuleConfig, Field
 
 
 class wpscan(BaseModule):
@@ -12,24 +13,19 @@ class wpscan(BaseModule):
         "author": "@domwhewell-sage",
     }
 
-    options = {
-        "api_key": "",
-        "enumerate": "vp,vt,cb,dbe",
-        "threads": 5,
-        "request_timeout": 5,
-        "connection_timeout": 2,
-        "disable_tls_checks": True,
-        "force": False,
-    }
-    options_desc = {
-        "api_key": "WPScan API Key",
-        "enumerate": "Enumeration Process see wpscan help documentation (default: vp,vt,cb,dbe)",
-        "threads": "How many wpscan threads to spawn (default is 5)",
-        "request_timeout": "The request timeout in seconds (default 5)",
-        "connection_timeout": "The connection timeout in seconds (default 2)",
-        "disable_tls_checks": "Disables the SSL/TLS certificate verification (Default True)",
-        "force": "Do not check if the target is running WordPress or returns a 403",
-    }
+    class Config(BaseModuleConfig):
+        api_key: str | list[str] = Field("", description="WPScan API Key", sensitive=True)
+        enumerate: str = Field(
+            "vp,vt,cb,dbe", description="Enumeration Process see wpscan help documentation (default: vp,vt,cb,dbe)"
+        )
+        threads: int = Field(5, description="How many wpscan threads to spawn (default is 5)")
+        request_timeout: int = Field(5, description="The request timeout in seconds (default 5)")
+        connection_timeout: int = Field(2, description="The connection timeout in seconds (default 2)")
+        disable_tls_checks: bool = Field(
+            True, description="Disables the SSL/TLS certificate verification (Default True)"
+        )
+        force: bool = Field(False, description="Do not check if the target is running WordPress or returns a 403")
+
     deps_apt = ["curl", "make", "gcc"]
     deps_ansible = [
         {
diff --git a/bbot/scanner/__init__.py b/bbot/scanner/__init__.py
index 17338fd73e..24bedbe1a4 100644
--- a/bbot/scanner/__init__.py
+++ b/bbot/scanner/__init__.py
@@ -1,4 +1,33 @@
-from .preset import Preset
+from .preset import (
+    BaseModuleConfig,
+    BBOTConfig,
+    DepsConfig,
+    DepsToolConfig,
+    DnsConfig,
+    EngineConfig,
+    Preset,
+    PresetSchema,
+    PresetValidationError,
+    ScopeConfig,
+    WebConfig,
+    validate_preset,
+    validate_preset_file,
+)
 from .scanner import Scanner
 
-__all__ = ["Preset", "Scanner"]
+__all__ = [
+    "BBOTConfig",
+    "BaseModuleConfig",
+    "DepsConfig",
+    "DepsToolConfig",
+    "DnsConfig",
+    "EngineConfig",
+    "Preset",
+    "PresetSchema",
+    "PresetValidationError",
+    "Scanner",
+    "ScopeConfig",
+    "WebConfig",
+    "validate_preset",
+    "validate_preset_file",
+]
diff --git a/bbot/scanner/preset/__init__.py b/bbot/scanner/preset/__init__.py
index 063f3659d2..fb2e423dfd 100644
--- a/bbot/scanner/preset/__init__.py
+++ b/bbot/scanner/preset/__init__.py
@@ -1,3 +1,30 @@
+from bbot.core.config.models import (
+    BaseModuleConfig,
+    BBOTConfig,
+    DepsConfig,
+    DepsToolConfig,
+    DnsConfig,
+    EngineConfig,
+    PresetSchema,
+    ScopeConfig,
+    WebConfig,
+)
+
 from .preset import Preset
+from .validate import PresetValidationError, validate_preset, validate_preset_file
 
-__all__ = ["Preset"]
+__all__ = [
+    "BBOTConfig",
+    "BaseModuleConfig",
+    "DepsConfig",
+    "DepsToolConfig",
+    "DnsConfig",
+    "EngineConfig",
+    "Preset",
+    "PresetSchema",
+    "PresetValidationError",
+    "ScopeConfig",
+    "WebConfig",
+    "validate_preset",
+    "validate_preset_file",
+]
diff --git a/bbot/scanner/preset/args.py b/bbot/scanner/preset/args.py
index b57d3dbb1e..b29dd09b8f 100644
--- a/bbot/scanner/preset/args.py
+++ b/bbot/scanner/preset/args.py
@@ -1,28 +1,51 @@
 import os
-import re
 import logging
 import argparse
-from omegaconf import OmegaConf
 
 from bbot.errors import *
-from bbot.core.helpers.misc import chain_lists, get_closest_match, get_keys_in_dot_syntax
-
-log = logging.getLogger("bbot.presets.args")
+from bbot.core.config.merge import dotted_set
+from bbot.core.config.models import coerce_value
+from bbot.core.helpers.misc import chain_lists
+
+
+def _parse_cli_value(raw: str, adapter=None):
+    """Parse the RHS of a `-c a.b.c=value` argument.
+
+    `adapter` is the target field's pydantic TypeAdapter (from the config type
+    index), or None when the field is unknown. Coercion follows the declared type:
+    string fields keep the literal text (lossless), bool fields produce a real bool,
+    int/float fields parse via YAML, and unknown fields fall back to plain YAML
+    coercion.
+    """
+    if raw == "":
+        return ""
+    return coerce_value(raw, adapter)
+
+
+def parse_dotted_cli(entries, index=None):
+    """Parse one or more `a.b.c=value` strings into a nested dict.
+
+    If `index` (the config type index from `MODULE_LOADER.config_type_index`) is
+    provided, each value is coerced toward its declared type so string fields keep
+    their literal text and typed fields get real typed values.
+    """
+    result: dict = {}
+    for entry in entries:
+        if "=" not in entry:
+            raise ValueError(f'Expected "key=value" (got {entry!r})')
+        path, _, raw = entry.partition("=")
+        path = path.strip()
+        if not path:
+            raise ValueError(f'Empty key in "{entry}"')
+        adapter = index.get(path) if index is not None else None
+        dotted_set(result, path, _parse_cli_value(raw.strip(), adapter))
+    return result
 
 
-universal_module_options = {
-    "batch_size": "The number of events to process in a single batch (only applies to batch modules)",
-    "module_threads": "How many event handlers to run in parallel",
-    "module_timeout": "Max time in seconds to spend handling each event or batch of events",
-}
+log = logging.getLogger("bbot.presets.args")
 
 
 class BBOTArgs:
-    # module config options to exclude from validation
-    exclude_from_validation = re.compile(
-        r".*modules\.[a-z0-9_]+\.(?:" + "|".join(universal_module_options.keys()) + ")$"
-    )
-
     scan_examples = [
         (
             "Subdomains",
@@ -200,11 +223,12 @@ def preset_from_args(self):
         if self.parsed.user_agent_suffix:
             args_preset.core.merge_custom({"web": {"user_agent_suffix": self.parsed.user_agent_suffix}})
 
-        # CLI config options (dot-syntax)
+        # CLI config options (dot-syntax) -- parsed type-aware so string fields
+        # keep their literal value (e.g. an all-numeric password isn't coerced to int)
+        index = self._config_type_index()
         for config_arg in self.parsed.config:
             try:
-                # if that fails, try to parse as key=value syntax
-                args_preset.core.merge_custom(OmegaConf.from_cli([config_arg]))
+                args_preset.core.merge_custom(parse_dotted_cli([config_arg], index=index))
             except Exception as e:
                 raise BBOTArgumentError(f'Error parsing command-line config option: "{config_arg}": {e}')
 
@@ -467,17 +491,25 @@ def sanitize_args(self):
         if self.parsed.fast_mode:
             self.parsed.preset += ["fast"]
 
+    def _config_type_index(self):
+        """Config type index for type-directed CLI parsing, or None if it can't
+        be built yet (then parsing falls back to plain YAML coercion)."""
+        try:
+            return self.preset.module_loader.config_type_index
+        except Exception:
+            return None
+
     def validate(self):
-        # validate config options
-        sentinel = object()
-        all_options = set(get_keys_in_dot_syntax(self.preset.core.default_config))
-        for c in self.parsed.config:
-            c = c.split("=")[0].strip()
-            v = OmegaConf.select(self.preset.core.default_config, c, default=sentinel)
-            # if option isn't in the default config
-            if v is sentinel:
-                # skip if it's excluded from validation
-                if self.exclude_from_validation.match(c):
-                    continue
-                # otherwise, ensure it exists as a module option
-                raise ValidationError(get_closest_match(c, all_options, msg="config option"))
+        """
+        Validate the CLI `-c key=value` arguments against the composite
+        preset schema. Catches typos like `bbot -c modules.shoudn.api_key=x`
+        with a closest-match suggestion.
+        """
+        from .validate import validate_preset
+
+        if not self.parsed.config:
+            return
+        cli_dict = parse_dotted_cli(self.parsed.config, index=self._config_type_index())
+        errs = validate_preset({"config": cli_dict}, module_loader=self.preset.module_loader)
+        if errs:
+            raise ValidationError("\n".join(str(e) for e in errs))
diff --git a/bbot/scanner/preset/environ.py b/bbot/scanner/preset/environ.py
index f39e863ac7..4abe3e92e7 100644
--- a/bbot/scanner/preset/environ.py
+++ b/bbot/scanner/preset/environ.py
@@ -1,6 +1,5 @@
 import os
 import sys
-import omegaconf
 from pathlib import Path
 
 from bbot.core.helpers.misc import (
@@ -33,11 +32,6 @@ def increase_limit(new_limit):
 increase_limit(65535)
 
 
-# Custom custom omegaconf resolver to get environment variables
-def env_resolver(env_name, default=None):
-    return os.getenv(env_name, default)
-
-
 def add_to_path(v, k="PATH", environ=None):
     """
     Add an entry to a colon-separated PATH variable.
@@ -65,26 +59,25 @@ def add_to_path(v, k="PATH", environ=None):
 add_to_path(local_bin_dir)
 
 
-# Register the new resolver
-# this allows you to substitute environment variables in your config like "${env:PATH}""
-omegaconf.OmegaConf.register_new_resolver("env", env_resolver)
-
-
 class BBOTEnviron:
     def __init__(self, preset):
         self.preset = preset
 
     def flatten_config(self, config, base="bbot"):
         """
-        Flatten a JSON-like config into a list of environment variables:
-            {"modules": [{"http": {"threads": 10}}]} --> "BBOT_MODULES_BLASTHTTP_THREADS=10"
+        Flatten a JSON-like config into a sequence of (KEY, value) env var pairs:
+            {"modules": {"http": {"threads": 10}}} --> ("BBOT_MODULES_HTTP_THREADS", "10")
+
+        Lists are skipped (they don't translate cleanly to env var values).
+        None values are skipped too, since `str(None)` would write the literal
+        string "None" into the env, which is never a useful value for a consumer.
         """
-        if type(config) == omegaconf.dictconfig.DictConfig:
+        if isinstance(config, dict):
             for k, v in config.items():
                 new_base = f"{base}_{k}"
-                if type(v) == omegaconf.dictconfig.DictConfig:
+                if isinstance(v, dict):
                     yield from self.flatten_config(v, base=new_base)
-                elif type(v) != omegaconf.listconfig.ListConfig:
+                elif v is not None and not isinstance(v, list):
                     yield (new_base.upper(), str(v))
 
     def prepare(self):
@@ -136,7 +129,7 @@ def prepare(self):
         import urllib3
 
         urllib3.disable_warnings()
-        ssl_verify = self.preset.config.get("ssl_verify", False)
+        ssl_verify = self.preset.config.get("web", {}).get("ssl_verify", False)
 
         global REQUESTS_PATCHED
         if not ssl_verify and not REQUESTS_PATCHED:
diff --git a/bbot/scanner/preset/preset.py b/bbot/scanner/preset/preset.py
index 4550028c10..fa83af5431 100644
--- a/bbot/scanner/preset/preset.py
+++ b/bbot/scanner/preset/preset.py
@@ -1,11 +1,9 @@
 import os
 import yaml
 import logging
-import omegaconf
 import traceback
 from copy import copy
 from pathlib import Path
-from contextlib import suppress
 
 from .path import PRESET_PATH
 
@@ -93,7 +91,7 @@ class Preset(metaclass=BasePreset):
         require_flags (set): Require modules to have these flags. When set, automatically removes offending modules.
         exclude_flags (set): Exclude modules that have any of these flags. When set, automatically removes offending modules.
         module_dirs (set): Custom directories from which to load modules (alias to `self.module_loader.module_dirs`). When set, automatically preloads contained modules.
-        config (omegaconf.dictconfig.DictConfig): BBOT config (alias to `core.config`)
+        config (dict): BBOT config (alias to `core.config`)
         core (BBOTCore): Local copy of BBOTCore object.
         verbose (bool): Whether log level is currently set to verbose. When set, updates log level for all BBOT log handlers.
         debug (bool): Whether log level is currently set to debug. When set, updates log level for all BBOT log handlers.
@@ -179,6 +177,8 @@ def __init__(
         self._module_loader = None
         self._yaml_str = ""
         self._baked = False
+        # whether this preset has been validated+coerced (a precondition for bake())
+        self._validated = False
 
         self._default_output_modules = None
         self._default_internal_modules = None
@@ -249,7 +249,7 @@ def __init__(
         # bbot core config
         self.core = CORE.copy()
         if config is None:
-            config = omegaconf.OmegaConf.create({})
+            config = {}
         # merge custom configs if specified by the user
         self.core.merge_custom(config)
 
@@ -398,6 +398,8 @@ def merge(self, other):
         # transfer args
         if other._args is not None:
             self._args = other._args
+        # the preset changed -- it must be re-validated before baking
+        self._validated = False
 
     def bake(self, scan=None):
         """
@@ -431,12 +433,18 @@ def bake(self, scan=None):
             os.environ.clear()
             os.environ.update(os_environ)
 
+        # bake() requires an already validated + coerced preset. Validation and
+        # coercion are a PRECONDITION (Preset.validate(), the caller's
+        # responsibility) -- enforced here so an unvalidated preset never bakes.
+        if not self._validated:
+            raise ValidationError(
+                "Preset must be validated before baking -- call .validate() first "
+                "(Scanner and the CLI do this for you)."
+            )
+
         # validate log level options
         baked_preset.apply_log_level(apply_core=scan is not None)
 
-        # validate flags, config options
-        baked_preset.validate()
-
         # now that our requirements / exclusions are validated, we can start enabling modules
         # enable scan modules
         for module in baked_preset.explicit_scan_modules:
@@ -597,16 +605,14 @@ def apply_log_level(self, apply_core=False):
             if apply_core:
                 self.core.logger.log_level = "CRITICAL"
                 for key in ("verbose", "debug"):
-                    with suppress(omegaconf.errors.ConfigKeyError):
-                        del self.core.custom_config[key]
+                    self.core.custom_config.pop(key, None)
         else:
             # then debug
             if self.debug:
                 self.verbose = False
                 if apply_core:
                     self.core.logger.log_level = "DEBUG"
-                    with suppress(omegaconf.errors.ConfigKeyError):
-                        del self.core.custom_config["verbose"]
+                    self.core.custom_config.pop("verbose", None)
             else:
                 # finally verbose
                 if self.verbose and apply_core:
@@ -690,6 +696,14 @@ def from_dict(cls, preset_dict, name=None, _exclude=None, _log=False):
         Examples:
             >>> preset = Preset.from_dict({"target": ["evilcorp.com"], "modules": ["portscan"]})
         """
+        from .validate import prevalidate_preset
+
+        # Gate top-level keys only -- .get() below would silently drop a typo like
+        # `modlues:`. Config values + _validated are validate()'s job, not from_dict's.
+        errs = prevalidate_preset(preset_dict)
+        if errs:
+            raise ValidationError("\n".join(str(e) for e in errs))
+
         from bbot.core.helpers.misc import chain_lists
 
         # Handle seeds and targets from dict
@@ -791,7 +805,7 @@ def from_yaml_file(cls, filename, _exclude=None, _log=False):
             except FileNotFoundError:
                 raise PresetNotFoundError(f'Could not find preset at "{filename}" - file does not exist')
             preset = cls.from_dict(
-                omegaconf.OmegaConf.create(yaml_str),
+                yaml.safe_load(yaml_str) or {},
                 name=filename.stem,
                 _exclude=_exclude,
                 _log=_log,
@@ -816,7 +830,7 @@ def from_yaml_string(cls, yaml_preset):
             >>> - portscan'''
             >>> preset = Preset.from_yaml_string(yaml_string)
         """
-        return cls.from_dict(omegaconf.OmegaConf.create(yaml_preset))
+        return cls.from_dict(yaml.safe_load(yaml_preset) or {})
 
     def to_dict(self, include_target=False, full_config=False, redact_secrets=False):
         """
@@ -841,10 +855,9 @@ def to_dict(self, include_target=False, full_config=False, redact_secrets=False)
 
         # config
         if full_config:
-            config = self.core.config
+            config = dict(self.core.config)
         else:
-            config = self.core.custom_config
-        config = omegaconf.OmegaConf.to_object(config)
+            config = dict(self.core.custom_config)
         if redact_secrets:
             config = self.core.no_secrets_config(config)
         if config:
@@ -967,8 +980,29 @@ def _is_valid_module(self, module, module_type, name_only=False, raise_error=Tru
 
     def validate(self):
         """
-        Validate module/flag exclusions/requirements, and CLI config options if applicable.
+        Coerce config values to their declared types and validate the preset.
+
+        This is a PRECONDITION for bake() (which enforces it): a preset must be
+        validated before it can be baked. Idempotent -- safe to call more than
+        once. Sets ``self._validated = True`` on success and returns ``self`` so
+        it can be chained (e.g. ``preset.validate().bake()``).
         """
+        from bbot.core.config.models import coerce_config
+
+        # Coerce config values toward their declared types
+        try:
+            index = self.module_loader.config_type_index
+            self.core.custom_config = coerce_config(self.core.custom_config, index)
+        except Exception as e:
+            log.debug(f"Config coercion error: {e}")
+
+        # Validate the (coerced) user config against the schema
+        from .validate import validate_preset
+
+        errs = validate_preset({"config": dict(self.core.custom_config)}, module_loader=self.module_loader)
+        if errs:
+            raise ValidationError("\n".join(str(e) for e in errs))
+
         if self._cli:
             self.args.validate()
 
@@ -978,6 +1012,11 @@ def validate(self):
                 raise ValidationError(
                     get_closest_match(excluded_module, self.module_loader.all_module_choices, msg="module")
                 )
+        # validate declared module names so typos fail early
+        for scan_module in self.explicit_scan_modules:
+            self._is_valid_module(scan_module, "scan", name_only=True)
+        for output_module in self.explicit_output_modules:
+            self._is_valid_module(output_module, "output", name_only=True)
         # validate excluded flags
         for excluded_flag in self.exclude_flags:
             if excluded_flag not in self.module_loader.flag_choices:
@@ -991,6 +1030,9 @@ def validate(self):
             if flag not in self.module_loader.flag_choices:
                 raise ValidationError(get_closest_match(flag, self.module_loader.flag_choices, msg="flag"))
 
+        self._validated = True
+        return self
+
     @property
     def all_presets(self):
         """
diff --git a/bbot/scanner/preset/validate.py b/bbot/scanner/preset/validate.py
new file mode 100644
index 0000000000..afed983899
--- /dev/null
+++ b/bbot/scanner/preset/validate.py
@@ -0,0 +1,317 @@
+"""
+Public `validate_preset()` API for BBOT presets.
+
+Given a preset-as-dict (i.e. what comes out of a YAML file before it's
+instantiated), return a list of human-readable errors.
+
+The validator does a single pass against a composite pydantic schema
+(built once per module-loader state by `ModuleLoader.validation_schema`)
+that covers every layer in one tree:
+
+- top-level preset keys (e.g. `modlues:` typo)
+- global config (e.g. `scope.strct`, `web.http_timoeut`)
+- unknown module names (e.g. `modules.nucleii`)
+- per-module config (e.g. `modules.nuclei.tgas`)
+
+Errors are aggregated so a user with multiple typos sees them all. The
+caller decides whether to raise or just print them.
+"""
+
+from __future__ import annotations
+
+import logging
+from dataclasses import dataclass
+from pathlib import Path
+from typing import Any
+
+from pydantic import ValidationError
+
+from bbot.errors import BBOTError
+from bbot.core.config.models import PresetSchema
+from bbot.core.helpers.misc import get_closest_match
+
+
+def _preset_top_level_keys() -> set[str]:
+    """Field names and aliases declared on PresetSchema, used for closest-match
+    suggestions on unknown top-level preset keys (e.g. `modlues` -> `modules`)."""
+    keys: set[str] = set()
+    for name, field in PresetSchema.model_fields.items():
+        keys.add(name)
+        alias = getattr(field, "alias", None)
+        if alias:
+            keys.add(alias)
+    return keys
+
+
+_PRESET_KEYS = _preset_top_level_keys()
+
+
+log = logging.getLogger("bbot.presets.validate")
+
+
+@dataclass
+class PresetValidationError:
+    """A single validation problem. Stringifies to a human-readable message."""
+
+    where: str  # "preset", "config", "module:<name>"
+    path: str  # dotted location, e.g. "scope.strict" or ""
+    message: str
+
+    def __str__(self) -> str:
+        loc = f"{self.where}:{self.path}" if self.path else self.where
+        return f"[{loc}] {self.message}"
+
+
+def _classify_loc(loc: tuple) -> tuple[str, str]:
+    """
+    Map a pydantic error path to a (where, path) pair.
+
+    Examples:
+        ('modlues',)                              -> ('preset', 'modlues')
+        ('config', 'scope', 'strct')              -> ('config', 'scope.strct')
+        ('config', 'modules', 'nucleii')          -> ('preset', 'config.modules.nucleii')
+        ('config', 'modules', 'nuclei', 'tgas')   -> ('module:nuclei', 'tgas')
+    """
+    parts = [str(p) for p in loc]
+
+    if len(parts) >= 2 and parts[0] == "config" and parts[1] == "modules":
+        # Error is somewhere under config.modules.*
+        if len(parts) == 2:
+            # The `modules` mapping itself has the wrong shape (e.g. a list).
+            # Classify as a config-level error rather than walking deeper.
+            return ("config", "modules")
+        if len(parts) == 3:
+            # The module name itself is unknown (extra_forbidden on ModulesSchema)
+            return ("preset", ".".join(parts))
+        # Error is within a known module's config
+        module_name = parts[2]
+        return (f"module:{module_name}", ".".join(parts[3:]))
+
+    if parts and parts[0] == "config":
+        return ("config", ".".join(parts[1:]))
+
+    return ("preset", ".".join(parts))
+
+
+def _format_msg(err: dict, known_modules: set | None = None, known_paths: set | None = None) -> str:
+    kind = err["type"]
+    input_value = err.get("input")
+    loc = err["loc"]
+    field = str(loc[-1]) if loc else ""
+    path = ".".join(str(p) for p in loc)
+
+    if kind == "extra_forbidden":
+        # Special-case unknown module name (config.modules.<bad>) — users get
+        # a suggestion drawn from the set of known module names.
+        if len(loc) == 3 and loc[0] == "config" and loc[1] == "modules":
+            return get_closest_match(field, known_modules or set(), msg="module")
+        # Top-level preset key (e.g. `modlues:`) — suggest from PresetSchema
+        # field names rather than the dotted config-path universe, so users
+        # get useful hints like "Did you mean 'modules'?".
+        if len(loc) == 1:
+            return get_closest_match(field, _PRESET_KEYS, msg="preset option")
+        # For everything else, suggest from the known dotted-path universe
+        # (`web.spier_distance` → `web.spider_distance`).
+        if known_paths:
+            # strip the leading "config." prefix when matching, since
+            # default_config dotted paths don't include it
+            lookup_path = ".".join(str(p) for p in loc[1:]) if loc and loc[0] == "config" else path
+            return get_closest_match(lookup_path, known_paths, msg="config option")
+        msg = f"Unknown option: {field!r}"
+        if isinstance(input_value, (str, int, bool, float)):
+            msg += f" (value: {input_value!r})"
+        elif isinstance(input_value, list) and len(input_value) <= 5:
+            msg += f" (value: {input_value!r})"
+        return msg
+
+    if kind in {"int_parsing", "int_type"}:
+        return f"Expected an integer, got {type(input_value).__name__}: {input_value!r}"
+    if kind in {"bool_parsing", "bool_type"}:
+        return f"Expected a boolean, got {type(input_value).__name__}: {input_value!r}"
+    if kind == "string_type":
+        return f"Expected a string, got {type(input_value).__name__}: {input_value!r}"
+    if kind == "list_type":
+        return f"Expected a list, got {type(input_value).__name__}"
+    if kind == "dict_type":
+        return f"Expected a mapping, got {type(input_value).__name__}"
+    if kind == "literal_error":
+        # pydantic stashes the allowed values in ctx["expected"] formatted like:
+        # "'manual', 'technology', 'severe' or 'budget'"
+        ctx = err.get("ctx") or {}
+        expected = ctx.get("expected", "")
+        return f"Expected one of {expected}, got {input_value!r}" if expected else err.get("msg", "")
+    if kind == "missing":
+        return f"Required option {field!r} is missing"
+    if kind == "value_error":
+        # Pydantic wraps ValueError raised inside a field_validator and prefixes
+        # the message with "Value error, ". Surface the original ValueError text
+        # so the error reads naturally.
+        ctx = err.get("ctx") or {}
+        inner = ctx.get("error")
+        if inner is not None:
+            return str(inner)
+        msg = err.get("msg", "")
+        prefix = "Value error, "
+        return msg[len(prefix) :] if msg.startswith(prefix) else msg
+
+    # Fallback to pydantic's own message
+    return err["msg"] if err.get("msg") else f"validation error at {path}"
+
+
+def _format_errors(
+    exc: ValidationError,
+    known_modules: set | None = None,
+    known_paths: set | None = None,
+) -> list[PresetValidationError]:
+    out: list[PresetValidationError] = []
+    for err in exc.errors():
+        where, path = _classify_loc(err["loc"])
+        out.append(PresetValidationError(where=where, path=path, message=_format_msg(err, known_modules, known_paths)))
+    return out
+
+
+def prevalidate_preset(preset_dict: Any) -> list[PresetValidationError]:
+    """Validate a preset's top-level KEY names only -- the gate `Preset.from_dict`
+    runs up front. Reports every unknown/typo'd key with a closest-match hint;
+    config VALUES are validated later by `Preset.validate()`, not here.
+
+    Examples:
+        >>> print(prevalidate_preset({"modlues": ["nuclei"]})[0])
+        [preset:modlues] Could not find preset option "modlues". Did you mean "modules"?
+    """
+    if not isinstance(preset_dict, dict):
+        return [PresetValidationError("preset", "", f"Expected a mapping, got {type(preset_dict).__name__}")]
+    errors: list[PresetValidationError] = []
+    for key in preset_dict:
+        if key not in _PRESET_KEYS:
+            errors.append(
+                PresetValidationError(
+                    "preset", str(key), get_closest_match(str(key), _PRESET_KEYS, msg="preset option")
+                )
+            )
+    return errors
+
+
+def validate_preset(preset_dict: Any, module_loader=None) -> list[PresetValidationError]:
+    """
+    Validate a preset dict against BBOT's composite schema.
+
+    Returns a list of `PresetValidationError` objects. An empty list means
+    the preset is valid. Errors from all layers are aggregated, so a user
+    with multiple typos sees them all at once.
+
+    **Side effect**: any custom `module_dirs` declared in the preset (either
+    at top level or inside `config`) are registered with `module_loader` so
+    their modules become known. Without this, modules from a custom dir
+    would be falsely reported as unknown. Idempotent — `add_module_dir`
+    short-circuits on already-loaded directories.
+
+    Args:
+        preset_dict: Preset as a plain dict (e.g. from `yaml.safe_load`).
+        module_loader: Optional module loader. Falls back to the global
+            `MODULE_LOADER` if not provided.
+
+    Examples:
+        >>> errors = validate_preset({"modlues": ["nuclei"]})
+        >>> print(errors[0])
+        [preset:modlues] Unknown option: 'modlues' (value: ['nuclei'])
+    """
+    if not isinstance(preset_dict, dict):
+        return [PresetValidationError("preset", "", f"Expected a dict, got {type(preset_dict).__name__}")]
+
+    if module_loader is None:
+        from bbot.core.modules import MODULE_LOADER
+
+        module_loader = MODULE_LOADER
+
+    errors: list[PresetValidationError] = []
+
+    # Pre-load any custom module_dirs the preset declares so the composite
+    # schema includes their modules. Defensive iteration — bad shape gets
+    # surfaced by the schema pass below.
+    config_dict = preset_dict.get("config")
+    for source in (
+        preset_dict.get("module_dirs"),
+        config_dict.get("module_dirs") if isinstance(config_dict, dict) else None,
+    ):
+        # Skip non-list shapes (e.g. a string) so we don't iterate characters
+        # and trigger filesystem calls. The schema pass below reports the
+        # actual type error.
+        if not isinstance(source, list):
+            continue
+        for d in source:
+            if not isinstance(d, str):
+                continue
+            # A bad custom module (e.g. a legacy options dict, which preload rejects
+            # via sys.exit) must not kill a caller that just wants a list of errors.
+            try:
+                module_loader.add_module_dir(d)
+            except (SystemExit, Exception) as e:
+                detail = str(e).strip()
+                suffix = f": {detail}" if detail and detail != "1" else ""
+                errors.append(
+                    PresetValidationError("preset", "module_dirs", f"Failed to load module dir {d!r}{suffix}")
+                )
+
+    known_modules = set(module_loader.all_module_choices)
+    # The type index is the single source of truth for known dotted config
+    # paths -- both for coercion AND for "did you mean ...?" suggestions.
+    known_paths = set(module_loader.config_type_index)
+
+    # Validate against the composite schema (rebuilt automatically if new
+    # module_dirs were just preloaded above). Closest-match suggestions
+    # for unknown module names + config options are produced inside the formatter.
+    try:
+        module_loader.validation_schema.model_validate(preset_dict)
+    except ValidationError as e:
+        errors.extend(_format_errors(e, known_modules=known_modules, known_paths=known_paths))
+    except BBOTError as e:
+        # A custom module with an invalid `class Config` raises when the schema is
+        # built/exec'd. Report it instead of letting it propagate out of this API.
+        errors.append(PresetValidationError("preset", "", str(e)))
+
+    # Module names listed in top-level `modules`/`output_modules`/`exclude_modules`
+    # aren't covered by the composite schema (they're a list of strings, not a
+    # nested mapping). Check them explicitly, with the same closest-match hint.
+    # Skip non-list values; the schema pass above already flagged the type error,
+    # and iterating a string here would yield bogus per-character lookups.
+    for key in ("modules", "output_modules", "exclude_modules"):
+        value = preset_dict.get(key)
+        if not isinstance(value, list):
+            continue
+        for name in value:
+            # non-string entries (e.g. a dangling YAML item -> None) already get a
+            # type error from the schema pass; skip so get_closest_match's difflib doesn't choke
+            if not isinstance(name, str):
+                continue
+            if name not in known_modules:
+                hint = get_closest_match(name, known_modules, msg="module")
+                errors.append(PresetValidationError(where="preset", path=key, message=hint))
+
+    return errors
+
+
+def validate_preset_file(path: str | Path, **kwargs) -> list[PresetValidationError]:
+    """Convenience wrapper for validating a YAML preset file on disk.
+
+    Returns a list of errors. A missing file or unreadable YAML is reported
+    as a single error rather than raised, so callers can treat all failure
+    modes uniformly.
+    """
+    import yaml
+
+    try:
+        with open(path) as f:
+            data = yaml.safe_load(f) or {}
+    except FileNotFoundError:
+        return [PresetValidationError("preset", "", f"Preset file not found: {path}")]
+    except OSError as e:
+        return [PresetValidationError("preset", "", f"Could not read preset file {path}: {e}")]
+    except yaml.YAMLError as e:
+        return [PresetValidationError("preset", "", f"Invalid YAML in {path}: {e}")]
+    if not isinstance(data, dict):
+        return [PresetValidationError("preset", "", f"Expected a YAML mapping, got {type(data).__name__}")]
+    return validate_preset(data, **kwargs)
+
+
+__all__ = ["PresetValidationError", "prevalidate_preset", "validate_preset", "validate_preset_file"]
diff --git a/bbot/scanner/scanner.py b/bbot/scanner/scanner.py
index 2eb7a3b9d4..5ac6c1a4d8 100644
--- a/bbot/scanner/scanner.py
+++ b/bbot/scanner/scanner.py
@@ -1,3 +1,4 @@
+import os
 import sys
 import asyncio
 import logging
@@ -76,7 +77,7 @@ class Scanner:
         _status_code (int): The numerical representation of the current scan status, stored for internal use. It is mapped according to the values in `_status_codes`.
         target (Target): Target of scan (alias to `self.preset.target`).
         preset (Preset): The main scan Preset in its baked form.
-        config (omegaconf.dictconfig.DictConfig): BBOT config (alias to `self.preset.config`).
+        config (dict): BBOT config (alias to `self.preset.config`).
         seeds (Target): Scan seeds (by default this is the same as `target`) (alias to `self.preset.seeds`).
         blacklist (Target): Scan blacklist (this takes ultimate precedence) (alias to `self.preset.blacklist`).
         helpers (ConfigAwareHelper): Helper containing various reusable functions, regexes, etc. (alias to `self.preset.helpers`).
@@ -151,6 +152,8 @@ def __init__(
                 raise ValidationError(f'Preset must be of type Preset, not "{type(custom_preset).__name__}"')
             base_preset.merge(custom_preset)
 
+        # validation+coercion is a precondition for baking; Scanner does it for the caller
+        base_preset.validate()
         self.preset = base_preset.bake(self)
 
         self._prepped = False
@@ -182,23 +185,34 @@ def __init__(
         self.name = scan_name.replace("/", "_")
 
         # :)
-        if self.name == "golden_gus":
-            import os
+        if self.name == "golden_gus" and not os.environ.get("NO_COLOR", ""):
             from base64 import b64decode as _d
 
             _a = _d(
                 "ICAgICAgICAgICAgICBfX18KICAqd29vZiogIF9fL18gIGAuICAuLSIiIi0uCiAgICAgICAgICBcXyxgIHwgXC0nICAvICAgKWAtJykKICAgICAgICAgICAiIikgImAiICAgIFwgICgoImAiCiAgICAgICAgICBfX19ZICAsICAgIC4nNyAvfAogICAgICAgICAoXyxfX18vLi4uLWAgKF8vXy8="
             ).decode()
             _m = _d("R3VzIGhhcyBibGVzc2VkIHlvdXIgc2Nhbi4=").decode()
-            no_color = bool(os.environ.get("NO_COLOR", ""))
-            gold = "" if no_color else "\033[1;38;5;220m"
-            green = "" if no_color else "\033[1;38;5;118m"
-            reset = "" if no_color else "\033[0m"
+            gold = "\033[1;38;5;220m"
+            green = "\033[1;38;5;118m"
+            reset = "\033[0m"
             log_to_stderr(
                 f"{gold}{_a}{reset}\n          {green}{_m}{reset}",
                 level="HUGESUCCESS",
                 logname=False,
             )
+        if self.name == "recursive_thetechromancer" and not os.environ.get("NO_COLOR", ""):
+            from base64 import b64decode as _d
+
+            _a = _d(
+                "G1sxOzM4OzU7Njlt4qCE4qCC4qCE4qCE4qKA4qKAG1sxOzM4OzU7MTA0beKjv+Kjv+Kjv+KhvxtbMTszODs1Ozk4beKju+Kjv+KjvxtbMTszODs1OzEzNG3io7/io7/ioL/ioLviorvio7/io78bWzE7Mzg7NTsxNzBt4qGf4qO74qG/4qK/G1sxOzM4OzU7MTY5beKjv+Kjv+Kjv+KjvxtbMTszODs1OzIwNW3io6fioILioILioIAbWzBtChtbMTszODs1OzY5beKggeKggeKggeKggeKigOKjvBtbMTszODs1OzEwNG3io7/io5/io7/io74bWzE7Mzg7NTs5OG3io7/io7/io78bWzE7Mzg7NTsxMzRt4qO/4qGX4qO+4qG04qG74qCn4qCEG1sxOzM4OzU7MTcwbeKggOKggeKhqOKgiRtbMTszODs1OzE2OW3ioonioJvior/io78bWzE7Mzg7NTsyMDVt4qO/4qOG4qCB4qCAG1swbQobWzE7Mzg7NTs2OW3ioIHioIHioIHioIHiorHiob8bWzE7Mzg7NTsxMDRt4qKB4qO+4qO/4qO/G1sxOzM4OzU7OTht4qGH4qK/4qO/G1sxOzM4OzU7MTM0beKhn+KjtOKjv+KggeKggeKggOKggOKggBtbMTszODs1OzE3MG3ioIDioIDioIDioIAbWzE7Mzg7NTsxNjlt4qCA4qCA4qK9G1sxOzM4OzU7MjA1beKjv+Kjv+KghOKghBtbMG0KG1sxOzM4OzU7Njlt4qKA4qCB4qCC4qCB4qCJ4qKVG1sxOzM4OzU7MTA0beKhmOKgieKgm+KgmRtbMTszODs1Ozk4beKig+KgjuKjuxtbMTszODs1OzEzNG3io6PioJ/ioIHioIDioIDioIDioIDioIAbWzE7Mzg7NTsxNzBt4qCA4qCA4qCA4qKAG1sxOzM4OzU7MTY5beKghOKggOKiuOKjvxtbMTszODs1OzIwNW3io7/ioITioIYbWzBtChtbMTszODs1OzY5beKigOKggeKgguKgguKigOKjvRtbMTszODs1OzEwNG3io7/io7/io7fio78bWzE7Mzg7NTs5OG3io7/io7fio78bWzE7Mzg7NTsxMzRt4qOu4qOl4qCA4qCA4qCA4qCA4qCA4qCAG1sxOzM4OzU7MTcwbeKggOKggOKggOKigOKgghtbMTszODs1OzE2OW3ioILiorjio7/iob/ioKbioIEbWzBtChtbMTszODs1OzY5beKgguKggeKigOKigOKigOKjvxtbMTszODs1OzEwNW3io78bWzE7Mzg7NTsxMDRt4qO/4qO/4qO/G1sxOzM4OzU7OTht4qO/4qO/4qO/4qO/G1sxOzM4OzU7MTM0beKjv+KggOKggOKggOKggOKggOKggOKggBtbMTszODs1OzE3MG3ioIDiooDioITiooAbWzE7Mzg7NTsxNjlt4qKA4qO/4qO/4qG/4qOk4qOkG1swbQobWzE7Mzg7NTs2OW3iooDiooDiooDioITioITio78bWzE7Mzg7NTsxMDVt4qO/G1sxOzM4OzU7MTA0beKjv+Kjv+KjvxtbMTszODs1Ozk4beKjv+Kjv+Kjv+KjvxtbMTszODs1OzEzNG3io7/io6DiooDioITioIDiooDiooDio4AbWzE7Mzg7NTsxNzBt4qKA4qCA4qKB4qO04qOm4qO/G1sxOzM4OzU7MTY5beKjv+Kjt+KigOKiiRtbMG0KG1sxOzM4OzU7Njlt4qKA4qCB4qCC4qKA4qKA4qK/G1sxOzM4OzU7MTA1beKivxtbMTszODs1OzEwNG3io7/io7/io7/io78bWzE7Mzg7NTs5OG3io7/io7/io78bWzE7Mzg7NTsxMzRt4qC/4qCf4qCD4qCC4qCC4qCQ4qC+4qO/4qGfG1sxOzM4OzU7MTcwbeKisOKhv+KhmeKiu+Kjv+Kjv+KjvxtbMTszODs1OzE2OW3io4DiooAbWzBtChtbMTszODs1OzY5beKgguKghOKigOKigOKigOKiuOKjrxtbMTszODs1OzEwNG3ioYjioYnio7/io48bWzE7Mzg7NTs5OG3ioInioIHioIDioIAbWzE7Mzg7NTsxMzRt4qCE4qCA4qCA4qKA4qKA4qKg4qO/4qO/4qK+G1sxOzM4OzU7MTcwbeKigOKjsOKjvuKjv+Kjv+Khj+KigOKgoRtbMG0KG1sxOzM4OzU7Njlt4qKA4qCC4qCE4qCC4qCB4qC44qO/G1sxOzM4OzU7MTA1beKjvxtbMTszODs1OzEwNG3io77io7/ioZ8bWzE7Mzg7NTs5OG3iooDioIDioIDio6AbWzE7Mzg7NTsxMzRt4qO04qO24qGm4qCE4qCB4qCa4qK/4qO/4qO/4qG8G1sxOzM4OzU7MTcwbeKjv+Kjv+Kjv+Kjv+KhheKgguKgghtbMG0KG1sxOzM4OzU7Njlt4qKA4qKA4qKA4qKA4qKA4qKA4qK74qO/G1sxOzM4OzU7MTA0beKjv+Kjv+Khh+KggRtbMTszODs1Ozk4beKggeKggeKiv+KjvxtbMTszODs1OzEzNG3ioJ/ioIHioIHioIHioIHioLjio7/io7/io7fio7/io78bWzE7Mzg7NTsxNzBt4qO/4qCK4qKI4qKA4qKAG1swbQobWzE7Mzg7NTs2OW3iooDiooDiooDioITiooDiooDiooDior8bWzE7Mzg7NTsxMDVt4qO/G1sxOzM4OzU7MTA0beKhv+Kgg+KgguKgghtbMTszODs1Ozk4beKigOKigOKggeKghBtbMTszODs1OzEzNG3ioIDioIDioIDioIDiorHio7/io7/io7/io7/ioZnioLviorfiooQbWzE7Mzg7NTsxNzBt4qKA4qKAG1swbQobWzE7Mzg7NTs2OW3ioITioITioILioILioIHioIHioILioLgbWzE7Mzg7NTsxMDVt4qO/G1sxOzM4OzU7MTA0beKhv+Kjv+Kgt+KgpBtbMTszODs1Ozk4beKggeKggeKggeKggRtbMTszODs1OzEzNG3ioIDioIDioIDioqDio7/io7/io7/io7/io7/io7fio7bio6Tio6Tio6DiooAbWzBtChtbMTszODs1OzY5beKggOKgguKggeKggeKigOKghOKgguKgguKiuBtbMTszODs1OzEwNW3io78bWzE7Mzg7NTsxMDRt4qG34qCW4qCC4qCAG1sxOzM4OzU7OTht4qCA4qCB4qCA4qCAG1sxOzM4OzU7MTM0beKggOKggOKgmOKgieKggeKiu+Kjv+Kjv+Kjv+KguOKiu+Kjv+Kjv+KjvxtbMG0KG1sxOzM4OzU7Njlt4qKA4qKA4qKA4qKA4qKA4qCE4qOg4qO04qO/4qO/G1sxOzM4OzU7MTA0beKjv+Kjv+KgpuKggOKggBtbMTszODs1Ozk4beKjgOKjgOKggOKggBtbMTszODs1OzEzNG3ioIDioITioILioIHiorjio7/iob/ioKPioITioIHioJnioLvio78bWzBtChtbMTszODs1OzY5beKgguKghOKggeKigeKjpOKjvuKjv+Kjv+Kjv+KjvxtbMTszODs1OzEwNW3io78bWzE7Mzg7NTsxMDRt4qO/4qO24qO24qO/G1sxOzM4OzU7OTht4qO/4qO/4qO34qCE4qCA4qCAG1sxOzM4OzU7MTM0beKggOKggOKgiOKgq+KggeKghOKggeKggeKggeKgguKggRtbMG0="
+            ).decode()
+            cyan = "\033[1;38;5;51m"
+            reset = "\033[0m"
+            log_to_stderr(
+                f"{_a}\n{cyan}Never Mind the Electric Reign{reset}",
+                level="HUGESUCCESS",
+                logname=False,
+            )
 
         # make sure the preset has a description
         if not self.preset.description:
diff --git a/bbot/scripts/docs.py b/bbot/scripts/docs.py
index 8da02e83bd..2b52f69316 100755
--- a/bbot/scripts/docs.py
+++ b/bbot/scripts/docs.py
@@ -182,12 +182,12 @@ def update_individual_module_options():
     assert len(bbot_output_module_table.splitlines()) > 10
     update_md_files("BBOT OUTPUT MODULES", bbot_output_module_table)
 
-    # BBOT universal module options
-    from bbot.scanner.preset.args import universal_module_options
+    # BBOT universal module options (sourced from BaseModuleConfig)
+    from bbot.core.config.models import BaseModuleConfig
 
     universal_module_options_table = ""
-    for option, description in universal_module_options.items():
-        universal_module_options_table += f"**{option}**: {description}\n"
+    for name, field in BaseModuleConfig.model_fields.items():
+        universal_module_options_table += f"**{name}**: {field.description}\n"
     update_md_files("BBOT UNIVERSAL MODULE OPTIONS", universal_module_options_table)
 
     # BBOT module options
diff --git a/bbot/test/bbot_fixtures.py b/bbot/test/bbot_fixtures.py
index 5884ef5eb4..df8a7cb547 100644
--- a/bbot/test/bbot_fixtures.py
+++ b/bbot/test/bbot_fixtures.py
@@ -7,12 +7,12 @@
 import tldextract
 import pytest_httpserver
 from pathlib import Path
-from omegaconf import OmegaConf  # noqa
 
 from werkzeug.wrappers import Request
 
 from bbot.errors import *  # noqa: F401
 from bbot.core import CORE
+from bbot.core.config.merge import deep_merge
 from bbot.scanner import Preset
 from bbot.core.helpers.misc import mkdir, rand_string
 
@@ -49,13 +49,14 @@ def tempapkfile():
 
 @pytest.fixture
 def clean_default_config(monkeypatch):
-    clean_config = OmegaConf.merge(
-        CORE.files_config.get_default_config(), {"modules": DEFAULT_PRESET.module_loader.configs()}
+    clean_config = deep_merge(
+        CORE.files_config.get_default_config(),
+        {"modules": DEFAULT_PRESET.module_loader.configs()},
     )
     with monkeypatch.context() as m:
         m.setattr("bbot.core.core.DEFAULT_CONFIG", clean_config)
         # Also clear CORE's custom_config to ensure Preset.copy() gets a clean core
-        m.setattr(CORE, "_custom_config", OmegaConf.create({}))
+        m.setattr(CORE, "_custom_config", {})
         yield
 
 
diff --git a/bbot/test/conftest.py b/bbot/test/conftest.py
index 40b7180ece..03efdb7b23 100644
--- a/bbot/test/conftest.py
+++ b/bbot/test/conftest.py
@@ -1,13 +1,13 @@
 import os
 import ssl
 import time
+import yaml
 import pytest
 import shutil
 import asyncio
 import logging
 from pathlib import Path
 from contextlib import suppress
-from omegaconf import OmegaConf
 from pytest_httpserver import HTTPServer
 
 from bbot.core import CORE
@@ -23,7 +23,8 @@
 debug_handler.setFormatter(debug_format)
 root_logger.addHandler(debug_handler)
 
-test_config = OmegaConf.load(Path(__file__).parent / "test.conf")
+with open(Path(__file__).parent / "test.conf") as _f:
+    test_config = yaml.safe_load(_f) or {}
 
 os.environ["BBOT_DEBUG"] = "True"
 CORE.logger.log_level = logging.DEBUG
diff --git a/bbot/test/test.conf b/bbot/test/test.conf
index 1c6a19dbf7..7c607615a7 100644
--- a/bbot/test/test.conf
+++ b/bbot/test/test.conf
@@ -1,10 +1,8 @@
 home: /tmp/.bbot_test
 modules:
-  massdns:
+  dnsbrute:
     wordlist: https://raw.githubusercontent.com/danielmiessler/SecLists/master/Discovery/DNS/deepmagic.com-prefixes-top500.txt
-  ffuf:
-    prefix_busting: true
-  http:
+  webhook:
     url: http://127.0.0.1:11111
     username: username
     password: password
@@ -25,7 +23,7 @@ dns:
   disable: false
   minimal: true
   search_distance: 1
-  debug: false
+  debug: true
   timeout: 1
   wildcard_ignore:
     - blacklanternsecurity.com
@@ -40,11 +38,8 @@ deps:
   behavior: retry_failed
 engine:
   debug: true
-agent_url: ws://127.0.0.1:8765
-agent_token: test
 speculate: false
 excavate: false
 aggregate: false
 cloudcheck: false
 omit_event_types: []
-debug: true
diff --git a/bbot/test/test_step_1/test_cli.py b/bbot/test/test_step_1/test_cli.py
index 4e84ba0742..af04192ab2 100644
--- a/bbot/test/test_step_1/test_cli.py
+++ b/bbot/test/test_step_1/test_cli.py
@@ -461,18 +461,37 @@ async def test_cli_module_help(monkeypatch, capsys):
     assert "Extracts domains from CSP headers" in captured.out
     assert "Module Help:" in captured.out
 
+    # a module with options must list them (regression: help_text reads the pydantic
+    # Config, not the removed self.options dict — otherwise every module shows nothing)
+    monkeypatch.setattr("sys.argv", ["bbot", "--module-help", "robots"])
+    assert await cli._main() is None
+    captured = capsys.readouterr()
+    assert "include_sitemap" in captured.out
+    assert "No options available" not in captured.out
+
+    # lightfuzz overrides help_text as a classmethod (regression: it must not read
+    # instance-only config, which previously crashed with AttributeError)
+    monkeypatch.setattr("sys.argv", ["bbot", "--module-help", "lightfuzz"])
+    assert await cli._main() is None
+    captured = capsys.readouterr()
+    assert "Lightfuzz Submodules:" in captured.out
+    assert "sqli" in captured.out
+    assert "enabled_submodules" in captured.out
+
 
 def test_cli_config_validation(monkeypatch, caplog):
     monkeypatch.setattr(sys, "exit", lambda *args, **kwargs: True)
     monkeypatch.setattr(os, "_exit", lambda *args, **kwargs: True)
 
-    # incorrect module option
+    # incorrect module name nested under modules.* — surfaces as an unknown
+    # module with a closest-match suggestion (more useful than the legacy
+    # "Could not find config option ..." phrasing)
     caplog.clear()
     assert not caplog.text
     monkeypatch.setattr("sys.argv", ["bbot", "-c", "modules.ipnegibhor.num_bits=4"])
     cli.main()
-    assert 'Could not find config option "modules.ipnegibhor.num_bits"' in caplog.text
-    assert 'Did you mean "modules.ipneighbor.num_bits"?' in caplog.text
+    assert 'Could not find module "ipnegibhor"' in caplog.text
+    assert 'Did you mean "ipneighbor"?' in caplog.text
 
     # incorrect global option
     caplog.clear()
@@ -483,6 +502,101 @@ def test_cli_config_validation(monkeypatch, caplog):
     assert 'Did you mean "web.spider_distance"?' in caplog.text
 
 
+def test_parse_cli_value_keeps_date_shaped_strings():
+    """`-c key=2024-01-01` must stay a string -- YAML would coerce it to a date object,
+    which every typed field rejects (e.g. an all-numeric or date-shaped credential).
+    Normal type coercion for typed options is preserved."""
+    from bbot.scanner.preset.args import _parse_cli_value
+
+    assert _parse_cli_value("2024-01-01") == "2024-01-01"
+    assert _parse_cli_value("2") == 2
+    assert _parse_cli_value("true") is True
+    assert _parse_cli_value("3.5") == 3.5
+    assert _parse_cli_value("[a, b]") == ["a", "b"]
+    assert _parse_cli_value("") == ""
+    assert _parse_cli_value("hello") == "hello"
+
+
+def test_parse_dotted_cli_type_aware_string_fields():
+    """String fields keep the literal CLI text (lossless) so an all-numeric or
+    boolean-looking value isn't coerced to int/bool and rejected by the str type."""
+    from bbot.scanner.preset.args import parse_dotted_cli
+    from bbot.scanner import validate_preset
+    from bbot.core.modules import MODULE_LOADER
+
+    MODULE_LOADER.preload()
+    index = MODULE_LOADER.config_type_index
+    for raw, expect in [("12345678", "12345678"), ("true", "true"), ("0755", "0755")]:
+        d = parse_dotted_cli([f"modules.postgres.password={raw}"], index=index)
+        assert d["modules"]["postgres"]["password"] == expect
+        assert validate_preset({"config": d}) == []
+
+
+def test_parse_dotted_cli_type_aware_preserves_scalars():
+    """Typed options still coerce (int/bool), and Union[str, list[str]] still parses a
+    list while keeping a bare value as a string."""
+    from bbot.scanner.preset.args import parse_dotted_cli
+    from bbot.core.modules import MODULE_LOADER
+
+    MODULE_LOADER.preload()
+    index = MODULE_LOADER.config_type_index
+    assert parse_dotted_cli(["web.http_timeout=20"], index=index)["web"]["http_timeout"] == 20
+    assert parse_dotted_cli(["scope.strict=true"], index=index)["scope"]["strict"] is True
+    wl = parse_dotted_cli(["modules.dnsbrute.wordlist=[a,b]"], index=index)["modules"]["dnsbrute"]["wordlist"]
+    assert wl == ["a", "b"]
+    bare = parse_dotted_cli(["modules.dnsbrute.wordlist=foo"], index=index)["modules"]["dnsbrute"]["wordlist"]
+    assert bare == "foo"
+
+
+def test_parse_dotted_cli_type_aware_bool_fields():
+    """Bool fields produce real bool values, not ints or strings."""
+    from bbot.scanner.preset.args import parse_dotted_cli
+    from bbot.core.modules import MODULE_LOADER
+
+    MODULE_LOADER.preload()
+    index = MODULE_LOADER.config_type_index
+    d = parse_dotted_cli(["modules.lightfuzz.force_common_headers=1"], index=index)
+    assert d["modules"]["lightfuzz"]["force_common_headers"] is True
+    d = parse_dotted_cli(["scope.strict=yes"], index=index)
+    assert d["scope"]["strict"] is True
+    d = parse_dotted_cli(["scope.strict=false"], index=index)
+    assert d["scope"]["strict"] is False
+
+
+def test_type_aware_parsing_still_flags_unknown_key():
+    """Type-awareness must not hide a typo: an unknown key falls back to YAML parse
+    and is still rejected by validation."""
+    from bbot.scanner.preset.args import parse_dotted_cli
+    from bbot.scanner import validate_preset
+    from bbot.core.modules import MODULE_LOADER
+
+    MODULE_LOADER.preload()
+    d = parse_dotted_cli(["web.bogus=5"], index=MODULE_LOADER.config_type_index)
+    assert validate_preset({"config": d})  # non-empty: unknown key flagged
+
+
+def test_coerce_config_file_values():
+    """coerce_config fixes YAML-parsed values from config files: numeric passwords
+    become strings, integer 1 on a bool field becomes True, etc."""
+    from bbot.core.config.models import coerce_config
+    from bbot.core.modules import MODULE_LOADER
+
+    MODULE_LOADER.preload()
+    index = MODULE_LOADER.config_type_index
+    cfg = {
+        "web": {"http_timeout": 30},
+        "modules": {
+            "postgres": {"password": 12345678, "port": 5432},
+            "lightfuzz": {"force_common_headers": 1},
+        },
+    }
+    result = coerce_config(cfg, index)
+    assert result["modules"]["postgres"]["password"] == "12345678"
+    assert result["modules"]["postgres"]["port"] == 5432
+    assert result["modules"]["lightfuzz"]["force_common_headers"] is True
+    assert result["web"]["http_timeout"] == 30
+
+
 def test_cli_module_validation(monkeypatch, caplog):
     monkeypatch.setattr(sys, "exit", lambda *args, **kwargs: True)
     monkeypatch.setattr(os, "_exit", lambda *args, **kwargs: True)
diff --git a/bbot/test/test_step_1/test_config.py b/bbot/test/test_step_1/test_config.py
index b040bf5dc0..6de63e6b44 100644
--- a/bbot/test/test_step_1/test_config.py
+++ b/bbot/test/test_step_1/test_config.py
@@ -3,23 +3,22 @@
 
 @pytest.mark.asyncio
 async def test_config(bbot_scanner):
-    config = OmegaConf.create(
-        {
-            "plumbus": "asdf",
-            "speculate": True,
-            "modules": {
-                "ipneighbor": {"test_option": "ipneighbor"},
-                "python": {"test_option": "asdf"},
-                "speculate": {"test_option": "speculate"},
-            },
-        }
-    )
+    # config is strictly validated, so propagation must be tested with real keys
+    config = {
+        "status_frequency": 5,
+        "speculate": True,
+        "modules": {
+            "ipneighbor": {"num_bits": 8},
+            "python": {"module_timeout": 60},
+            "speculate": {"module_timeout": 60},
+        },
+    }
     scan1 = bbot_scanner("127.0.0.1", modules=["ipneighbor"], config=config)
     await scan1._prep()
-    assert scan1.config.web.user_agent == "BBOT Test User-Agent"
-    assert scan1.config.plumbus == "asdf"
-    assert scan1.modules["ipneighbor"].config.test_option == "ipneighbor"
-    assert scan1.modules["python"].config.test_option == "asdf"
-    assert scan1.modules["speculate"].config.test_option == "speculate"
+    assert scan1.config["web"]["user_agent"] == "BBOT Test User-Agent"
+    assert scan1.config["status_frequency"] == 5
+    assert scan1.modules["ipneighbor"].config["num_bits"] == 8
+    assert scan1.modules["python"].config["module_timeout"] == 60
+    assert scan1.modules["speculate"].config["module_timeout"] == 60
 
     await scan1._cleanup()
diff --git a/bbot/test/test_step_1/test_field_metadata.py b/bbot/test/test_step_1/test_field_metadata.py
new file mode 100644
index 0000000000..be73478bcd
--- /dev/null
+++ b/bbot/test/test_step_1/test_field_metadata.py
@@ -0,0 +1,159 @@
+"""
+Tests for the unified `sensitive` / `mandatory` field-level metadata that
+drives:
+
+- redaction (`BBOTCore.no_secrets_config` / `secrets_only_config`)
+- the "Needs API Key" doc column (`MODULE_LOADER.modules_table`)
+- the runtime `BaseModule.auth_required` property
+"""
+
+from ..bbot_fixtures import *  # noqa: F401, F403
+
+
+def test_field_records_sensitive_and_mandatory_in_json_schema_extra():
+    from bbot.core.config.models import Field, is_mandatory, is_sensitive
+
+    f_secret = Field("", description="x", sensitive=True)
+    f_required = Field("", description="x", mandatory=True)
+    f_both = Field("", description="x", sensitive=True, mandatory=True)
+    f_plain = Field("", description="x")
+
+    assert is_sensitive(f_secret) is True
+    assert is_mandatory(f_secret) is False
+    assert is_sensitive(f_required) is False
+    assert is_mandatory(f_required) is True
+    assert is_sensitive(f_both) is True
+    assert is_mandatory(f_both) is True
+    assert is_sensitive(f_plain) is False
+    assert is_mandatory(f_plain) is False
+
+
+def test_global_config_marks_known_secrets_sensitive():
+    from bbot.core.config.models import BBOTConfig, WebConfig, is_sensitive
+
+    assert is_sensitive(BBOTConfig.model_fields["interactsh_token"]) is True
+    assert is_sensitive(WebConfig.model_fields["http_cookies"]) is True
+    # nearby non-secret control
+    assert is_sensitive(WebConfig.model_fields["http_timeout"]) is False
+
+
+def test_module_preload_extracts_sensitive_and_mandatory_sets():
+    """`_extract_pydantic_config` should return the field-level flags via AST."""
+    from bbot.core.modules import MODULE_LOADER
+
+    MODULE_LOADER.preload()
+    preloaded = MODULE_LOADER.preloaded()
+
+    assert preloaded["shodan_dns"]["options_sensitive"] == ["api_key"]
+    assert preloaded["shodan_dns"]["options_mandatory"] == ["api_key"]
+
+    # robots has a Config but no auth-related fields
+    assert preloaded["robots"]["options_sensitive"] == []
+    assert preloaded["robots"]["options_mandatory"] == []
+
+    # credshed: 3 mandatory, 2 sensitive (url is mandatory but not sensitive)
+    assert sorted(preloaded["credshed"]["options_sensitive"]) == ["password", "username"]
+    assert sorted(preloaded["credshed"]["options_mandatory"]) == ["credshed_url", "password", "username"]
+
+
+def test_modules_table_needs_api_key_derived_from_mandatory():
+    from bbot.core.modules import MODULE_LOADER
+
+    MODULE_LOADER.preload()
+    out = MODULE_LOADER.modules_table(["shodan_dns", "robots"])
+    # Row format: | Module | Type | Needs API Key | ...
+    rows = [line for line in out.splitlines() if "shodan_dns" in line or "robots" in line]
+    shodan_row = next(r for r in rows if "shodan_dns" in r)
+    robots_row = next(r for r in rows if "robots" in r)
+    assert "Yes" in shodan_row.split("|")[3]
+    assert "No" in robots_row.split("|")[3]
+
+
+def test_no_secrets_config_redacts_module_and_global_secrets():
+    from bbot.core import CORE
+    from bbot.core.modules import MODULE_LOADER
+
+    MODULE_LOADER.preload()
+    cfg = {
+        "home": "/tmp/bbot",
+        "interactsh_token": "leaky",
+        "web": {"http_cookies": {"session": "abc"}, "http_timeout": 30},
+        "modules": {
+            "shodan_dns": {"api_key": "shodan-secret"},
+            "credshed": {"username": "u", "password": "p", "credshed_url": "http://x"},
+            "robots": {"include_sitemap": True},
+            "unknown_mod": {"foo": "bar"},  # passes through
+        },
+    }
+    redacted = CORE.no_secrets_config(cfg)
+
+    # global non-secret kept
+    assert redacted["home"] == "/tmp/bbot"
+    assert redacted["web"]["http_timeout"] == 30
+    # global secrets removed
+    assert "interactsh_token" not in redacted
+    assert "http_cookies" not in redacted["web"]
+    # module secrets removed, non-secret module fields kept (empty dicts kept
+    # so the module name still appears under `modules`, matching prior behavior)
+    assert redacted["modules"]["shodan_dns"] == {}
+    assert redacted["modules"]["credshed"] == {"credshed_url": "http://x"}
+    assert redacted["modules"]["robots"] == {"include_sitemap": True}
+    # unknown module passes through unchanged
+    assert redacted["modules"]["unknown_mod"] == {"foo": "bar"}
+
+
+def test_secrets_only_config_extracts_sensitive_fields():
+    from bbot.core import CORE
+    from bbot.core.modules import MODULE_LOADER
+
+    MODULE_LOADER.preload()
+    cfg = {
+        "home": "/tmp/bbot",
+        "interactsh_token": "leaky",
+        "web": {"http_cookies": {"session": "abc"}, "http_timeout": 30},
+        "modules": {
+            "shodan_dns": {"api_key": "shodan-secret"},
+            "credshed": {"username": "u", "password": "p", "credshed_url": "http://x"},
+        },
+    }
+    secrets = CORE.secrets_only_config(cfg)
+
+    assert secrets == {
+        "interactsh_token": "leaky",
+        "web": {"http_cookies": {"session": "abc"}},
+        "modules": {
+            "shodan_dns": {"api_key": "shodan-secret"},
+            "credshed": {"username": "u", "password": "p"},
+        },
+    }
+
+
+def test_auth_required_property_derives_from_config():
+    from bbot.core.modules import MODULE_LOADER
+
+    MODULE_LOADER.preload()
+    shodan_dns = MODULE_LOADER.load_module("shodan_dns")
+    robots = MODULE_LOADER.load_module("robots")
+
+    # `auth_required` is a property — the descriptor is on the class.
+    # We can resolve it without instantiating by walking model_fields ourselves.
+    from bbot.core.config.models import is_mandatory
+
+    shodan_mandatories = [n for n, f in shodan_dns.Config.model_fields.items() if is_mandatory(f)]
+    robots_mandatories = [n for n, f in robots.Config.model_fields.items() if is_mandatory(f)]
+    assert shodan_mandatories == ["api_key"]
+    assert robots_mandatories == []
+
+
+def test_credential_connection_fields_are_sensitive():
+    """Connection URIs that can embed credentials, and auth usernames, must be sensitive
+    so they aren't leaked into the redacted/public config view."""
+    from bbot.core.modules import MODULE_LOADER
+
+    MODULE_LOADER.preload()
+    preloaded = MODULE_LOADER.preloaded()
+    assert "uri" in preloaded["neo4j"]["options_sensitive"]
+    assert "url" in preloaded["elastic"]["options_sensitive"]
+    assert "url" in preloaded["splunk"]["options_sensitive"]
+    assert "url" in preloaded["websocket"]["options_sensitive"]
+    assert "jenkins_username" in preloaded["trajan"]["options_sensitive"]
diff --git a/bbot/test/test_step_1/test_merge.py b/bbot/test/test_step_1/test_merge.py
new file mode 100644
index 0000000000..edb5757476
--- /dev/null
+++ b/bbot/test/test_step_1/test_merge.py
@@ -0,0 +1,164 @@
+from bbot.core.config.merge import deep_merge, dotted_get, dotted_set, iter_dotted_paths
+
+
+# ----- deep_merge -----
+
+
+def test_deep_merge_basic():
+    assert deep_merge({"a": 1}, {"b": 2}) == {"a": 1, "b": 2}
+
+
+def test_deep_merge_last_wins():
+    assert deep_merge({"a": 1}, {"a": 2}, {"a": 3}) == {"a": 3}
+
+
+def test_deep_merge_recurses_into_dicts():
+    a = {"web": {"timeout": 5, "user_agent": "x"}}
+    b = {"web": {"timeout": 10}}
+    assert deep_merge(a, b) == {"web": {"timeout": 10, "user_agent": "x"}}
+
+
+def test_deep_merge_lists_are_replaced_not_concatenated():
+    # Matches OmegaConf's REPLACE list-merge mode (BBOT's previous default).
+    a = {"event_types": ["DNS_NAME", "URL"]}
+    b = {"event_types": ["EMAIL_ADDRESS"]}
+    assert deep_merge(a, b) == {"event_types": ["EMAIL_ADDRESS"]}
+
+
+def test_deep_merge_dict_replaces_scalar():
+    # Pydantic catches the resulting type mismatch downstream; merge itself
+    # does the structural replacement without complaint.
+    assert deep_merge({"a": 1}, {"a": {"b": 2}}) == {"a": {"b": 2}}
+
+
+def test_deep_merge_scalar_replaces_dict():
+    assert deep_merge({"a": {"b": 1}}, {"a": 5}) == {"a": 5}
+
+
+def test_deep_merge_none_inputs():
+    # All three forms used by callers in core.py / files.py
+    assert deep_merge(None, {"a": 1}) == {"a": 1}
+    assert deep_merge({"a": 1}, None) == {"a": 1}
+    assert deep_merge(None, None) == {}
+
+
+def test_deep_merge_no_aliasing_with_base():
+    """Mutating the result must not affect the base dict."""
+    a = {"web": {"headers": {"X-Foo": "1"}}}
+    result = deep_merge(a, {})
+    result["web"]["headers"]["X-Foo"] = "MUTATED"
+    result["web"]["new_key"] = "new"
+    assert a == {"web": {"headers": {"X-Foo": "1"}}}
+
+
+def test_deep_merge_no_aliasing_with_update():
+    """Mutating the result must not affect the update dict either."""
+    b = {"web": {"headers": {"X-Foo": "1"}}}
+    result = deep_merge({}, b)
+    result["web"]["headers"]["X-Foo"] = "MUTATED"
+    assert b == {"web": {"headers": {"X-Foo": "1"}}}
+
+
+def test_deep_merge_no_aliasing_for_lists():
+    """Lists in update should be deep-copied, not aliased."""
+    b = {"event_types": ["DNS_NAME"]}
+    result = deep_merge({}, b)
+    result["event_types"].append("URL")
+    assert b == {"event_types": ["DNS_NAME"]}
+
+
+def test_deep_merge_empty_update_skipped():
+    a = {"a": 1}
+    assert deep_merge(a, {}) == {"a": 1}
+    assert deep_merge(a, {}, {}, {"b": 2}) == {"a": 1, "b": 2}
+
+
+# ----- dotted_get -----
+
+
+def test_dotted_get_hit():
+    assert dotted_get({"a": {"b": {"c": 1}}}, "a.b.c") == 1
+
+
+def test_dotted_get_default_when_missing():
+    assert dotted_get({"a": 1}, "a.b.c", default="x") == "x"
+
+
+def test_dotted_get_default_when_blocked_by_scalar():
+    # `a` exists but is a scalar, so `a.b` can't be resolved.
+    assert dotted_get({"a": 1}, "a.b") is None
+    assert dotted_get({"a": 1}, "a.b", default="fallback") == "fallback"
+
+
+def test_dotted_get_top_level():
+    assert dotted_get({"a": 1}, "a") == 1
+
+
+# ----- dotted_set -----
+
+
+def test_dotted_set_creates_intermediates():
+    d = {}
+    dotted_set(d, "a.b.c", 1)
+    assert d == {"a": {"b": {"c": 1}}}
+
+
+def test_dotted_set_preserves_siblings():
+    d = {"a": {"b": 1}}
+    dotted_set(d, "a.c", 2)
+    assert d == {"a": {"b": 1, "c": 2}}
+
+
+def test_dotted_set_overwrites_existing_leaf():
+    d = {"a": {"b": 1}}
+    dotted_set(d, "a.b", 99)
+    assert d == {"a": {"b": 99}}
+
+
+def test_dotted_set_silently_replaces_non_dict_intermediate():
+    """
+    Documented behavior: a scalar in the path is silently replaced by a dict.
+    Pydantic validation downstream surfaces the resulting type mismatch.
+    """
+    d = {"a": 1}
+    dotted_set(d, "a.b", 2)
+    assert d == {"a": {"b": 2}}
+
+
+def test_dotted_set_top_level():
+    d = {}
+    dotted_set(d, "a", 1)
+    assert d == {"a": 1}
+
+
+# ----- iter_dotted_paths -----
+
+
+def test_iter_dotted_paths_basic():
+    assert iter_dotted_paths({"a": 1, "b": {"c": 2}}) == ["a", "b.c"]
+
+
+def test_iter_dotted_paths_deep():
+    paths = iter_dotted_paths({"a": {"b": {"c": 1, "d": 2}}, "e": 3})
+    assert sorted(paths) == ["a.b.c", "a.b.d", "e"]
+
+
+def test_iter_dotted_paths_empty_dict_treated_as_leaf():
+    # An empty dict is a leaf path so dotted_get/dotted_set round-trip through it.
+    assert iter_dotted_paths({"a": {}, "b": 1}) == ["a", "b"]
+
+
+def test_iter_dotted_paths_empty_input():
+    assert iter_dotted_paths({}) == []
+
+
+# ----- round-trip -----
+
+
+def test_dotted_set_get_roundtrip():
+    d = {}
+    dotted_set(d, "modules.shodan.api_key", "abc123")
+    dotted_set(d, "web.spider_distance", 2)
+    assert dotted_get(d, "modules.shodan.api_key") == "abc123"
+    assert dotted_get(d, "web.spider_distance") == 2
+    assert sorted(iter_dotted_paths(d)) == ["modules.shodan.api_key", "web.spider_distance"]
diff --git a/bbot/test/test_step_1/test_modules_basic.py b/bbot/test/test_step_1/test_modules_basic.py
index ab0259a306..10577b5856 100644
--- a/bbot/test/test_step_1/test_modules_basic.py
+++ b/bbot/test/test_step_1/test_modules_basic.py
@@ -541,3 +541,111 @@ async def test_module_loading(bbot_scanner):
     assert not any(not_async)
 
     await scan2._cleanup()
+
+
+def test_legacy_options_dict_rejected(tmp_path):
+    """A pre-3.0 user module that declares an `options` / `options_desc` dict
+    instead of a `class Config(BaseModuleConfig)` schema must be rejected at
+    preload time with a clear migration message. Otherwise the loader would
+    silently ignore the defaults and the user would never know."""
+    from bbot.errors import BBOTError
+    from bbot.core.modules import MODULE_LOADER
+
+    legacy_mod = tmp_path / "legacy_user_mod.py"
+    legacy_mod.write_text(
+        """
+from bbot.modules.base import BaseModule
+
+
+class legacy_user_mod(BaseModule):
+    watched_events = ["DNS_NAME"]
+    produced_events = ["FINDING"]
+    flags = ["passive", "safe"]
+    meta = {"description": "x", "created_date": "2024-01-01", "author": "@x"}
+
+    options = {"api_key": "", "max_results": 100}
+    options_desc = {"api_key": "API key", "max_results": "Max results"}
+
+    async def handle_event(self, event):
+        pass
+"""
+    )
+
+    with pytest.raises(BBOTError) as excinfo:
+        MODULE_LOADER.preload_module(legacy_mod)
+    msg = str(excinfo.value)
+    assert "legacy_user_mod" in msg
+    assert "no longer supported" in msg
+    assert "class Config(BaseModuleConfig)" in msg
+
+    # And a module that declares only options_desc (still legacy) is also rejected.
+    legacy_mod_desc_only = tmp_path / "legacy_desc_only.py"
+    legacy_mod_desc_only.write_text(
+        """
+from bbot.modules.base import BaseModule
+
+
+class legacy_desc_only(BaseModule):
+    watched_events = ["DNS_NAME"]
+    produced_events = ["FINDING"]
+    flags = ["passive", "safe"]
+    meta = {"description": "x", "created_date": "2024-01-01", "author": "@x"}
+
+    options_desc = {"api_key": "API key"}
+
+    async def handle_event(self, event):
+        pass
+"""
+    )
+    with pytest.raises(BBOTError):
+        MODULE_LOADER.preload_module(legacy_mod_desc_only)
+
+    # A module with a real `class Config` and NO legacy dict must load cleanly.
+    new_mod = tmp_path / "new_style_mod.py"
+    new_mod.write_text(
+        """
+from bbot.modules.base import BaseModule
+from bbot.core.config.models import BaseModuleConfig, Field
+
+
+class new_style_mod(BaseModule):
+    watched_events = ["DNS_NAME"]
+    produced_events = ["FINDING"]
+    flags = ["passive", "safe"]
+    meta = {"description": "x", "created_date": "2024-01-01", "author": "@x"}
+
+    class Config(BaseModuleConfig):
+        api_key: str = Field("", description="API key", sensitive=True)
+
+    async def handle_event(self, event):
+        pass
+"""
+    )
+    preloaded = MODULE_LOADER.preload_module(new_mod)
+    assert preloaded is not None
+    assert preloaded["config"] == {"api_key": ""}
+
+    # The annotated form `options: dict = {...}` (ast.AnnAssign) must also be rejected,
+    # not silently slip the guard.
+    annotated_mod = tmp_path / "annotated_legacy_mod.py"
+    annotated_mod.write_text(
+        """
+from bbot.modules.base import BaseModule
+
+
+class annotated_legacy_mod(BaseModule):
+    watched_events = ["DNS_NAME"]
+    produced_events = ["FINDING"]
+    flags = ["passive", "safe"]
+    meta = {"description": "x", "created_date": "2024-01-01", "author": "@x"}
+
+    options: dict = {"api_key": ""}
+    options_desc: dict = {"api_key": "API key"}
+
+    async def handle_event(self, event):
+        pass
+"""
+    )
+    with pytest.raises(BBOTError) as excinfo:
+        MODULE_LOADER.preload_module(annotated_mod)
+    assert "no longer supported" in str(excinfo.value)
diff --git a/bbot/test/test_step_1/test_preset_seeds.py b/bbot/test/test_step_1/test_preset_seeds.py
index 07d74c2d9c..3c54898046 100644
--- a/bbot/test/test_step_1/test_preset_seeds.py
+++ b/bbot/test/test_step_1/test_preset_seeds.py
@@ -6,7 +6,7 @@ def test_preset_target_and_seeds_default():
     If no explicit seeds are provided, seeds should be copied from target.
     """
     preset = Preset("evilcorp.com")
-    baked = preset.bake()
+    baked = preset.validate().bake()
 
     target = baked.target
     assert set(target.target.inputs) == {"evilcorp.com"}
@@ -18,7 +18,7 @@ def test_preset_target_and_seeds_explicit_seeds_override():
     If explicit seeds are provided, they should NOT be copied from target.
     """
     preset = Preset("evilcorp.com", seeds=["seedonly.evilcorp.com"])
-    baked = preset.bake()
+    baked = preset.validate().bake()
 
     target = baked.target
     assert set(target.target.inputs) == {"evilcorp.com"}
diff --git a/bbot/test/test_step_1/test_presets.py b/bbot/test/test_step_1/test_presets.py
index c861a05a66..f5de75bf48 100644
--- a/bbot/test/test_step_1/test_presets.py
+++ b/bbot/test/test_step_1/test_presets.py
@@ -25,31 +25,21 @@ def test_preset_descriptions():
 def test_core():
     from bbot.core import CORE
 
-    import omegaconf
-
     assert "testasdf" not in CORE.default_config
     assert "testasdf" not in CORE.custom_config
     assert "testasdf" not in CORE.config
 
     core_copy = CORE.copy()
-    # make sure our default config is read-only
-    with pytest.raises(omegaconf.errors.ReadonlyConfigError):
-        core_copy.default_config["testasdf"] = "test"
-    # same for merged config
-    with pytest.raises(omegaconf.errors.ReadonlyConfigError):
-        core_copy.config["testasdf"] = "test"
-
-    assert "testasdf" not in core_copy.default_config
-    assert "testasdf" not in core_copy.custom_config
-    assert "testasdf" not in core_copy.config
-
+    # custom_config is mutable per-instance; default/merged config should not leak back
     core_copy.custom_config["testasdf"] = "test"
-    assert "testasdf" not in core_copy.default_config
+    assert "testasdf" not in CORE.custom_config
+    assert "testasdf" not in CORE.config
     assert "testasdf" in core_copy.custom_config
+    # force a re-merge by reading .config
     assert "testasdf" in core_copy.config
 
     # test config merging
-    config_to_merge = omegaconf.OmegaConf.create({"test123": {"test321": [3, 2, 1], "test456": [4, 5, 6]}})
+    config_to_merge = {"test123": {"test321": [3, 2, 1], "test456": [4, 5, 6]}}
     core_copy.merge_custom(config_to_merge)
     assert "test123" not in core_copy.default_config
     assert "test123" in core_copy.custom_config
@@ -58,7 +48,9 @@ def test_core():
     assert "test321" in core_copy.config["test123"]
 
     # test deletion
-    del core_copy.custom_config.test123.test321
+    del core_copy.custom_config["test123"]["test321"]
+    # force re-merge
+    core_copy._config = None
     assert "test123" in core_copy.custom_config
     assert "test123" in core_copy.config
     assert "test321" not in core_copy.custom_config["test123"]
@@ -83,9 +75,9 @@ async def test_preset_yaml(clean_default_config):
         verbose=False,
         debug=False,
         silent=True,
-        config={"preset_test_asdf": 1},
+        config={"keep_scans": 42},
     )
-    preset1 = preset1.bake()
+    preset1 = preset1.validate().bake()
     assert "evilcorp.com" in preset1.target.seeds
     assert "evilcorp.ce" not in preset1.target.seeds
     assert "asdf.www.evilcorp.ce" in preset1.target.seeds
@@ -178,7 +170,7 @@ async def test_preset_scope(clean_default_config):
     assert {str(h) for h in scan.target.target.hosts} == {"1.2.3.4/32", "evilcorp.com"}
 
     blank_preset = Preset()
-    blank_preset = blank_preset.bake()
+    blank_preset = blank_preset.validate().bake()
     assert not blank_preset.target.seeds
     assert not blank_preset.target.target
     assert blank_preset.strict_scope is False
@@ -189,7 +181,7 @@ async def test_preset_scope(clean_default_config):
         seeds=["evilcorp.com", "www.evilcorp.ce"],
         blacklist=["test.www.evilcorp.ce"],
     )
-    preset1_baked = preset1.bake()
+    preset1_baked = preset1.validate().bake()
 
     # make sure target logic works as expected
     assert "evilcorp.com" in preset1_baked.target.seeds
@@ -220,7 +212,7 @@ async def test_preset_scope(clean_default_config):
 
     preset1.merge(preset3)
 
-    preset1_baked = preset1.bake()
+    preset1_baked = preset1.validate().bake()
 
     # targets should be merged
     assert "evilcorp.com" in preset1_baked.target.seeds
@@ -264,11 +256,11 @@ async def test_preset_scope(clean_default_config):
         name="with_target_scope",
         seeds=["evilcorp.org"],
         blacklist=["evilcorp.co.uk:443", "bob@evilcorp.co.uk"],
-        config={"modules": {"secretsdb": {"api_key": "deadbeef", "otherthing": "asdf"}}},
+        config={"modules": {"github_workflows": {"api_key": "deadbeef", "output_folder": "asdf"}}},
     )
 
-    preset_domain_with_seed_baked = preset_domain_with_seed.bake()
-    preset_with_target_scope_baked = preset_with_target_scope.bake()
+    preset_domain_with_seed_baked = preset_domain_with_seed.validate().bake()
+    preset_with_target_scope_baked = preset_with_target_scope.validate().bake()
 
     # When seeds and targets are identical, only targets are serialized.
     domain_with_seed_dict = preset_domain_with_seed_baked.to_dict(include_target=True)
@@ -279,16 +271,16 @@ async def test_preset_scope(clean_default_config):
     scope_dict = preset_with_target_scope_baked.to_dict(include_target=True)
     assert set(scope_dict["target"]) == {"1.2.3.0/24", "http://evilcorp.net/"}
     assert set(scope_dict["blacklist"]) == {"bob@evilcorp.co.uk", "evilcorp.co.uk:443"}
-    # secretsdb config should be preserved (other module config may also be present)
-    assert scope_dict["config"]["modules"]["secretsdb"] == {
+    # github_workflows config should be preserved (other module config may also be present)
+    assert scope_dict["config"]["modules"]["github_workflows"] == {
         "api_key": "deadbeef",
-        "otherthing": "asdf",
+        "output_folder": "asdf",
     }
 
     redacted_dict = preset_with_target_scope_baked.to_dict(include_target=True, redact_secrets=True)
     assert set(redacted_dict["target"]) == {"1.2.3.0/24", "http://evilcorp.net/"}
     assert set(redacted_dict["blacklist"]) == {"bob@evilcorp.co.uk", "evilcorp.co.uk:443"}
-    assert redacted_dict["config"]["modules"]["secretsdb"] == {"otherthing": "asdf"}
+    assert redacted_dict["config"]["modules"]["github_workflows"] == {"output_folder": "asdf"}
 
     assert preset_domain_with_seed_baked.in_scope("www.evilcorp.com")
     assert not preset_domain_with_seed_baked.in_scope("www.evilcorp.de")
@@ -316,7 +308,7 @@ async def test_preset_scope(clean_default_config):
     # When merging a preset that has both seeds and target with one that only has
     # target (no explicit seeds), explicit seeds are unioned and targets are unioned.
     preset_domain_with_seed.merge(preset_with_target_scope)
-    preset_domain_with_seed_baked = preset_domain_with_seed.bake()
+    preset_domain_with_seed_baked = preset_domain_with_seed.validate().bake()
     assert {e.data for e in preset_domain_with_seed_baked.seeds} == {"evilcorp.com", "evilcorp.org"}
     # After merging, target scope should include both the original domain target and the scoped network/URL
     assert {e.data for e in preset_domain_with_seed_baked.target.target} == {
@@ -339,7 +331,7 @@ async def test_preset_scope(clean_default_config):
     preset_targets_only = Preset("evilcorp.com")
     preset_with_target_scope = Preset("1.2.3.4/24", seeds=["evilcorp.org"])
     preset_with_target_scope.merge(preset_targets_only)
-    preset_with_target_scope_baked = preset_with_target_scope.bake()
+    preset_with_target_scope_baked = preset_with_target_scope.validate().bake()
     # Seeds stay as the explicit seeds from the base preset
     assert {e.data for e in preset_with_target_scope_baked.seeds} == {"evilcorp.org"}
     # Target scope is the union of both presets' targets.
@@ -364,14 +356,14 @@ async def test_preset_scope(clean_default_config):
     # after bake, each has seeds backfilled from its own target, and merge unions both.
     preset_targets_only1 = Preset("evilcorp.com")
     preset_targets_only2 = Preset("evilcorp.de")
-    preset_targets_only1_baked = preset_targets_only1.bake()
-    preset_targets_only2_baked = preset_targets_only2.bake()
+    preset_targets_only1_baked = preset_targets_only1.validate().bake()
+    preset_targets_only2_baked = preset_targets_only2.validate().bake()
     assert {e.data for e in preset_targets_only1_baked.seeds} == {"evilcorp.com"}
     assert {e.data for e in preset_targets_only2_baked.seeds} == {"evilcorp.de"}
     assert {e.data for e in preset_targets_only1_baked.target.target} == {"evilcorp.com"}
     assert {e.data for e in preset_targets_only2_baked.target.target} == {"evilcorp.de"}
     preset_targets_only1.merge(preset_targets_only2)
-    preset_targets_only1_baked = preset_targets_only1.bake()
+    preset_targets_only1_baked = preset_targets_only1.validate().bake()
     assert {e.data for e in preset_targets_only1_baked.seeds} == {"evilcorp.com", "evilcorp.de"}
     assert {e.data for e in preset_targets_only2_baked.seeds} == {"evilcorp.de"}
     assert {e.data for e in preset_targets_only1_baked.target.target} == {"evilcorp.com", "evilcorp.de"}
@@ -392,8 +384,8 @@ async def test_preset_scope(clean_default_config):
     preset_targets_only1 = Preset("evilcorp.com")
     preset_targets_only2 = Preset("evilcorp.de")
     preset_targets_only2.merge(preset_targets_only1)
-    preset_targets_only1_baked = preset_targets_only1.bake()
-    preset_targets_only2_baked = preset_targets_only2.bake()
+    preset_targets_only1_baked = preset_targets_only1.validate().bake()
+    preset_targets_only2_baked = preset_targets_only2.validate().bake()
     assert {e.data for e in preset_targets_only1_baked.seeds} == {"evilcorp.com"}
     assert {e.data for e in preset_targets_only2_baked.seeds} == {"evilcorp.com", "evilcorp.de"}
     assert {e.data for e in preset_targets_only1_baked.target.target} == {"evilcorp.com"}
@@ -431,12 +423,12 @@ async def test_preset_logging():
         assert silent_and_verbose.silent is True
         assert silent_and_verbose.debug is False
         assert silent_and_verbose.verbose is True
-        baked = silent_and_verbose.bake()
+        baked = silent_and_verbose.validate().bake()
         assert baked.silent is True
         assert baked.debug is False
         assert baked.verbose is False
         assert baked.core.logger.log_level == original_log_level
-        baked = silent_and_verbose.bake(scan=scan)
+        baked = silent_and_verbose.validate().bake(scan=scan)
         assert baked.core.logger.log_level == logging.CRITICAL
         assert CORE.logger.log_level == logging.CRITICAL
 
@@ -447,12 +439,12 @@ async def test_preset_logging():
         assert silent_and_debug.silent is True
         assert silent_and_debug.debug is True
         assert silent_and_debug.verbose is False
-        baked = silent_and_debug.bake()
+        baked = silent_and_debug.validate().bake()
         assert baked.silent is True
         assert baked.debug is False
         assert baked.verbose is False
         assert baked.core.logger.log_level == original_log_level
-        baked = silent_and_debug.bake(scan=scan)
+        baked = silent_and_debug.validate().bake(scan=scan)
         assert baked.core.logger.log_level == logging.CRITICAL
         assert CORE.logger.log_level == logging.CRITICAL
 
@@ -463,12 +455,12 @@ async def test_preset_logging():
         assert debug_and_verbose.silent is False
         assert debug_and_verbose.debug is True
         assert debug_and_verbose.verbose is True
-        baked = debug_and_verbose.bake()
+        baked = debug_and_verbose.validate().bake()
         assert baked.silent is False
         assert baked.debug is True
         assert baked.verbose is False
         assert baked.core.logger.log_level == original_log_level
-        baked = debug_and_verbose.bake(scan=scan)
+        baked = debug_and_verbose.validate().bake(scan=scan)
         assert baked.core.logger.log_level == logging.DEBUG
         assert CORE.logger.log_level == logging.DEBUG
 
@@ -479,12 +471,12 @@ async def test_preset_logging():
         assert all_preset.silent is True
         assert all_preset.debug is True
         assert all_preset.verbose is True
-        baked = all_preset.bake()
+        baked = all_preset.validate().bake()
         assert baked.silent is True
         assert baked.debug is False
         assert baked.verbose is False
         assert baked.core.logger.log_level == original_log_level
-        baked = all_preset.bake(scan=scan)
+        baked = all_preset.validate().bake(scan=scan)
         assert baked.core.logger.log_level == logging.CRITICAL
         assert CORE.logger.log_level == logging.CRITICAL
 
@@ -492,7 +484,7 @@ async def test_preset_logging():
         assert CORE.logger.log_level == original_log_level
 
         # defaults
-        preset = Preset().bake()
+        preset = Preset().validate().bake()
         assert preset.core.logger.log_level == original_log_level
         assert CORE.logger.log_level == original_log_level
 
@@ -503,7 +495,7 @@ async def test_preset_logging():
 
 
 async def test_preset_module_resolution(clean_default_config):
-    preset = Preset().bake()
+    preset = Preset().validate().bake()
     sslcert_preloaded = preset.preloaded_module("sslcert")
     wayback_preloaded = preset.preloaded_module("wayback")
     dotnetnuke_preloaded = preset.preloaded_module("dotnetnuke")
@@ -531,11 +523,11 @@ async def test_preset_module_resolution(clean_default_config):
     assert preset.modules == set(preset.output_modules).union(set(preset.internal_modules))
 
     # make sure dependency resolution works as expected
-    preset = Preset(modules=["dotnetnuke"]).bake()
+    preset = Preset(modules=["dotnetnuke"]).validate().bake()
     assert set(preset.scan_modules) == {"dotnetnuke", "http"}
 
     # make sure flags work as expected
-    preset = Preset(flags=["subdomain-enum"]).bake()
+    preset = Preset(flags=["subdomain-enum"]).validate().bake()
     assert preset.flags == {"subdomain-enum"}
     assert "sslcert" in preset.modules
     assert "wayback" in preset.modules
@@ -543,40 +535,40 @@ async def test_preset_module_resolution(clean_default_config):
     assert "wayback" in preset.scan_modules
 
     # flag + module exclusions
-    preset = Preset(flags=["subdomain-enum"], exclude_modules=["sslcert"]).bake()
+    preset = Preset(flags=["subdomain-enum"], exclude_modules=["sslcert"]).validate().bake()
     assert "sslcert" not in preset.modules
     assert "wayback" in preset.modules
     assert "sslcert" not in preset.scan_modules
     assert "wayback" in preset.scan_modules
 
     # flag + flag exclusions
-    preset = Preset(flags=["subdomain-enum"], exclude_flags=["active"]).bake()
+    preset = Preset(flags=["subdomain-enum"], exclude_flags=["active"]).validate().bake()
     assert "sslcert" not in preset.modules
     assert "wayback" in preset.modules
     assert "sslcert" not in preset.scan_modules
     assert "wayback" in preset.scan_modules
 
     # flag + flag requirements
-    preset = Preset(flags=["subdomain-enum"], require_flags=["passive"]).bake()
+    preset = Preset(flags=["subdomain-enum"], require_flags=["passive"]).validate().bake()
     assert "sslcert" not in preset.modules
     assert "wayback" in preset.modules
     assert "sslcert" not in preset.scan_modules
     assert "wayback" in preset.scan_modules
 
     # normal module enableement
-    preset = Preset(modules=["sslcert", "dotnetnuke", "wayback"]).bake()
+    preset = Preset(modules=["sslcert", "dotnetnuke", "wayback"]).validate().bake()
     assert set(preset.scan_modules) == {"sslcert", "dotnetnuke", "wayback", "http"}
 
     # modules + flag exclusions
-    preset = Preset(exclude_flags=["active"], modules=["sslcert", "dotnetnuke", "wayback"]).bake()
+    preset = Preset(exclude_flags=["active"], modules=["sslcert", "dotnetnuke", "wayback"]).validate().bake()
     assert set(preset.scan_modules) == {"wayback"}
 
     # modules + flag requirements
-    preset = Preset(require_flags=["passive"], modules=["sslcert", "dotnetnuke", "wayback"]).bake()
+    preset = Preset(require_flags=["passive"], modules=["sslcert", "dotnetnuke", "wayback"]).validate().bake()
     assert set(preset.scan_modules) == {"wayback"}
 
     # modules + module exclusions
-    baked_preset = Preset(exclude_modules=["sslcert"], modules=["sslcert", "dotnetnuke", "wayback"]).bake()
+    baked_preset = Preset(exclude_modules=["sslcert"], modules=["sslcert", "dotnetnuke", "wayback"]).validate().bake()
     assert baked_preset.modules == {
         "wayback",
         "cloudcheck",
@@ -637,7 +629,7 @@ def test_preset_scope_round_trip(clean_default_config):
         "config": {"scope": {"strict": True}},
     }
     preset = Preset.from_dict(preset_dict)
-    baked = preset.bake()
+    baked = preset.validate().bake()
     # Seeds should round-trip unchanged
     assert list(baked.seeds) == ["127.0.0.1"]
     # Target list should round-trip unchanged
@@ -656,7 +648,7 @@ def test_preset_target_tolerance():
         "targets": ["127.0.0.2"],
     }
     preset = Preset.from_dict(preset_dict)
-    baked = preset.bake()
+    baked = preset.validate().bake()
     assert set(baked.seeds) == {"127.0.0.1", "127.0.0.2"}
 
     preset = Preset.from_yaml_string("""
@@ -665,7 +657,7 @@ def test_preset_target_tolerance():
 targets:
   - 127.0.0.2
 """)
-    baked = preset.bake()
+    baked = preset.validate().bake()
     assert set(baked.seeds) == {"127.0.0.1", "127.0.0.2"}
 
 
@@ -793,16 +785,14 @@ class TestModule5(BaseModule):
 """
         )
 
-    preset = Preset.from_yaml_string(
-        """
+    # unknown module name is caught at validate()
+    with pytest.raises(ValidationError):
+        Preset.from_yaml_string(
+            """
 modules:
   - testmodule5
 """
-    )
-    # should fail
-    with pytest.raises(ValidationError):
-        scan = Scanner(preset=preset)
-        await scan._prep()
+        ).validate()
 
     preset = Preset.from_yaml_string(
         f"""
@@ -831,6 +821,8 @@ def test_preset_include():
     mkdir(custom_preset_dir_4)
     mkdir(custom_preset_dir_5)
 
+    # Real modules so the (now-strict) validator accepts them. We use the
+    # universal `module_timeout` field as an opaque marker per preset.
     preset_file = custom_preset_dir_1 / "preset1.yml"
     with open(preset_file, "w") as f:
         f.write(
@@ -840,8 +832,8 @@ def test_preset_include():
 
 config:
   modules:
-    testpreset1:
-      test: asdf
+    nuclei:
+      module_timeout: 1
 """
         )
 
@@ -854,8 +846,8 @@ def test_preset_include():
 
 config:
   modules:
-    testpreset2:
-      test: fdsa
+    sslcert:
+      module_timeout: 2
 """
         )
 
@@ -870,8 +862,8 @@ def test_preset_include():
 
 config:
   modules:
-    testpreset3:
-      test: qwerty
+    gowitness:
+      module_timeout: 3
 """
         )
 
@@ -884,8 +876,8 @@ def test_preset_include():
 
 config:
   modules:
-    testpreset4:
-      test: zxcv
+    robots:
+      module_timeout: 4
 """
         )
 
@@ -895,26 +887,26 @@ def test_preset_include():
             """
 config:
   modules:
-    testpreset5:
-      test: hjkl
+    wayback:
+      module_timeout: 5
 """
         )
 
     # with include=
     preset = Preset(include=[str(custom_preset_dir_1 / "preset1")])
-    assert preset.config.modules.testpreset1.test == "asdf"
-    assert preset.config.modules.testpreset2.test == "fdsa"
-    assert preset.config.modules.testpreset3.test == "qwerty"
-    assert preset.config.modules.testpreset4.test == "zxcv"
-    assert preset.config.modules.testpreset5.test == "hjkl"
+    assert preset.config["modules"]["nuclei"]["module_timeout"] == 1
+    assert preset.config["modules"]["sslcert"]["module_timeout"] == 2
+    assert preset.config["modules"]["gowitness"]["module_timeout"] == 3
+    assert preset.config["modules"]["robots"]["module_timeout"] == 4
+    assert preset.config["modules"]["wayback"]["module_timeout"] == 5
 
     # same thing but with presets= (an alias to include)
     preset = Preset(presets=[str(custom_preset_dir_1 / "preset1")])
-    assert preset.config.modules.testpreset1.test == "asdf"
-    assert preset.config.modules.testpreset2.test == "fdsa"
-    assert preset.config.modules.testpreset3.test == "qwerty"
-    assert preset.config.modules.testpreset4.test == "zxcv"
-    assert preset.config.modules.testpreset5.test == "hjkl"
+    assert preset.config["modules"]["nuclei"]["module_timeout"] == 1
+    assert preset.config["modules"]["sslcert"]["module_timeout"] == 2
+    assert preset.config["modules"]["gowitness"]["module_timeout"] == 3
+    assert preset.config["modules"]["robots"]["module_timeout"] == 4
+    assert preset.config["modules"]["wayback"]["module_timeout"] == 5
 
     # can't use both include= and presets= at the same time
     with pytest.raises(ValueError):
@@ -968,25 +960,25 @@ async def test_preset_conditions():
 
 async def test_preset_module_disablement(clean_default_config):
     # internal module disablement
-    preset = Preset().bake()
+    preset = Preset().validate().bake()
     assert "speculate" in preset.internal_modules
     assert "excavate" in preset.internal_modules
     assert "aggregate" in preset.internal_modules
-    preset = Preset(config={"speculate": False}).bake()
+    preset = Preset(config={"speculate": False}).validate().bake()
     assert "speculate" not in preset.internal_modules
     assert "excavate" in preset.internal_modules
     assert "aggregate" in preset.internal_modules
-    preset = Preset(exclude_modules=["speculate", "excavate"]).bake()
+    preset = Preset(exclude_modules=["speculate", "excavate"]).validate().bake()
     assert "speculate" not in preset.internal_modules
     assert "excavate" not in preset.internal_modules
     assert "aggregate" in preset.internal_modules
 
     # internal module disablement
-    preset = Preset().bake()
+    preset = Preset().validate().bake()
     assert set(preset.output_modules) == {"python", "txt", "csv", "json"}
-    preset = Preset(exclude_modules=["txt", "csv"]).bake()
+    preset = Preset(exclude_modules=["txt", "csv"]).validate().bake()
     assert set(preset.output_modules) == {"python", "json"}
-    preset = Preset(output_modules=["json"]).bake()
+    preset = Preset(output_modules=["json"]).validate().bake()
     assert set(preset.output_modules) == {"json"}
 
 
@@ -1001,8 +993,8 @@ async def test_preset_override(clean_default_config):
   - robots
 config:
   modules:
-    asdf:
-      option1: asdf
+    robots:
+      module_timeout: 10
 """
     preset_2_yaml = """
 name: override2
@@ -1013,8 +1005,8 @@ async def test_preset_override(clean_default_config):
   - c99
 config:
   modules:
-    asdf:
-      option1: fdsa
+    robots:
+      module_timeout: 20
 """
     preset_3_yaml = """
 name: override3
@@ -1059,7 +1051,7 @@ async def test_preset_override(clean_default_config):
     assert preset.debug is True
     assert preset.silent is True
     assert preset.name == "override4"
-    preset = preset.bake()
+    preset = preset.validate().bake()
     assert preset.debug is False
     assert preset.silent is True
     assert preset.name == "override4"
@@ -1068,7 +1060,7 @@ async def test_preset_override(clean_default_config):
     assert targets == {"evilcorp1.com", "evilcorp2.com", "evilcorp3.com", "evilcorp4.com"}
     assert preset.config["web"]["spider_distance"] == 1
     assert preset.config["web"]["spider_depth"] == 2
-    assert preset.config["modules"]["asdf"]["option1"] == "fdsa"
+    assert preset.config["modules"]["robots"]["module_timeout"] == 20
     assert set(preset.scan_modules) == {"http", "c99", "robots", "virustotal", "securitytrails"}
 
 
@@ -1079,7 +1071,7 @@ def get_module_flags(p):
             yield m, preloaded.get("flags", [])
 
     # enable by flag, no exclusions/requirements
-    preset = Preset(flags=["subdomain-enum"]).bake()
+    preset = Preset(flags=["subdomain-enum"]).validate().bake()
     assert len(preset.modules) > 25
     module_flags = list(get_module_flags(preset))
     dnsbrute_flags = preset.preloaded_module("dnsbrute").get("flags", [])
@@ -1097,7 +1089,7 @@ def get_module_flags(p):
     assert any("loud" in flags for module, flags in module_flags)
 
     # enable by flag, one required flag
-    preset = Preset(flags=["subdomain-enum"], require_flags=["passive"]).bake()
+    preset = Preset(flags=["subdomain-enum"], require_flags=["passive"]).validate().bake()
     assert len(preset.modules) > 25
     module_flags = list(get_module_flags(preset))
     assert "chaos" in [x[0] for x in module_flags]
@@ -1108,7 +1100,7 @@ def get_module_flags(p):
     assert any("loud" in flags for module, flags in module_flags)
 
     # enable by flag, one excluded flag
-    preset = Preset(flags=["subdomain-enum"], exclude_flags=["active"]).bake()
+    preset = Preset(flags=["subdomain-enum"], exclude_flags=["active"]).validate().bake()
     assert len(preset.modules) > 25
     module_flags = list(get_module_flags(preset))
     assert "chaos" in [x[0] for x in module_flags]
@@ -1119,7 +1111,7 @@ def get_module_flags(p):
     assert any("loud" in flags for module, flags in module_flags)
 
     # enable by flag, one excluded module
-    preset = Preset(flags=["subdomain-enum"], exclude_modules=["dnsbrute"]).bake()
+    preset = Preset(flags=["subdomain-enum"], exclude_modules=["dnsbrute"]).validate().bake()
     assert len(preset.modules) > 25
     module_flags = list(get_module_flags(preset))
     assert "dnsbrute" not in [x[0] for x in module_flags]
@@ -1130,7 +1122,7 @@ def get_module_flags(p):
     assert any("loud" in flags for module, flags in module_flags)
 
     # enable by flag, multiple required flags
-    preset = Preset(flags=["subdomain-enum"], require_flags=["safe", "passive"]).bake()
+    preset = Preset(flags=["subdomain-enum"], require_flags=["safe", "passive"]).validate().bake()
     assert len(preset.modules) > 20
     module_flags = list(get_module_flags(preset))
     assert "dnsbrute" not in [x[0] for x in module_flags]
@@ -1140,7 +1132,7 @@ def get_module_flags(p):
     assert not any("loud" in flags for module, flags in module_flags)
 
     # enable by flag, multiple excluded flags
-    preset = Preset(flags=["subdomain-enum"], exclude_flags=["loud", "active"]).bake()
+    preset = Preset(flags=["subdomain-enum"], exclude_flags=["loud", "active"]).validate().bake()
     assert len(preset.modules) > 20
     module_flags = list(get_module_flags(preset))
     assert "dnsbrute" not in [x[0] for x in module_flags]
@@ -1150,7 +1142,7 @@ def get_module_flags(p):
     assert not any("loud" in flags for module, flags in module_flags)
 
     # enable by flag, multiple excluded modules
-    preset = Preset(flags=["subdomain-enum"], exclude_modules=["dnsbrute", "c99"]).bake()
+    preset = Preset(flags=["subdomain-enum"], exclude_modules=["dnsbrute", "c99"]).validate().bake()
     assert len(preset.modules) > 25
     module_flags = list(get_module_flags(preset))
     assert "dnsbrute" not in [x[0] for x in module_flags]
@@ -1184,7 +1176,7 @@ async def test_preset_output_dir():
 # regression test for https://github.com/blacklanternsecurity/bbot/issues/2337
 async def test_preset_serialization(clean_default_config):
     preset = Preset("192.168.1.1")
-    preset = preset.bake()
+    preset = preset.validate().bake()
 
     import orjson as json
 
@@ -1284,10 +1276,10 @@ def test_preset_dnsresolve_required_by_dns_name_consumers():
         {"config": {"dns": {"disable": True}}, "flags": ["subdomain-enum"]},
     ):
         with pytest.raises(ValidationError, match="dnsresolve is required"):
-            Preset(**opt_out).bake()
+            Preset(**opt_out).validate().bake()
 
     # dns.minimal keeps dnsresolve in the pipeline -- must NOT fire
-    Preset(flags=["subdomain-enum"], config={"dns": {"minimal": True}}).bake()
+    Preset(flags=["subdomain-enum"], config={"dns": {"minimal": True}}).validate().bake()
 
     # disabling dnsresolve with no DNS_NAME consumers enabled is allowed
-    Preset(exclude_modules=["dnsresolve"]).bake()
+    Preset(exclude_modules=["dnsresolve"]).validate().bake()
diff --git a/bbot/test/test_step_1/test_scan.py b/bbot/test/test_step_1/test_scan.py
index d094fd4093..2fc2d60a13 100644
--- a/bbot/test/test_step_1/test_scan.py
+++ b/bbot/test/test_step_1/test_scan.py
@@ -391,7 +391,7 @@ async def handle_event(self, event):
     # then run a scan with --exclude-cdn enabled
     preset = Preset("evilcorp.com")
     preset.parse_args()
-    baked_preset = preset.bake()
+    baked_preset = preset.validate().bake()
     assert baked_preset.to_yaml() == "modules:\n- portfilter\n"
     scan = bbot_scanner("evilcorp.com", preset=preset)
     await scan._prep()
diff --git a/bbot/test/test_step_1/test_validate_preset.py b/bbot/test/test_step_1/test_validate_preset.py
new file mode 100644
index 0000000000..4844381aee
--- /dev/null
+++ b/bbot/test/test_step_1/test_validate_preset.py
@@ -0,0 +1,313 @@
+from ..bbot_fixtures import *  # noqa: F401
+
+from bbot.scanner import validate_preset
+
+
+def test_validate_preset_valid():
+    errs = validate_preset({"modules": ["sslcert"], "config": {"scope": {"strict": True}}})
+    assert errs == []
+
+
+def test_validate_preset_typo_top_level():
+    errs = validate_preset({"modlues": ["nuclei"]})
+    assert len(errs) == 1
+    assert errs[0].where == "preset"
+    assert "modlues" in errs[0].message
+
+
+def test_validate_preset_typo_in_config():
+    errs = validate_preset({"config": {"scope": {"strct": True}}})
+    assert len(errs) == 1
+    assert errs[0].where == "config"
+    assert "strct" in errs[0].message
+    assert errs[0].path == "scope.strct"
+
+
+def test_validate_preset_wrong_type():
+    errs = validate_preset({"config": {"web": {"http_timeout": "not-a-number"}}})
+    assert len(errs) == 1
+    assert errs[0].where == "config"
+    assert errs[0].path == "web.http_timeout"
+    assert "integer" in errs[0].message
+
+
+def test_validate_preset_unknown_module():
+    errs = validate_preset({"modules": ["nucleii"]})
+    # closest-match suggestion: "Could not find module 'nucleii'. Did you mean 'nuclei'?"
+    assert any('"nucleii"' in str(e) and "nuclei" in str(e) for e in errs)
+
+
+def test_validate_preset_unknown_module_option():
+    """Typo in a known module's option key gets tagged `module:<name>`."""
+    errs = validate_preset({"config": {"modules": {"nuclei": {"tgas": "apache"}}}})
+    assert len(errs) == 1
+    assert errs[0].where == "module:nuclei"
+    assert errs[0].path == "tgas"
+    assert "tgas" in errs[0].message
+
+
+def test_validate_preset_wrong_type_on_module_option():
+    """Known module option with wrong type (nuclei.ratelimit is int)."""
+    errs = validate_preset({"config": {"modules": {"nuclei": {"ratelimit": "not-a-number"}}}})
+    assert len(errs) == 1
+    assert errs[0].where == "module:nuclei"
+    assert errs[0].path == "ratelimit"
+    assert "integer" in errs[0].message
+
+
+def test_validate_preset_unknown_module_in_config():
+    """Unknown module name nested under config.modules gets a clean error."""
+    errs = validate_preset({"config": {"modules": {"nucleii": {"tgas": "x"}}}})
+    # closest-match: "Could not find module 'nucleii'. Did you mean 'nuclei'?"
+    assert any('"nucleii"' in str(e) and "nuclei" in str(e) for e in errs)
+
+
+def test_validate_preset_multiple_errors():
+    """A preset with several typos should produce errors for all of them, not just the first."""
+    errs = validate_preset(
+        {
+            "modlues": ["x"],  # typo in top-level key
+            "config": {
+                "scope": {"strct": True},  # typo in config section
+                "web": {"http_timeout": "bad"},  # wrong type
+            },
+        },
+    )
+    assert len(errs) >= 3
+    messages = " ".join(str(e) for e in errs)
+    assert "modlues" in messages
+    assert "strct" in messages
+    assert "http_timeout" in messages
+
+
+def test_validate_preset_non_dict():
+    errs = validate_preset(["not a dict"])
+    assert len(errs) == 1
+    assert "dict" in errs[0].message
+
+
+def test_validate_preset_config_modules_as_list():
+    """`config.modules` given as a list (wrong shape) used to crash with IndexError."""
+    errs = validate_preset({"config": {"modules": ["nuclei"]}})
+    assert len(errs) == 1
+    assert errs[0].where == "config"
+    assert errs[0].path == "modules"
+
+
+def test_validate_preset_module_dirs_as_string():
+    """`module_dirs` as a string used to iterate characters and raise PermissionError."""
+    errs = validate_preset({"module_dirs": "/tmp/foo"})
+    assert any(e.path == "module_dirs" and "list" in e.message for e in errs)
+
+
+def test_validate_preset_modules_as_string_no_cascade():
+    """`modules: "nuclei"` (string instead of list) should NOT produce per-character lookups."""
+    errs = validate_preset({"modules": "nuclei"})
+    # exactly one type error, no per-character bogus suggestions
+    assert len(errs) == 1
+    assert errs[0].path == "modules"
+    assert "list" in errs[0].message
+
+
+def test_validate_preset_non_string_module_entry_no_crash():
+    """A non-string entry in modules/output_modules/exclude_modules (e.g. a dangling YAML
+    list item -> None) must be reported as a type error, never raise TypeError."""
+    # dangling YAML item -> None
+    errs = validate_preset({"modules": ["nuclei", None]})
+    assert len(errs) == 1
+    assert errs[0].path == "modules.1"
+    assert "string" in errs[0].message and "None" in errs[0].message
+
+    # a typo alongside the bad entry: both surface, still no crash
+    errs = validate_preset({"modules": ["nucleii", None]})
+    assert len(errs) == 2
+    assert any('Did you mean "nuclei"' in str(e) for e in errs)
+
+    # int and unhashable (dict) entries must not crash the set membership / difflib calls
+    errs = validate_preset({"output_modules": [123], "exclude_modules": [{"a": 1}]})
+    assert len(errs) == 2
+    assert all("string" in e.message for e in errs)
+
+
+def test_validate_preset_top_level_typo_suggests_preset_field():
+    """Typos at the preset root should suggest preset field names, not config paths."""
+    cases = [
+        ("modlues", "modules"),
+        ("flgas", "flags"),
+        ("targest", "target"),
+        ("output_moduels", "output_modules"),
+    ]
+    for typo, expected in cases:
+        errs = validate_preset({typo: ["x"]})
+        assert any(f'"{typo}"' in str(e) and f'"{expected}"' in str(e) for e in errs), (
+            f"expected suggestion {expected!r} for typo {typo!r}, got: {[str(e) for e in errs]}"
+        )
+
+
+def test_validate_preset_file_missing_returns_error():
+    """A missing preset path should be reported as a single error, not raised."""
+    from bbot.scanner import validate_preset_file
+
+    errs = validate_preset_file("/tmp/does-not-exist-bbot-fuzz.yml")
+    assert len(errs) == 1
+    assert "not found" in errs[0].message.lower()
+
+
+def test_from_dict_raises_on_typos():
+    """from_dict() should reject typo'd preset dicts up front instead of letting
+    them flow through to bake()."""
+    from bbot.errors import ValidationError as BBOTValidationError
+    from bbot.scanner.preset import Preset
+
+    import pytest
+
+    with pytest.raises(BBOTValidationError) as excinfo:
+        Preset.from_dict({"modlues": ["nuclei"]})
+    assert "modlues" in str(excinfo.value)
+
+
+def test_from_yaml_string_raises_on_top_level_typo():
+    """A top-level key typo in a YAML string is rejected up front by from_dict's gate."""
+    from bbot.errors import ValidationError as BBOTValidationError
+    from bbot.scanner.preset import Preset
+
+    import pytest
+
+    with pytest.raises(BBOTValidationError) as excinfo:
+        Preset.from_yaml_string("flgas:\n  - subdomain-enum\n")
+    assert "flgas" in str(excinfo.value)
+
+
+def test_from_yaml_config_typo_deferred_to_validate():
+    """A config-VALUE typo passes the top-level key gate; validate() catches it, not load."""
+    from bbot.errors import ValidationError as BBOTValidationError
+    from bbot.scanner.preset import Preset
+
+    import pytest
+
+    preset = Preset.from_yaml_string("config:\n  scope:\n    strct: true\n")
+    assert preset._validated is False
+    with pytest.raises(BBOTValidationError) as excinfo:
+        preset.validate()
+    assert "strct" in str(excinfo.value)
+
+
+def test_validate_preset_interactsh_server_accepts_valid():
+    """interactsh_server accepts FQDNs, IPv4, IPv6, None, and empty string."""
+    for v in ["example.com", "sub.example.com", "192.168.1.1", "::1", "", None]:
+        errs = validate_preset({"config": {"interactsh_server": v}})
+        assert errs == [], f"expected {v!r} to validate, got: {[str(e) for e in errs]}"
+
+
+def test_validate_preset_interactsh_server_rejects_invalid():
+    """A single-label hostname (a value without any dots, e.g. a typo'd
+    domain where the user forgot the TLD) or a value with whitespace must
+    be rejected at preset-load time, before any module tries to register
+    with the interactsh server."""
+    for v in ["badhost", "localhost", "with spaces.com"]:
+        errs = validate_preset({"config": {"interactsh_server": v}})
+        assert len(errs) == 1, f"expected {v!r} to fail validation"
+        assert errs[0].path == "interactsh_server"
+        assert "FQDN or IP" in errs[0].message
+        assert repr(v) in errs[0].message
+
+
+def test_defaults_yml_validates_against_schema():
+    """BBOT's own defaults.yml must pass its own validator. Guards against the pydantic
+    schema (core/config/models.py) silently drifting from defaults.yml -- if a key is
+    added/renamed in defaults.yml, the schema must keep up or this fails."""
+    import yaml
+    from pathlib import Path
+    import bbot
+
+    defaults = yaml.safe_load((Path(bbot.__file__).parent / "defaults.yml").read_text())
+    errs = validate_preset({"config": defaults})
+    assert errs == [], "defaults.yml must validate clean:\n" + "\n".join(str(e) for e in errs)
+
+
+def test_validate_preset_sql_retries_settable():
+    """`retries` is read by the shared SQLTemplate.setup, so each concrete SQL output
+    module must declare it in its Config (otherwise it's rejected as an unknown option)."""
+    for module in ("postgres", "mysql", "sqlite"):
+        errs = validate_preset({"config": {"modules": {module: {"retries": 5}}}})
+        assert errs == [], f"{module}.retries should validate, got: {[str(e) for e in errs]}"
+
+
+def test_validate_preset_wordlist_accepts_list():
+    """*_wordlist fields document a list form (merge multiple wordlists); the validating
+    path must accept a list, not only a string. Regression for a documented-feature break."""
+    for module, field in [
+        ("dnsbrute", "wordlist"),
+        ("paramminer_headers", "wordlist"),
+        ("webbrute", "wordlist"),
+        ("legba", "ssh_wordlist"),
+    ]:
+        errs = validate_preset({"config": {"modules": {module: {field: ["/tmp/a.txt", "/tmp/b.txt"]}}}})
+        assert errs == [], f"{module}.{field} list form should validate, got: {[str(e) for e in errs]}"
+
+
+def test_validate_preset_nuclei_mode_lowercase_literal():
+    """nuclei.mode is a lowercase Literal: lowercase values pass; anything else (incl.
+    mixed case) is rejected with the allowed values listed."""
+    assert validate_preset({"config": {"modules": {"nuclei": {"mode": "manual"}}}}) == []
+    errs = validate_preset({"config": {"modules": {"nuclei": {"mode": "MANUAL"}}}})
+    assert len(errs) == 1
+    assert errs[0].where == "module:nuclei" and errs[0].path == "mode"
+    assert "Expected one of" in errs[0].message and "'manual'" in errs[0].message
+
+
+def test_validate_preset_bad_module_dir_returns_errors(tmp_path):
+    """A custom module_dir containing an unloadable module (here a legacy options dict,
+    which preload rejects via sys.exit) must surface as an error, not kill the caller."""
+    from bbot.core.modules import ModuleLoader
+
+    mod_dir = tmp_path / "badmods"
+    mod_dir.mkdir()
+    (mod_dir / "legacymod.py").write_text(
+        "from bbot.modules.base import BaseModule\n"
+        "class legacymod(BaseModule):\n"
+        '    watched_events = ["DNS_NAME"]\n'
+        '    produced_events = ["DNS_NAME"]\n'
+        '    flags = ["passive", "safe"]\n'
+        '    meta = {"description": "x", "created_date": "2025-01-01", "author": "@x"}\n'
+        '    options = {"foo": "bar"}\n'
+        '    options_desc = {"foo": "a foo"}\n'
+    )
+    # isolated loader so the bad dir doesn't pollute the global one
+    errs = validate_preset(
+        {"module_dirs": [str(mod_dir)], "modules": ["legacymod"]},
+        module_loader=ModuleLoader(),
+    )
+    assert any(e.path == "module_dirs" for e in errs), [str(e) for e in errs]
+
+
+def test_build_validation_schema_tolerates_unexecable_config():
+    """A custom module whose `class Config` references a module-level name (valid at real
+    import, but unresolvable in the isolated exec namespace) must not break schema building.
+    The module falls back to accepting any config rather than being rejected."""
+    from bbot.core.modules import _build_validation_schema
+
+    preloaded = {
+        "synthmod": {
+            "config_source": (
+                "class Config(BaseModuleConfig):\n    threads: int = Field(MY_UNDEFINED_CONSTANT, description='x')\n"
+            ),
+        },
+    }
+    schema = _build_validation_schema(preloaded)  # must not raise
+    # the module is usable and accepts arbitrary config (lenient fallback)
+    assert schema.model_validate({"config": {"modules": {"synthmod": {"threads": 5, "anything": "x"}}}})
+
+
+def test_validate_preset_baddns_subclass_severity_is_validated():
+    """baddns_direct/baddns_zone validate min_severity/min_confidence against the shared
+    severity/confidence Literal (case-insensitive), not accept arbitrary strings."""
+    assert validate_preset({"config": {"modules": {"baddns_direct": {"min_severity": "low"}}}}) == []
+    errs = validate_preset({"config": {"modules": {"baddns_zone": {"min_severity": "BOGUS"}}}})
+    assert len(errs) == 1 and errs[0].path == "min_severity"
+    assert "Expected one of" in errs[0].message
+
+
+def test_validate_preset_shodan_idb_retries_is_int():
+    """shodan_idb.retries is numeric; the natural `retries: 3` must validate (was typed str)."""
+    assert validate_preset({"config": {"modules": {"shodan_idb": {"retries": 3}}}}) == []
diff --git a/bbot/test/test_step_2/module_tests/base.py b/bbot/test/test_step_2/module_tests/base.py
index 35829e217f..448c12ab09 100644
--- a/bbot/test/test_step_2/module_tests/base.py
+++ b/bbot/test/test_step_2/module_tests/base.py
@@ -2,10 +2,10 @@
 import asyncio
 import logging
 import pytest_asyncio
-from omegaconf import OmegaConf
 
 from ...bbot_fixtures import *
 from bbot.scanner import Scanner
+from bbot.core.config.merge import deep_merge
 from bbot.core.helpers.misc import rand_string
 
 log = logging.getLogger("bbot.test.modules")
@@ -28,7 +28,7 @@ def __init__(
             self, module_test_base, blasthttp_mock, httpserver, httpserver_ssl, monkeypatch, request, caplog, capsys
         ):
             self.name = module_test_base.name
-            self.config = OmegaConf.merge(CORE.config, OmegaConf.create(module_test_base.config_overrides))
+            self.config = deep_merge(dict(CORE.custom_config), dict(module_test_base.config_overrides))
 
             self.caplog = caplog
             self.capsys = capsys
@@ -51,7 +51,7 @@ def __init__(
                     if module_type == "output":
                         output_modules.append(module)
                     elif module_type == "internal" and not module == "dnsresolve":
-                        self.config = OmegaConf.merge(self.config, {module: True})
+                        self.config = deep_merge(self.config, {module: True})
 
             seeds = module_test_base.seeds or None
 
diff --git a/bbot/test/test_step_2/module_tests/test_module_aspnet_bin_exposure.py b/bbot/test/test_step_2/module_tests/test_module_aspnet_bin_exposure.py
index 1ce91d45fc..e53e0c4dc2 100644
--- a/bbot/test/test_step_2/module_tests/test_module_aspnet_bin_exposure.py
+++ b/bbot/test/test_step_2/module_tests/test_module_aspnet_bin_exposure.py
@@ -5,15 +5,6 @@
 class TestAspnetBinExposure(ModuleTestBase):
     targets = ["http://127.0.0.1:8888"]
     modules_overrides = ["http", "aspnet_bin_exposure"]
-    config_overrides = {
-        "modules": {
-            "aspnet_bin_exposure": {
-                "test_dlls": [
-                    "Newtonsoft.Json.dll",
-                ]
-            }
-        }
-    }
 
     async def setup_before_prep(self, module_test):
         # Simulate successful DLL exposure
diff --git a/bbot/test/test_step_2/module_tests/test_module_github_org.py b/bbot/test/test_step_2/module_tests/test_module_github_org.py
index fd3fe133fd..866e8d3c78 100644
--- a/bbot/test/test_step_2/module_tests/test_module_github_org.py
+++ b/bbot/test/test_step_2/module_tests/test_module_github_org.py
@@ -2,9 +2,7 @@
 
 
 class TestGithub_Org(ModuleTestBase):
-    config_overrides = {
-        "modules": {"github_org": {"api_key": "asdf"}, "github": {"api_key": "asdf"}, "git_clone": {"api_key": ""}}
-    }
+    config_overrides = {"modules": {"github_org": {"api_key": "asdf"}, "git_clone": {"api_key": ""}}}
     modules_overrides = ["github_org", "speculate"]
 
     async def setup_before_prep(self, module_test):
@@ -320,7 +318,7 @@ def check(self, module_test, events):
 
 
 class TestGithub_Org_No_Members(TestGithub_Org):
-    config_overrides = {"modules": {"github_org": {"include_members": False}, "github": {"api_key": "asdf"}}}
+    config_overrides = {"modules": {"github_org": {"include_members": False, "api_key": "asdf"}}}
 
     def check(self, module_test, events):
         assert 1 == len(
@@ -349,7 +347,7 @@ def check(self, module_test, events):
 class TestGithub_Org_MemberRepos(TestGithub_Org):
     config_overrides = {
         "scope": {"report_distance": 2, "search_distance": 2},
-        "modules": {"github_org": {"include_member_repos": True}, "github": {"api_key": "asdf"}},
+        "modules": {"github_org": {"include_member_repos": True, "api_key": "asdf"}},
     }
 
     def check(self, module_test, events):
@@ -367,7 +365,7 @@ class TestGithub_Org_Custom_Target(TestGithub_Org):
         "scope": {"report_distance": 10, "search_distance": 2},
         "omit_event_types": [],
         "speculate": True,
-        "modules": {"github": {"api_key": "asdf"}},
+        "modules": {"github_org": {"api_key": "asdf"}},
     }
 
     def check(self, module_test, events):
diff --git a/bbot/test/test_step_2/module_tests/test_module_gowitness.py b/bbot/test/test_step_2/module_tests/test_module_gowitness.py
index d9c22085af..f67836b72c 100644
--- a/bbot/test/test_step_2/module_tests/test_module_gowitness.py
+++ b/bbot/test/test_step_2/module_tests/test_module_gowitness.py
@@ -12,7 +12,7 @@ class TestGowitness(ModuleTestBase):
     home_dir = Path("/tmp/.bbot_gowitness_test")
     shutil.rmtree(home_dir, ignore_errors=True)
     config_overrides = {
-        "force_deps": True,
+        "deps": {"behavior": "force_install"},
         "home": str(home_dir),
         "scope": {"report_distance": 2},
         "omit_event_types": [],
@@ -150,7 +150,7 @@ class TestGowitness_MultiPort(ModuleTestBase):
     home_dir = Path("/tmp/.bbot_gowitness_multiport_test")
     shutil.rmtree(home_dir, ignore_errors=True)
     config_overrides = {
-        "force_deps": True,
+        "deps": {"behavior": "force_install"},
         "home": str(home_dir),
         "omit_event_types": [],
     }
diff --git a/bbot/test/test_step_2/module_tests/test_module_leakix.py b/bbot/test/test_step_2/module_tests/test_module_leakix.py
index e363b6a9fe..a33b2575ce 100644
--- a/bbot/test/test_step_2/module_tests/test_module_leakix.py
+++ b/bbot/test/test_step_2/module_tests/test_module_leakix.py
@@ -24,26 +24,3 @@ async def setup_before_prep(self, module_test):
 
     def check(self, module_test, events):
         assert any(e.data == "asdf.blacklanternsecurity.com" for e in events), "Failed to detect subdomain"
-
-
-class TestLeakIX_NoAPIKey(ModuleTestBase):
-    modules_overrides = ["leakix"]
-
-    async def setup_before_prep(self, module_test):
-        module_test.blasthttp_mock.add_response(
-            url="https://leakix.net/host/1.1.1.1",
-            json={"title": "Not Found", "description": "Host not found"},
-        )
-        module_test.blasthttp_mock.add_response(
-            url="https://leakix.net/api/subdomains/blacklanternsecurity.com",
-            json=[
-                {
-                    "subdomain": "asdf.blacklanternsecurity.com",
-                    "distinct_ips": 3,
-                    "last_seen": "2023-04-02T09:38:30.02Z",
-                },
-            ],
-        )
-
-    def check(self, module_test, events):
-        assert any(e.data == "asdf.blacklanternsecurity.com" for e in events), "Failed to detect subdomain"
diff --git a/bbot/test/test_step_2/module_tests/test_module_nuclei.py b/bbot/test/test_step_2/module_tests/test_module_nuclei.py
index 5cf59aabbd..88f0e2a01e 100644
--- a/bbot/test/test_step_2/module_tests/test_module_nuclei.py
+++ b/bbot/test/test_step_2/module_tests/test_module_nuclei.py
@@ -10,13 +10,13 @@ class TestNucleiManual(ModuleTestBase):
             "spider_distance": 1,
             "spider_depth": 1,
         },
+        "interactsh_disable": True,
         "modules": {
             "nuclei": {
                 "mode": "manual",
                 "concurrency": 2,
                 "ratelimit": 10,
                 "templates": "/tmp/.bbot_test/tools/nuclei-state/templates/http/miscellaneous/",
-                "interactsh_disable": True,
                 "directory_only": False,
             }
         },
@@ -109,15 +109,15 @@ def check(self, module_test, events):
 
 class TestNucleiBudget(TestNucleiManual):
     config_overrides = {
+        "interactsh_disable": True,
         "modules": {
             "nuclei": {
                 "mode": "budget",
                 "concurrency": 1,
                 "tags": "spiderfoot",
                 "templates": "/tmp/.bbot_test/tools/nuclei-state/templates/exposed-panels/spiderfoot.yaml",
-                "interactsh_disable": True,
             }
-        }
+        },
     }
 
     async def setup_before_prep(self, module_test):
diff --git a/bbot/test/test_step_2/module_tests/test_module_shodan_dns.py b/bbot/test/test_step_2/module_tests/test_module_shodan_dns.py
index 7656c5a2b0..ebedce64e8 100644
--- a/bbot/test/test_step_2/module_tests/test_module_shodan_dns.py
+++ b/bbot/test/test_step_2/module_tests/test_module_shodan_dns.py
@@ -2,7 +2,7 @@
 
 
 class TestShodan_DNS(ModuleTestBase):
-    config_overrides = {"modules": {"shodan": {"api_key": "asdf"}}}
+    config_overrides = {"modules": {"shodan_dns": {"api_key": "asdf"}}}
 
     async def setup_before_prep(self, module_test):
         module_test.blasthttp_mock.add_response(
diff --git a/bbot/test/test_step_2/module_tests/test_module_webbrute_shortnames.py b/bbot/test/test_step_2/module_tests/test_module_webbrute_shortnames.py
index 77e8cc74e2..6a54cac4ae 100644
--- a/bbot/test/test_step_2/module_tests/test_module_webbrute_shortnames.py
+++ b/bbot/test/test_step_2/module_tests/test_module_webbrute_shortnames.py
@@ -1,16 +1,14 @@
-from .base import ModuleTestBase, tempwordlist
+from .base import ModuleTestBase
 
 
 class TestWebBruteShortnames(ModuleTestBase):
     targets = ["http://127.0.0.1:8888"]
     module_name = "webbrute_shortnames"
-    test_wordlist = ["11111111", "administrator", "portal", "console", "junkword1", "zzzjunkword2", "directory"]
     config_overrides = {
         "modules": {
             "webbrute_shortnames": {
                 "find_common_prefixes": True,
                 "find_subwords": True,
-                "wordlist": tempwordlist(test_wordlist),
                 "max_predictions": 250,
             }
         }
diff --git a/docs/dev/preset_validation.md b/docs/dev/preset_validation.md
new file mode 100644
index 0000000000..48b993dd07
--- /dev/null
+++ b/docs/dev/preset_validation.md
@@ -0,0 +1,146 @@
+# Validating, Sanitizing, and Inspecting Presets
+
+BBOT's preset and module configs are described by [pydantic](https://docs.pydantic.dev/) models — the same models that power `bbot -l` and `bbot --help`. The helpers below let you reuse those models from your own code to validate a preset, redact sensitive values, or dump module metadata.
+
+All of these helpers work on plain dicts (i.e. what you'd get from `yaml.safe_load`), so you can call them before instantiating a `Preset` or `Scanner`.
+
+## Validate a preset
+
+[`validate_preset`](https://github.com/blacklanternsecurity/bbot/blob/dev/bbot/scanner/preset/validate.py) catches typos and type errors in one pass — top-level preset keys, global config, unknown module names, and per-module options:
+
+```python
+from bbot.scanner import validate_preset
+
+errors = validate_preset({
+    "modules": ["nuclei"],
+    "config": {
+        "scope": {"strict": True},
+        "modules": {"nuclei": {"ratelimit": 200}},
+    },
+})
+
+for err in errors:
+    print(err)
+```
+
+Empty list → valid. Each [`PresetValidationError`](https://github.com/blacklanternsecurity/bbot/blob/dev/bbot/scanner/preset/validate.py) carries a `where` (e.g. `"preset"`, `"config"`, `"module:nuclei"`), a dotted `path`, and a human-readable `message` with closest-match suggestions when applicable. To validate a YAML file directly, use `validate_preset_file(path)`.
+
+## Redact secrets from a config
+
+Each module's `class Config(BaseModuleConfig)` declares which fields are sensitive (`sensitive=True`) and/or required (`mandatory=True`). `BBOTCore.no_secrets_config()` walks the config dict alongside those schemas and removes only fields explicitly marked sensitive — no fuzzy name matching:
+
+```python
+from bbot.core import CORE
+
+config = {
+    "interactsh_token": "leaky",
+    "web": {"http_cookies": {"session": "abc"}},
+    "modules": {
+        "shodan_dns": {"api_key": "sh-secret"},
+        "robots": {"include_sitemap": True},
+    },
+}
+
+print(CORE.no_secrets_config(config))
+# {'web': {}, 'modules': {'shodan_dns': {}, 'robots': {'include_sitemap': True}}}
+
+print(CORE.secrets_only_config(config))
+# {'interactsh_token': 'leaky', 'web': {'http_cookies': {'session': 'abc'}}, ...}
+```
+
+The `Preset.to_dict()` method exposes the same behavior via a `redact_secrets=True` flag:
+
+```python
+preset.to_dict(include_target=True, redact_secrets=True)
+```
+
+## Mark your own fields sensitive or mandatory
+
+When you write a module, import `Field` from `bbot.core.config.models` (not from `pydantic` directly) so the `sensitive` and `mandatory` keyword args are accepted:
+
+```python
+from bbot.core.config.models import BaseModuleConfig, Field
+
+
+class my_module(BaseModule):
+    class Config(BaseModuleConfig):
+        api_key: str = Field("", description="My API key", sensitive=True, mandatory=True)
+        verbose: bool = Field(False, description="Print extra detail")
+```
+
+- `sensitive=True` — value is redacted by `no_secrets_config()` / `Preset.to_dict(redact_secrets=True)` and lives in `~/.config/bbot/secrets.yml` rather than `bbot.yml`.
+- `mandatory=True` — module needs this option to function. Drives the **Needs API Key** column in `bbot -l` and the runtime `BaseModule.auth_required` property.
+
+A field can carry both, just one, or neither.
+
+## Dump all module metadata
+
+`MODULE_LOADER.preloaded()` returns the full preload dict for every module — descriptions, flags, watched/produced events, deps, and (since the field-metadata refactor) the per-module `options_sensitive` and `options_mandatory` field-name sets:
+
+```python
+from bbot.core.modules import MODULE_LOADER
+
+MODULE_LOADER.preload()
+shodan = MODULE_LOADER.preloaded()["shodan_dns"]
+print(shodan["options_mandatory"])  # ['api_key']
+print(shodan["options_sensitive"])  # ['api_key']
+```
+
+For pretty-printed tables, use `MODULE_LOADER.modules_table()` (module summary) or `MODULE_LOADER.modules_options_table()` (per-option name/type/description/default) — these are what `bbot -l` and `bbot --help -m <module>` render.
+
+## Filter options by `sensitive` / `mandatory`
+
+To collect dotted-path keys (e.g. `modules.shodan_dns.api_key`) for every option carrying a particular flag, you have two options depending on scope.
+
+**Per-module only** — fast, no schema walk. The flag sets are pre-extracted on each preloaded module, so this is just a dict comprehension:
+
+```python
+from bbot.core.modules import MODULE_LOADER
+
+MODULE_LOADER.preload()
+
+sensitive_paths = [
+    f"modules.{name}.{opt}"
+    for name, p in MODULE_LOADER.preloaded().items()
+    for opt in p.get("options_sensitive") or []
+]
+
+mandatory_paths = [
+    f"modules.{name}.{opt}"
+    for name, p in MODULE_LOADER.preloaded().items()
+    for opt in p.get("options_mandatory") or []
+]
+
+# Both flags at once (e.g. an api-key audit — fields a module needs *and* hides):
+both = [
+    f"modules.{name}.{opt}"
+    for name, p in MODULE_LOADER.preloaded().items()
+    for opt in set(p.get("options_sensitive") or []) & set(p.get("options_mandatory") or [])
+]
+```
+
+**Per-module *and* global** — walk `MODULE_LOADER.config_schema`, which is the composite pydantic model with global keys (e.g. `interactsh_token`, `web.http_cookies`) and every module's `Config` grafted in under `modules.<name>`:
+
+```python
+import typing
+from pydantic import BaseModel
+from bbot.core.config.models import is_sensitive, is_mandatory
+
+def schema_paths(model, *, predicate, prefix=""):
+    """Yield dotted paths for every field where `predicate(FieldInfo)` is True."""
+    for name, field in model.model_fields.items():
+        path = f"{prefix}{name}"
+        ann = field.annotation
+        # unwrap Optional[X]
+        if typing.get_origin(ann) is typing.Union:
+            ann = next((a for a in typing.get_args(ann) if a is not type(None)), ann)
+        if isinstance(ann, type) and issubclass(ann, BaseModel):
+            yield from schema_paths(ann, predicate=predicate, prefix=f"{path}.")
+        elif predicate(field):
+            yield path
+
+all_sensitive = list(schema_paths(MODULE_LOADER.config_schema, predicate=is_sensitive))
+# ['web.http_cookies', 'interactsh_token', 'modules.shodan_dns.api_key', ...]
+```
+
+The same pattern works for any field-metadata key you stash via `Field(..., json_schema_extra={...})` — swap the `predicate` for your own check.
diff --git a/docs/modules/list_of_modules.md b/docs/modules/list_of_modules.md
index a3ba377921..b772650e47 100644
--- a/docs/modules/list_of_modules.md
+++ b/docs/modules/list_of_modules.md
@@ -95,13 +95,13 @@
 | ipstack               | scan     | Yes             | Query IPStack's GeoIP API                                                                                                                             | passive, safe                                              | IP_ADDRESS                                                                                                                              | GEOLOCATION                                                                              | @tycoonslive              | 2022-11-26     |
 | jadx                  | scan     | No              | Decompile APKs and XAPKs using JADX                                                                                                                   | code-enum, passive, safe                                   | FILESYSTEM                                                                                                                              | FILESYSTEM                                                                               | @domwhewell-sage          | 2024-11-04     |
 | kreuzberg             | scan     | No              | Module to extract data from files                                                                                                                     | passive, safe                                              | FILESYSTEM                                                                                                                              | RAW_TEXT                                                                                 | @domwhewell-sage          | 2024-06-03     |
-| leakix                | scan     | No              | Query leakix.net for subdomains                                                                                                                       | passive, safe, subdomain-enum                              | DNS_NAME                                                                                                                                | DNS_NAME                                                                                 | @TheTechromancer          | 2022-07-11     |
+| leakix                | scan     | Yes             | Query leakix.net for subdomains                                                                                                                       | passive, safe, subdomain-enum                              | DNS_NAME                                                                                                                                | DNS_NAME                                                                                 | @TheTechromancer          | 2022-07-11     |
 | myssl                 | scan     | No              | Query myssl.com's API for subdomains                                                                                                                  | passive, safe, subdomain-enum                              | DNS_NAME                                                                                                                                | DNS_NAME                                                                                 | @TheTechromancer          | 2023-07-10     |
 | otx                   | scan     | Yes             | Query otx.alienvault.com for subdomains                                                                                                               | passive, safe, subdomain-enum                              | DNS_NAME                                                                                                                                | DNS_NAME                                                                                 | @TheTechromancer          | 2022-08-24     |
 | pgp                   | scan     | No              | Query common PGP servers for email addresses                                                                                                          | email-enum, passive, safe                                  | DNS_NAME                                                                                                                                | EMAIL_ADDRESS                                                                            | @TheTechromancer          | 2022-08-10     |
 | portfilter            | scan     | No              | Filter out unwanted open ports from cloud/CDN targets                                                                                                 | passive, safe                                              | OPEN_TCP_PORT, URL, URL_UNVERIFIED                                                                                                      |                                                                                          | @TheTechromancer          | 2025-01-06     |
-| postman               | scan     | No              | Query Postman's API for related workspaces, collections, requests and download them                                                                   | code-enum, passive, safe, subdomain-enum                   | ORG_STUB, SOCIAL                                                                                                                        | CODE_REPOSITORY                                                                          | @domwhewell-sage          | 2024-09-07     |
-| postman_download      | scan     | No              | Download workspaces, collections, requests from Postman                                                                                               | code-enum, download, passive, safe, subdomain-enum         | CODE_REPOSITORY                                                                                                                         | FILESYSTEM                                                                               | @domwhewell-sage          | 2024-09-07     |
+| postman               | scan     | Yes             | Query Postman's API for related workspaces, collections, requests and download them                                                                   | code-enum, passive, safe, subdomain-enum                   | ORG_STUB, SOCIAL                                                                                                                        | CODE_REPOSITORY                                                                          | @domwhewell-sage          | 2024-09-07     |
+| postman_download      | scan     | Yes             | Download workspaces, collections, requests from Postman                                                                                               | code-enum, download, passive, safe, subdomain-enum         | CODE_REPOSITORY                                                                                                                         | FILESYSTEM                                                                               | @domwhewell-sage          | 2024-09-07     |
 | rapiddns              | scan     | No              | Query rapiddns.io for subdomains                                                                                                                      | passive, safe, subdomain-enum                              | DNS_NAME                                                                                                                                | DNS_NAME                                                                                 | @TheTechromancer          | 2022-08-24     |
 | securitytrails        | scan     | Yes             | Query the SecurityTrails API for subdomains                                                                                                           | passive, safe, subdomain-enum                              | DNS_NAME                                                                                                                                | DNS_NAME                                                                                 | @TheTechromancer          | 2022-07-03     |
 | shodan_dns            | scan     | Yes             | Query Shodan for subdomains                                                                                                                           | passive, safe, subdomain-enum                              | DNS_NAME                                                                                                                                | DNS_NAME                                                                                 | @TheTechromancer          | 2022-07-03     |
diff --git a/docs/scanning/advanced.md b/docs/scanning/advanced.md
index 7c10d49b51..9b40ce81cc 100644
--- a/docs/scanning/advanced.md
+++ b/docs/scanning/advanced.md
@@ -32,22 +32,23 @@ if __name__ == "__main__":
 
 <!-- BBOT HELP OUTPUT -->
 ```text
-usage: -c [-h] [-t TARGET [TARGET ...]] [-s SEEDS [SEEDS ...]]
-          [-b BLACKLIST [BLACKLIST ...]] [--strict-scope] [-p [PRESET ...]]
-          [-c [CONFIG ...]] [-lp] [-m MODULE [MODULE ...]] [-l] [-lmo]
-          [-em MODULE [MODULE ...]] [-f FLAG [FLAG ...]] [-lf]
-          [-rf FLAG [FLAG ...]] [-ef FLAG [FLAG ...]] [-n SCAN_NAME] [-v] [-d]
-          [-S] [--force] [-y] [--fast-mode] [--dry-run] [--current-preset]
-          [--current-preset-full] [-mh MODULE] [-o DIR]
-          [-om MODULE [MODULE ...]] [-lo] [--json] [--brief]
-          [--event-types EVENT_TYPES [EVENT_TYPES ...]] [--exclude-cdn]
-          [--no-deps | --force-deps | --retry-deps | --ignore-failed-deps]
-          [--install-all-deps] [--version] [--proxy HTTP_PROXY]
-          [--no-proxy HOST [HOST ...]]
-          [-H CUSTOM_HEADERS [CUSTOM_HEADERS ...]]
-          [-C CUSTOM_COOKIES [CUSTOM_COOKIES ...]]
-          [--custom-yara-rules CUSTOM_YARA_RULES] [--user-agent USER_AGENT]
-          [--user-agent-suffix SUFFIX]
+usage: bbot [-h] [-t TARGET [TARGET ...]] [-s SEEDS [SEEDS ...]]
+               [-b BLACKLIST [BLACKLIST ...]] [--strict-scope]
+               [-p [PRESET ...]] [-c [CONFIG ...]] [-lp]
+               [-m MODULE [MODULE ...]] [-l] [-lmo] [-em MODULE [MODULE ...]]
+               [-f FLAG [FLAG ...]] [-lf] [-rf FLAG [FLAG ...]]
+               [-ef FLAG [FLAG ...]] [-n SCAN_NAME] [-v] [-d] [-S] [--force]
+               [-y] [--fast-mode] [--dry-run] [--current-preset]
+               [--current-preset-full] [-mh MODULE] [-o DIR]
+               [-om MODULE [MODULE ...]] [-lo] [--json] [--brief] [--no-color]
+               [--event-types EVENT_TYPES [EVENT_TYPES ...]] [--exclude-cdn]
+               [--no-deps | --force-deps | --retry-deps | --ignore-failed-deps]
+               [--install-all-deps] [--version] [--proxy HTTP_PROXY]
+               [--no-proxy HOST [HOST ...]]
+               [-H CUSTOM_HEADERS [CUSTOM_HEADERS ...]]
+               [-C CUSTOM_COOKIES [CUSTOM_COOKIES ...]]
+               [--custom-yara-rules CUSTOM_YARA_RULES]
+               [--user-agent USER_AGENT] [--user-agent-suffix SUFFIX]
 
 Bighuge BLS OSINT Tool
 
@@ -55,39 +56,40 @@ options:
   -h, --help            show this help message and exit
 
 Target:
-  -t, --targets TARGET [TARGET ...]
+  -t TARGET [TARGET ...], --targets TARGET [TARGET ...]
                         Target scope
-  -s, --seeds SEEDS [SEEDS ...]
+  -s SEEDS [SEEDS ...], --seeds SEEDS [SEEDS ...]
                         Define seeds to drive passive modules without being in scope (if not specified, defaults to same as targets)
-  -b, --blacklist BLACKLIST [BLACKLIST ...]
+  -b BLACKLIST [BLACKLIST ...], --blacklist BLACKLIST [BLACKLIST ...]
                         Don't touch these things
   --strict-scope        Don't consider subdomains of target to be in-scope - exact matches only
 
 Presets:
-  -p, --preset [PRESET ...]
+  -p [PRESET ...], --preset [PRESET ...]
                         Enable BBOT preset(s)
-  -c, --config [CONFIG ...]
+  -c [CONFIG ...], --config [CONFIG ...]
                         Custom config options in key=value format: e.g. 'modules.shodan.api_key=1234'
   -lp, --list-presets   List available presets.
 
 Modules:
-  -m, --modules MODULE [MODULE ...]
+  -m MODULE [MODULE ...], --modules MODULE [MODULE ...]
                         Modules to enable. Choices: affiliates,ajaxpro,anubisdb,apkpure,asn,aspnet_bin_exposure,azure_tenant,baddns,baddns_direct,baddns_zone,badsecrets,bevigil,bucket_amazon,bucket_digitalocean,bucket_file_enum,bucket_firebase,bucket_google,bucket_hetzner,bucket_microsoft,bufferoverrun,builtwith,bypass403,c99,censys_dns,censys_ip,certspotter,chaos,code_repository,credshed,crt,crt_db,dehashed,dnsbimi,dnsbrute,dnsbrute_mutations,dnscaa,dnscommonsrv,dnsdumpster,dnstlsrpt,docker_pull,dockerhub,dotnetnuke,emailformat,filedownload,fingerprintx,fullhunt,generic_ssrf,git,git_clone,gitdumper,github_codesearch,github_org,github_usersearch,github_workflows,gitlab_com,gitlab_onprem,google_playstore,gowitness,graphql_introspection,hackertarget,host_header,http,hunt,hunterio,iis_shortnames,ip2location,ipneighbor,ipstack,jadx,kreuzberg,leakix,legba,lightfuzz,medusa,myssl,newsletters,ntlm,nuclei,oauth,otx,paramminer_cookies,paramminer_getparams,paramminer_headers,pgp,portfilter,portscan,postman,postman_download,rapiddns,reflected_parameters,retirejs,robots,securitytrails,securitytxt,shodan_dns,shodan_enterprise,shodan_idb,skymem,social,sslcert,subdomaincenter,subdomainradar,telerik,trajan,trickest,trufflehog,url_manipulation,urlscan,viewdns,virustotal,wafw00f,wayback,webbrute,webbrute_shortnames,wpscan
   -l, --list-modules    List available modules.
   -lmo, --list-module-options
                         Show all module config options
-  -em, --exclude-modules MODULE [MODULE ...]
+  -em MODULE [MODULE ...], --exclude-modules MODULE [MODULE ...]
                         Exclude these modules.
-  -f, --flags FLAG [FLAG ...]
+  -f FLAG [FLAG ...], --flags FLAG [FLAG ...]
                         Enable modules by flag. Choices: active,affiliates,baddns,cloud-enum,code-enum,download,email-enum,iis-shortnames,invasive,loud,passive,portscan,safe,service-enum,slow,social-enum,subdomain-enum,subdomain-hijack,web,web-heavy,web-paramminer,web-screenshots
   -lf, --list-flags     List available flags.
-  -rf, --require-flags FLAG [FLAG ...]
+  -rf FLAG [FLAG ...], --require-flags FLAG [FLAG ...]
                         Only enable modules with these flags (e.g. -rf passive)
-  -ef, --exclude-flags FLAG [FLAG ...]
+  -ef FLAG [FLAG ...], --exclude-flags FLAG [FLAG ...]
                         Disable modules with these flags. (e.g. -ef loud)
 
 Scan:
-  -n, --name SCAN_NAME  Name of scan (default: random)
+  -n SCAN_NAME, --name SCAN_NAME
+                        Name of scan (default: random)
   -v, --verbose         Be more verbose
   -d, --debug           Enable debugging
   -S, --silent          Be quiet
@@ -98,17 +100,19 @@ Scan:
   --current-preset      Show the current preset in YAML format
   --current-preset-full
                         Show the current preset in its full form, including defaults
-  -mh, --module-help MODULE
+  -mh MODULE, --module-help MODULE
                         Show help for a specific module
 
 Output:
-  -o, --output-dir DIR  Directory to output scan results
-  -om, --output-modules MODULE [MODULE ...]
+  -o DIR, --output-dir DIR
+                        Directory to output scan results
+  -om MODULE [MODULE ...], --output-modules MODULE [MODULE ...]
                         Output module(s). Choices: asset_inventory,csv,discord,elastic,emails,json,kafka,mongo,mysql,nats,neo4j,nmap_xml,postgres,python,rabbitmq,slack,splunk,sqlite,stdout,subdomains,teams,txt,web_parameters,web_report,webhook,websocket,zeromq
   -lo, --list-output-modules
                         List available output modules
   --json, -j            Output scan data in JSON format
   --brief, -br          Output only the data itself
+  --no-color            Disable colored terminal output
   --event-types EVENT_TYPES [EVENT_TYPES ...]
                         Choose which event types to display
   --exclude-cdn, -ec    Filter out unwanted open ports on CDNs/WAFs (80,443 only)
@@ -127,15 +131,15 @@ Misc:
   --proxy HTTP_PROXY    Use this proxy for all HTTP requests
   --no-proxy HOST [HOST ...]
                         Exclude these hosts from proxy (e.g. localhost *.internal.corp 10.0.0.0/8)
-  -H, --custom-headers CUSTOM_HEADERS [CUSTOM_HEADERS ...]
+  -H CUSTOM_HEADERS [CUSTOM_HEADERS ...], --custom-headers CUSTOM_HEADERS [CUSTOM_HEADERS ...]
                         List of custom headers as key value pairs (header=value).
-  -C, --custom-cookies CUSTOM_COOKIES [CUSTOM_COOKIES ...]
+  -C CUSTOM_COOKIES [CUSTOM_COOKIES ...], --custom-cookies CUSTOM_COOKIES [CUSTOM_COOKIES ...]
                         List of custom cookies as key value pairs (cookie=value).
-  --custom-yara-rules, -cy CUSTOM_YARA_RULES
+  --custom-yara-rules CUSTOM_YARA_RULES, -cy CUSTOM_YARA_RULES
                         Add custom yara rules to excavate
-  --user-agent, -ua USER_AGENT
+  --user-agent USER_AGENT, -ua USER_AGENT
                         Set the user-agent for all HTTP requests
-  --user-agent-suffix, -uas SUFFIX
+  --user-agent-suffix SUFFIX, -uas SUFFIX
                         Suffix to append to the user-agent
 
 EXAMPLES
diff --git a/docs/scanning/configuration.md b/docs/scanning/configuration.md
index a83a652bdc..6a210450e5 100644
--- a/docs/scanning/configuration.md
+++ b/docs/scanning/configuration.md
@@ -420,8 +420,8 @@ In addition to the stated options for each module, the following universal optio
 |-----------------------------------------------------|----------|--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
 | modules.baddns.custom_nameservers                   | list     | Force BadDNS to use a list of custom nameservers                                                                                                                                                                                                                                                                               | []                                                                                                                                                                                                                                                                                                                                                                                                                                                      |
 | modules.baddns.enabled_submodules                   | list     | A list of submodules to enable. Empty list (default) enables CNAME, TXT and MX Only                                                                                                                                                                                                                                            | []                                                                                                                                                                                                                                                                                                                                                                                                                                                      |
-| modules.baddns.min_confidence                       | str      | Minimum confidence to emit (UNKNOWN, LOW, MEDIUM, HIGH, CONFIRMED)                                                                                                                                                                                                                                                             | MEDIUM                                                                                                                                                                                                                                                                                                                                                                                                                                                  |
-| modules.baddns.min_severity                         | str      | Minimum severity to emit (INFO, LOW, MEDIUM, HIGH, CRITICAL)                                                                                                                                                                                                                                                                   | LOW                                                                                                                                                                                                                                                                                                                                                                                                                                                     |
+| modules.baddns.min_confidence                       | str      | Minimum confidence to emit                                                                                                                                                                                                                                                                                                     | MEDIUM                                                                                                                                                                                                                                                                                                                                                                                                                                                  |
+| modules.baddns.min_severity                         | str      | Minimum severity to emit                                                                                                                                                                                                                                                                                                       | LOW                                                                                                                                                                                                                                                                                                                                                                                                                                                     |
 | modules.baddns_direct.custom_nameservers            | list     | Force BadDNS to use a list of custom nameservers                                                                                                                                                                                                                                                                               | []                                                                                                                                                                                                                                                                                                                                                                                                                                                      |
 | modules.baddns_direct.min_confidence                | str      | Minimum confidence to emit (UNKNOWN, LOW, MEDIUM, HIGH, CONFIRMED)                                                                                                                                                                                                                                                             | MEDIUM                                                                                                                                                                                                                                                                                                                                                                                                                                                  |
 | modules.baddns_direct.min_severity                  | str      | Minimum severity to emit (INFO, LOW, MEDIUM, HIGH, CRITICAL)                                                                                                                                                                                                                                                                   | LOW                                                                                                                                                                                                                                                                                                                                                                                                                                                     |
@@ -436,9 +436,11 @@ In addition to the stated options for each module, the following universal optio
 | modules.bucket_hetzner.permutations                 | bool     | Whether to try permutations                                                                                                                                                                                                                                                                                                    | False                                                                                                                                                                                                                                                                                                                                                                                                                                                   |
 | modules.bucket_microsoft.permutations               | bool     | Whether to try permutations                                                                                                                                                                                                                                                                                                    | False                                                                                                                                                                                                                                                                                                                                                                                                                                                   |
 | modules.dnsbrute.max_depth                          | int      | How many subdomains deep to brute force, i.e. 5.4.3.2.1.evilcorp.com                                                                                                                                                                                                                                                           | 5                                                                                                                                                                                                                                                                                                                                                                                                                                                       |
+| modules.dnsbrute.recursive_mutations                | bool     | If True, brute-force hosts discovered by dnsbrute_mutations. The default (False) skips them because the static wordlist heavily overlaps with the mutation algorithm's own output.                                                                                                                                             | False                                                                                                                                                                                                                                                                                                                                                                                                                                                   |
 | modules.dnsbrute.wordlist                           | str      | Subdomain wordlist URL or file path. Accepts a list of URLs/paths to merge multiple wordlists (duplicates are removed).                                                                                                                                                                                                        | https://raw.githubusercontent.com/danielmiessler/SecLists/master/Discovery/DNS/subdomains-top1million-5000.txt                                                                                                                                                                                                                                                                                                                                          |
 | modules.dnsbrute_mutations.max_mutations            | int      | Maximum number of target-specific mutations to try per subdomain                                                                                                                                                                                                                                                               | 100                                                                                                                                                                                                                                                                                                                                                                                                                                                     |
 | modules.dnscommonsrv.max_depth                      | int      | The maximum subdomain depth to brute-force SRV records                                                                                                                                                                                                                                                                         | 2                                                                                                                                                                                                                                                                                                                                                                                                                                                       |
+| modules.dnscommonsrv.recursive_mutations            | bool     | If True, brute-force SRV records on hosts discovered by dnsbrute_mutations. Default False skips them.                                                                                                                                                                                                                          | False                                                                                                                                                                                                                                                                                                                                                                                                                                                   |
 | modules.filedownload.extensions                     | list     | File extensions to download                                                                                                                                                                                                                                                                                                    | ['bak', 'bash', 'bashrc', 'cfg', 'conf', 'crt', 'csv', 'db', 'dll', 'doc', 'docx', 'exe', 'ica', 'indd', 'ini', 'jar', 'json', 'key', 'log', 'markdown', 'md', 'msi', 'odg', 'odp', 'ods', 'odt', 'pdf', 'pem', 'pps', 'ppsx', 'ppt', 'pptx', 'ps1', 'pub', 'raw', 'rdp', 'rsa', 'sh', 'sql', 'sqlite', 'swp', 'sxw', 'tar.gz', 'tgz', 'tar', 'txt', 'vbs', 'war', 'wpd', 'xls', 'xlsx', 'xml', 'yaml', 'yml', 'zip', 'lzma', 'rar', '7z', 'xz', 'bz2'] |
 | modules.filedownload.max_filesize                   | str      | Cancel download if filesize is greater than this size                                                                                                                                                                                                                                                                          | 10MB                                                                                                                                                                                                                                                                                                                                                                                                                                                    |
 | modules.filedownload.output_folder                  | str      | Folder to download files to. If not specified, downloaded files will be deleted when the scan completes, to minimize disk usage.                                                                                                                                                                                               |                                                                                                                                                                                                                                                                                                                                                                                                                                                         |
@@ -505,7 +507,7 @@ In addition to the stated options for each module, the following universal optio
 | modules.paramminer_cookies.recycle_words            | bool     | Attempt to use words found during the scan on all other endpoints                                                                                                                                                                                                                                                              | False                                                                                                                                                                                                                                                                                                                                                                                                                                                   |
 | modules.paramminer_cookies.skip_boring_words        | bool     | Remove commonly uninteresting words from the wordlist                                                                                                                                                                                                                                                                          | True                                                                                                                                                                                                                                                                                                                                                                                                                                                    |
 | modules.paramminer_cookies.wordlist                 | str      | Define the wordlist to be used to derive cookies. Accepts a list of URLs/paths to merge multiple wordlists (duplicates are removed).                                                                                                                                                                                           |                                                                                                                                                                                                                                                                                                                                                                                                                                                         |
-| modules.paramminer_getparams.brute_short            | bool     | Generate every 1-, 2-, and 3-letter [a-z] combination and add to the wordlist. Costs ~18,278 extra requests per host — opt-in for thorough scans.                                                                                                                                                                              | False                                                                                                                                                                                                                                                                                                                                                                                                                                                   |
+| modules.paramminer_getparams.brute_short            | bool     | Generate every 1-, 2-, and 3-letter [a-z] combination and add to the wordlist. Costs ~18,278 extra requests per host; opt-in for thorough scans.                                                                                                                                                                               | False                                                                                                                                                                                                                                                                                                                                                                                                                                                   |
 | modules.paramminer_getparams.mutate_case            | bool     | Also test case-mutated variants of each entry (camelCase for snake_case/kebab-case, Title case for single words). Skipped on URLs with case-insensitive backend extensions like .aspx/.cfm.                                                                                                                                    | False                                                                                                                                                                                                                                                                                                                                                                                                                                                   |
 | modules.paramminer_getparams.recycle_words          | bool     | Attempt to use words found during the scan on all other endpoints                                                                                                                                                                                                                                                              | False                                                                                                                                                                                                                                                                                                                                                                                                                                                   |
 | modules.paramminer_getparams.skip_boring_words      | bool     | Remove commonly uninteresting words from the wordlist                                                                                                                                                                                                                                                                          | True                                                                                                                                                                                                                                                                                                                                                                                                                                                    |
@@ -537,7 +539,7 @@ In addition to the stated options for each module, the following universal optio
 | modules.url_manipulation.allow_redirects            | bool     | Allowing redirects will sometimes create false positives. Disallowing will sometimes create false negatives. Allowed by default.                                                                                                                                                                                               | True                                                                                                                                                                                                                                                                                                                                                                                                                                                    |
 | modules.wafw00f.generic_detect                      | bool     | When no specific WAF detections are made, try to perform a generic detect                                                                                                                                                                                                                                                      | True                                                                                                                                                                                                                                                                                                                                                                                                                                                    |
 | modules.webbrute.concurrency                        | int      | Number of concurrent requests per URL being fuzzed                                                                                                                                                                                                                                                                             | 50                                                                                                                                                                                                                                                                                                                                                                                                                                                      |
-| modules.webbrute.extensions                         | str      | Optionally include a list of extensions to extend the keyword with (comma separated)                                                                                                                                                                                                                                           |                                                                                                                                                                                                                                                                                                                                                                                                                                                         |
+| modules.webbrute.extensions                         | str      | Optionally include a list of extensions to extend the keyword with (comma separated or YAML list)                                                                                                                                                                                                                              |                                                                                                                                                                                                                                                                                                                                                                                                                                                         |
 | modules.webbrute.ignore_case                        | bool     | Only put lowercase words into the wordlist                                                                                                                                                                                                                                                                                     | False                                                                                                                                                                                                                                                                                                                                                                                                                                                   |
 | modules.webbrute.lines                              | int      | take only the first N lines from the wordlist when finding directories                                                                                                                                                                                                                                                         | 5000                                                                                                                                                                                                                                                                                                                                                                                                                                                    |
 | modules.webbrute.max_depth                          | int      | the maximum directory depth to attempt to solve                                                                                                                                                                                                                                                                                | 0                                                                                                                                                                                                                                                                                                                                                                                                                                                       |
@@ -672,6 +674,7 @@ In addition to the stated options for each module, the following universal optio
 | modules.mysql.host                                  | str      | The server running MySQL                                                                                                                                                                                                                                                                                                       | localhost                                                                                                                                                                                                                                                                                                                                                                                                                                               |
 | modules.mysql.password                              | str      | The password to connect to MySQL                                                                                                                                                                                                                                                                                               | bbotislife                                                                                                                                                                                                                                                                                                                                                                                                                                              |
 | modules.mysql.port                                  | int      | The port to connect to MySQL                                                                                                                                                                                                                                                                                                   | 3306                                                                                                                                                                                                                                                                                                                                                                                                                                                    |
+| modules.mysql.retries                               | int      | Number of times to retry connecting to the database (1 second between retries)                                                                                                                                                                                                                                                 | 10                                                                                                                                                                                                                                                                                                                                                                                                                                                      |
 | modules.mysql.username                              | str      | The username to connect to MySQL                                                                                                                                                                                                                                                                                               | root                                                                                                                                                                                                                                                                                                                                                                                                                                                    |
 | modules.nats.servers                                | list     | A list of NATS server addresses                                                                                                                                                                                                                                                                                                | []                                                                                                                                                                                                                                                                                                                                                                                                                                                      |
 | modules.nats.subject                                | str      | The NATS subject to publish events to                                                                                                                                                                                                                                                                                          | bbot_events                                                                                                                                                                                                                                                                                                                                                                                                                                             |
@@ -682,19 +685,21 @@ In addition to the stated options for each module, the following universal optio
 | modules.postgres.host                               | str      | The server running Postgres                                                                                                                                                                                                                                                                                                    | localhost                                                                                                                                                                                                                                                                                                                                                                                                                                               |
 | modules.postgres.password                           | str      | The password to connect to Postgres                                                                                                                                                                                                                                                                                            | bbotislife                                                                                                                                                                                                                                                                                                                                                                                                                                              |
 | modules.postgres.port                               | int      | The port to connect to Postgres                                                                                                                                                                                                                                                                                                | 5432                                                                                                                                                                                                                                                                                                                                                                                                                                                    |
+| modules.postgres.retries                            | int      | Number of times to retry connecting to the database (1 second between retries)                                                                                                                                                                                                                                                 | 10                                                                                                                                                                                                                                                                                                                                                                                                                                                      |
 | modules.postgres.username                           | str      | The username to connect to Postgres                                                                                                                                                                                                                                                                                            | postgres                                                                                                                                                                                                                                                                                                                                                                                                                                                |
 | modules.rabbitmq.queue                              | str      | The RabbitMQ queue to publish events to                                                                                                                                                                                                                                                                                        | bbot_events                                                                                                                                                                                                                                                                                                                                                                                                                                             |
 | modules.rabbitmq.url                                | str      | The RabbitMQ connection URL                                                                                                                                                                                                                                                                                                    | amqp://guest:guest@localhost/                                                                                                                                                                                                                                                                                                                                                                                                                           |
 | modules.slack.event_types                           | list     | Types of events to send                                                                                                                                                                                                                                                                                                        | ['FINDING']                                                                                                                                                                                                                                                                                                                                                                                                                                             |
 | modules.slack.min_severity                          | str      | Only allow FINDING events of this severity or higher                                                                                                                                                                                                                                                                           | LOW                                                                                                                                                                                                                                                                                                                                                                                                                                                     |
 | modules.slack.retries                               | int      | Number of times to retry sending the message before skipping the event                                                                                                                                                                                                                                                         | 10                                                                                                                                                                                                                                                                                                                                                                                                                                                      |
-| modules.slack.webhook_url                           | str      | Discord webhook URL                                                                                                                                                                                                                                                                                                            |                                                                                                                                                                                                                                                                                                                                                                                                                                                         |
+| modules.slack.webhook_url                           | str      | Slack webhook URL                                                                                                                                                                                                                                                                                                              |                                                                                                                                                                                                                                                                                                                                                                                                                                                         |
 | modules.splunk.hectoken                             | str      | HEC Token                                                                                                                                                                                                                                                                                                                      |                                                                                                                                                                                                                                                                                                                                                                                                                                                         |
 | modules.splunk.index                                | str      | Index to send data to                                                                                                                                                                                                                                                                                                          |                                                                                                                                                                                                                                                                                                                                                                                                                                                         |
 | modules.splunk.source                               | str      | Source path to be added to the metadata                                                                                                                                                                                                                                                                                        |                                                                                                                                                                                                                                                                                                                                                                                                                                                         |
 | modules.splunk.timeout                              | int      | HTTP timeout                                                                                                                                                                                                                                                                                                                   | 10                                                                                                                                                                                                                                                                                                                                                                                                                                                      |
 | modules.splunk.url                                  | str      | Web URL                                                                                                                                                                                                                                                                                                                        |                                                                                                                                                                                                                                                                                                                                                                                                                                                         |
 | modules.sqlite.database                             | str      | The path to the sqlite database file                                                                                                                                                                                                                                                                                           |                                                                                                                                                                                                                                                                                                                                                                                                                                                         |
+| modules.sqlite.retries                              | int      | Number of times to retry connecting to the database (1 second between retries)                                                                                                                                                                                                                                                 | 10                                                                                                                                                                                                                                                                                                                                                                                                                                                      |
 | modules.stdout.accept_dupes                         | bool     | Whether to show duplicate events, default True                                                                                                                                                                                                                                                                                 | True                                                                                                                                                                                                                                                                                                                                                                                                                                                    |
 | modules.stdout.event_fields                         | list     | Which event fields to display                                                                                                                                                                                                                                                                                                  | []                                                                                                                                                                                                                                                                                                                                                                                                                                                      |
 | modules.stdout.event_types                          | list     | Which events to display, default all event types                                                                                                                                                                                                                                                                               | []                                                                                                                                                                                                                                                                                                                                                                                                                                                      |
diff --git a/docs/scanning/index.md b/docs/scanning/index.md
index 1c6e286210..df69dcef90 100644
--- a/docs/scanning/index.md
+++ b/docs/scanning/index.md
@@ -54,8 +54,8 @@ To see a full list of modules and their descriptions, use `bbot -l` or see [List
 Modules are the part of BBOT that does the work -- port scanning, subdomain brute-forcing, API querying, etc. Modules consume [Events](events.md) (`IP_ADDRESS`, `DNS_NAME`, etc.) from each other, process the data in a useful way, then emit the results as new events. You can enable individual modules with `-m`.
 
 ```bash
-# Enable modules: portscan, sslcert, and httpx
-bbot -t www.evilcorp.com -m portscan sslcert httpx
+# Enable modules: portscan, sslcert, and http
+bbot -t www.evilcorp.com -m portscan sslcert http
 ```
 
 ### Types of Modules
@@ -63,7 +63,7 @@ bbot -t www.evilcorp.com -m portscan sslcert httpx
 Modules fall into three categories:
 
 - **Scan Modules**:
-    - These make up the majority of modules. Examples are `portscan`, `sslcert`, `httpx`, etc. Enable with `-m`.
+    - These make up the majority of modules. Examples are `portscan`, `sslcert`, `http`, etc. Enable with `-m`.
 - **Output Modules**:
     - These output scan data to different formats/destinations. `human`, `json`, and `csv` are enabled by default. Enable others with `-om`. (See: [Output](output.md))
 - **Internal Modules**:
@@ -232,7 +232,7 @@ Similar to targets, blacklists can be specified in your preset. The `spider` pre
 description: Recursive web spider
 
 modules:
-  - httpx
+  - http
 
 blacklist:
   # Prevent spider from invalidating sessions by logging out
diff --git a/docs/scanning/presets.md b/docs/scanning/presets.md
index fc5e9426f8..76e0514d68 100644
--- a/docs/scanning/presets.md
+++ b/docs/scanning/presets.md
@@ -122,7 +122,7 @@ bbot -p ./mypreset.yml --current-preset
 
 ## Advanced Usage
 
-BBOT Presets support advanced features like file-based targets, environment variable substitution, and custom conditions.
+BBOT Presets support advanced features like file-based targets, custom modules, and custom conditions.
 
 ### Files as Targets
 
@@ -154,30 +154,6 @@ module_dirs:
   - /home/user/custom_modules
 ```
 
-### Environment Variables
-
-You can insert environment variables into your preset like this: `${env:<variable>}`:
-
-```yaml title="my_nuclei.yml"
-description: Do a nuclei scan
-
-target:
-  - evilcorp.com
-
-modules:
-  - nuclei
-
-config:
-  modules:
-    nuclei:
-      # allow the nuclei templates to be specified at runtime via an environment variable
-      tags: ${env:NUCLEI_TAGS}
-```
-
-```bash
-NUCLEI_TAGS=apache,nginx bbot -p ./my_nuclei.yml
-```
-
 ### Conditions
 
 Sometimes, you might need to add custom logic to a preset. BBOT supports this via `conditions`. The `conditions` attribute allows you to specify a list of custom conditions that will be evaluated before the scan starts. This is useful for performing last-minute sanity checks, or changing the behavior of the scan based on custom criteria.
@@ -196,16 +172,16 @@ conditions:
 ```
 
 ```yaml title="my_preset.yml"
-description: Enable ffuf but only when the web spider isn't also enabled
+description: Enable webbrute but only when the web spider isn't also enabled
 
 modules:
-  - ffuf
+  - webbrute
 
 conditions:
   - |
     {% if config.web.spider_distance > 0 and config.web.spider_depth > 0 %}
-      {{ warn("Disabling ffuf because the web spider is enabled") }}
-      {{ preset.exclude_module("ffuf") }}
+      {{ warn("Disabling webbrute because the web spider is enabled") }}
+      {{ preset.exclude_module("webbrute") }}
     {% endif %}
 ```
 
diff --git a/docs/scanning/presets_list.md b/docs/scanning/presets_list.md
index d599e75a81..6ad19096f9 100644
--- a/docs/scanning/presets_list.md
+++ b/docs/scanning/presets_list.md
@@ -772,6 +772,31 @@ Detect technologies via Nuclei, and FingerprintX
 
 
 
+Modules: [0]("")
+
+## **test**
+
+Detect technologies via Nuclei, and FingerprintX
+
+??? note "`test.yml`"
+    ```yaml title="~/.bbot/presets/test.yml"
+    description: Detect technologies via Nuclei, and FingerprintX
+    
+    modules:
+      - nuclei
+      - fingerprintx
+    
+    target:
+      - tesasdft.txt
+    
+    config:
+      modules:
+        nuclei:
+          tags: tech
+    ```
+
+
+
 Modules: [0]("")
 
 ## **web**
@@ -873,6 +898,7 @@ Here is a the same data, but in a table:
 | spider-heavy      |            | Recursive web spider with more aggressive settings                                                                                                                                                                                                                                                                                                                                                                                                                                                      | 1           | http                                                                                               |
 | subdomain-enum    |            | Enumerate subdomains via APIs, brute-force                                                                                                                                                                                                                                                                                                                                                                                                                                                              | 0           |                                                                                                    |
 | tech-detect       |            | Detect technologies via Nuclei, and FingerprintX                                                                                                                                                                                                                                                                                                                                                                                                                                                        | 2           | fingerprintx, nuclei                                                                               |
+| test              |            | Detect technologies via Nuclei, and FingerprintX                                                                                                                                                                                                                                                                                                                                                                                                                                                        | 2           | fingerprintx, nuclei                                                                               |
 | web               |            | Quick web scan                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          | 0           |                                                                                                    |
 | web-heavy         |            | Aggressive web scan                                                                                                                                                                                                                                                                                                                                                                                                                                                                                     | 0           |                                                                                                    |
 | web-screenshots   |            | Take screenshots of webpages                                                                                                                                                                                                                                                                                                                                                                                                                                                                            | 0           |                                                                                                    |
diff --git a/mkdocs.yml b/mkdocs.yml
index 498b0b4a6d..0e9eb0d057 100644
--- a/mkdocs.yml
+++ b/mkdocs.yml
@@ -43,6 +43,7 @@ nav:
   - Setting Up a Dev Environment: dev/dev_environment.md
   - BBOT Internal Architecture: dev/architecture.md
   - How to Write a BBOT Module: dev/module_howto.md
+  - Validating & Inspecting Presets: dev/preset_validation.md
   - Unit Tests: dev/tests.md
   - Discord Bot Example: dev/discord_bot.md
   - Code Reference:
diff --git a/pyproject.toml b/pyproject.toml
index b80662563e..901a17b272 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -16,7 +16,6 @@ classifiers = [
 ]
 dependencies = [
     "pip",
-    "omegaconf>=2.3.0,<3",
     "psutil>=5.9.4,<8.0.0",
     "wordninja>=2.0.0,<3",
     "ansible-runner>=2.3.2,<3",
@@ -42,6 +41,7 @@ dependencies = [
     "pyzmq>=26.0.3,<28.0.0",
     "puremagic>=1.28,<2",
     "pydantic>=2.12.2,<3",
+    "pyyaml>=6.0.0,<7",
     "radixtarget>=4.0.1,<5",
     "asndb>=1.0.4",
     "orjson>=3.10.12,<4",
diff --git a/uv.lock b/uv.lock
index 1168389833..8cd80b1ec3 100644
--- a/uv.lock
+++ b/uv.lock
@@ -97,12 +97,6 @@ wheels = [
     { url = "https://files.pythonhosted.org/packages/a9/da/19512e72e9cf2b8e7e6345264baa6c7ac1bb0ab128eb19c73a58407c4566/ansible_runner-2.4.2-py3-none-any.whl", hash = "sha256:0bde6cb39224770ff49ccdc6027288f6a98f4ed2ea0c64688b31217033221893", size = 79758, upload-time = "2025-10-14T19:10:48.994Z" },
 ]
 
-[[package]]
-name = "antlr4-python3-runtime"
-version = "4.9.3"
-source = { registry = "https://pypi.org/simple" }
-sdist = { url = "https://files.pythonhosted.org/packages/3e/38/7859ff46355f76f8d19459005ca000b6e7012f2f1ca597746cbcd1fbfe5e/antlr4-python3-runtime-4.9.3.tar.gz", hash = "sha256:f224469b4168294902bb1efa80a8bf7855f24c99aef99cbefc1bcd3cce77881b", size = 117034, upload-time = "2021-11-06T17:52:23.524Z" }
-
 [[package]]
 name = "anyio"
 version = "4.12.1"
@@ -205,7 +199,6 @@ dependencies = [
     { name = "jinja2" },
     { name = "lxml" },
     { name = "mmh3" },
-    { name = "omegaconf" },
     { name = "orjson" },
     { name = "pip" },
     { name = "psutil" },
@@ -213,6 +206,7 @@ dependencies = [
     { name = "pycryptodome" },
     { name = "pydantic" },
     { name = "pyjwt" },
+    { name = "pyyaml" },
     { name = "pyzmq" },
     { name = "radixtarget" },
     { name = "regex" },
@@ -278,7 +272,6 @@ requires-dist = [
     { name = "jinja2", specifier = ">=3.1.3,<4" },
     { name = "lxml", specifier = ">=4.9.2,<7.0.0" },
     { name = "mmh3", specifier = ">=4.1,<6.0" },
-    { name = "omegaconf", specifier = ">=2.3.0,<3" },
     { name = "orjson", specifier = ">=3.10.12,<4" },
     { name = "pip" },
     { name = "psutil", specifier = ">=5.9.4,<8.0.0" },
@@ -286,6 +279,7 @@ requires-dist = [
     { name = "pycryptodome", specifier = ">=3.17,<4" },
     { name = "pydantic", specifier = ">=2.12.2,<3" },
     { name = "pyjwt", specifier = ">=2.7.0,<3" },
+    { name = "pyyaml", specifier = ">=6.0.0,<7" },
     { name = "pyzmq", specifier = ">=26.0.3,<28.0.0" },
     { name = "radixtarget", specifier = ">=4.0.1,<5" },
     { name = "regex", specifier = ">=2024.4.16,<2027.0.0" },
@@ -309,7 +303,7 @@ dev = [
     { name = "maturin", specifier = ">=1.4,<2" },
     { name = "pre-commit", specifier = ">=3.4,<5.0" },
     { name = "pytest", specifier = ">=8.3.1,<10" },
-    { name = "pytest-asyncio", specifier = "==1.3.0" },
+    { name = "pytest-asyncio", specifier = "==1.4.0" },
     { name = "pytest-benchmark", specifier = ">=4,<6" },
     { name = "pytest-cov", specifier = ">=5,<8" },
     { name = "pytest-env", specifier = ">=0.8.2,<1.7.0" },
@@ -317,9 +311,9 @@ dev = [
     { name = "pytest-httpx", specifier = ">=0.35" },
     { name = "pytest-rerunfailures", specifier = ">=14,<17" },
     { name = "pytest-timeout", specifier = ">=2.3.1,<3" },
-    { name = "ruff", specifier = "==0.15.13" },
+    { name = "ruff", specifier = "==0.15.15" },
     { name = "urllib3", specifier = ">=2.0.2,<3" },
-    { name = "uvicorn", specifier = ">=0.32,<0.48" },
+    { name = "uvicorn", specifier = ">=0.32,<0.49" },
     { name = "werkzeug", specifier = ">=2.3.4,<4.0.0" },
 ]
 docs = [
@@ -1759,19 +1753,6 @@ wheels = [
     { url = "https://files.pythonhosted.org/packages/88/b2/d0896bdcdc8d28a7fc5717c305f1a861c26e18c05047949fb371034d98bd/nodeenv-1.10.0-py2.py3-none-any.whl", hash = "sha256:5bb13e3eed2923615535339b3c620e76779af4cb4c6a90deccc9e36b274d3827", size = 23438, upload-time = "2025-12-20T14:08:52.782Z" },
 ]
 
-[[package]]
-name = "omegaconf"
-version = "2.3.0"
-source = { registry = "https://pypi.org/simple" }
-dependencies = [
-    { name = "antlr4-python3-runtime" },
-    { name = "pyyaml" },
-]
-sdist = { url = "https://files.pythonhosted.org/packages/09/48/6388f1bb9da707110532cb70ec4d2822858ddfb44f1cdf1233c20a80ea4b/omegaconf-2.3.0.tar.gz", hash = "sha256:d5d4b6d29955cc50ad50c46dc269bcd92c6e00f5f90d23ab5fee7bfca4ba4cc7", size = 3298120, upload-time = "2022-12-08T20:59:22.753Z" }
-wheels = [
-    { url = "https://files.pythonhosted.org/packages/e3/94/1843518e420fa3ed6919835845df698c7e27e183cb997394e4a670973a65/omegaconf-2.3.0-py3-none-any.whl", hash = "sha256:7b4df175cdb08ba400f45cae3bdcae7ba8365db4d165fc65fd04b050ab63b46b", size = 79500, upload-time = "2022-12-08T20:59:19.686Z" },
-]
-
 [[package]]
 name = "orderly-set"
 version = "5.5.0"
@@ -2236,16 +2217,16 @@ wheels = [
 
 [[package]]
 name = "pytest-asyncio"
-version = "1.3.0"
+version = "1.4.0"
 source = { registry = "https://pypi.org/simple" }
 dependencies = [
     { name = "backports-asyncio-runner", marker = "python_full_version < '3.11'" },
     { name = "pytest" },
     { name = "typing-extensions", marker = "python_full_version < '3.13'" },
 ]
-sdist = { url = "https://files.pythonhosted.org/packages/90/2c/8af215c0f776415f3590cac4f9086ccefd6fd463befeae41cd4d3f193e5a/pytest_asyncio-1.3.0.tar.gz", hash = "sha256:d7f52f36d231b80ee124cd216ffb19369aa168fc10095013c6b014a34d3ee9e5", size = 50087, upload-time = "2025-11-10T16:07:47.256Z" }
+sdist = { url = "https://files.pythonhosted.org/packages/43/7c/d36d04db312ecf4298932ef77e6e4a9e8ad017906e24e34f0b0c361a2473/pytest_asyncio-1.4.0.tar.gz", hash = "sha256:c6c0d2259945122819f171a32ecea2c349ead889ee28176caaf492143424be42", size = 58514, upload-time = "2026-05-26T09:56:04.083Z" }
 wheels = [
-    { url = "https://files.pythonhosted.org/packages/e5/35/f8b19922b6a25bc0880171a2f1a003eaeb93657475193ab516fd87cac9da/pytest_asyncio-1.3.0-py3-none-any.whl", hash = "sha256:611e26147c7f77640e6d0a92a38ed17c3e9848063698d5c93d5aa7aa11cebff5", size = 15075, upload-time = "2025-11-10T16:07:45.537Z" },
+    { url = "https://files.pythonhosted.org/packages/03/e2/08a497ef684b88559c9cc5f4ad53a37e7b99e727094a86d6ea32536d5d3c/pytest_asyncio-1.4.0-py3-none-any.whl", hash = "sha256:933ca923a23075a87fb7070c0ec272a6848489824d887c85c812670932835aa1", size = 16930, upload-time = "2026-05-26T09:56:02.576Z" },
 ]
 
 [[package]]
@@ -2810,27 +2791,27 @@ wheels = [
 
 [[package]]
 name = "ruff"
-version = "0.15.13"
-source = { registry = "https://pypi.org/simple" }
-sdist = { url = "https://files.pythonhosted.org/packages/24/21/a7d5c126d5b557715ef81098f3db2fe20f622a039ff2e626af28d674ab80/ruff-0.15.13.tar.gz", hash = "sha256:f9d89f17f7ba7fb2ed42921f0df75da797a9a5d71bc39049e2c687cf2baf44b7", size = 4678180, upload-time = "2026-05-14T13:44:37.869Z" }
-wheels = [
-    { url = "https://files.pythonhosted.org/packages/c6/61/11d458dc6ac22504fd8e237b29dfd40504c7fbbcc8930402cfe51a8e63ed/ruff-0.15.13-py3-none-linux_armv6l.whl", hash = "sha256:444b580fc72fd6887e650acd3e575e18cdc79dbcf42fb4030b491057921f61f8", size = 10738279, upload-time = "2026-05-14T13:44:18.7Z" },
-    { url = "https://files.pythonhosted.org/packages/86/ca/caa871ee7be718c45256fada4e16a218ee3e33f0c4a46b729a60a24912e6/ruff-0.15.13-py3-none-macosx_10_12_x86_64.whl", hash = "sha256:6590d009e7cb7ebf36f83dbdd44a3fa48a0994ff6f1cdc1b08006abe58f98dc7", size = 11124798, upload-time = "2026-05-14T13:44:06.427Z" },
-    { url = "https://files.pythonhosted.org/packages/d3/19/43f5f2e568dddde567fc41f8471f9432c09563e19d3e617a48cfa52f8f0a/ruff-0.15.13-py3-none-macosx_11_0_arm64.whl", hash = "sha256:1c26d2f66163deeb6e08d8b39fbbe983ce3c71cea06a6d7591cfd1421793c629", size = 10460761, upload-time = "2026-05-14T13:44:04.375Z" },
-    { url = "https://files.pythonhosted.org/packages/99/df/cf938cd6de3003178f03ad7c1ea2a6c099468c03a35037985070b37e76be/ruff-0.15.13-py3-none-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:9dbd6f94b434f896308e4d57fb7bfde0d02b99f7a64b3bdab0fdfa6a864203a5", size = 10804451, upload-time = "2026-05-14T13:44:25.221Z" },
-    { url = "https://files.pythonhosted.org/packages/c7/7d/5d0973129b154ded2225729169d7068f26b467760b146493fde138415f23/ruff-0.15.13-py3-none-manylinux_2_17_armv7l.manylinux2014_armv7l.whl", hash = "sha256:bf3259f3be4d181bda591da5db2571aed6853c6a048157756448020bc6c5cd22", size = 10534285, upload-time = "2026-05-14T13:44:08.888Z" },
-    { url = "https://files.pythonhosted.org/packages/1f/e3/6b999bbc66cd51e5f073842bc2a3995e99c5e0e72e16b15e7261f7abf57a/ruff-0.15.13-py3-none-manylinux_2_17_i686.manylinux2014_i686.whl", hash = "sha256:ae9c17e5eb4430c154e76abc25d79a318190f5a997f38fb6b114416c5319ffc9", size = 11312063, upload-time = "2026-05-14T13:44:11.274Z" },
-    { url = "https://files.pythonhosted.org/packages/af/5a/642639e9f5db04f1e97fbd6e091c6fd20725bdf072fb114d00eefb9e6eb8/ruff-0.15.13-py3-none-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl", hash = "sha256:2e2e39bff6c341f4b577a21b801326fab0b11847f48fcaa83f00a113c9b3cb55", size = 12183079, upload-time = "2026-05-14T13:44:01.634Z" },
-    { url = "https://files.pythonhosted.org/packages/19/4c/7585735f6b53b0f12de13618b2f7d250a844f018822efc899df2e7b8295f/ruff-0.15.13-py3-none-manylinux_2_17_s390x.manylinux2014_s390x.whl", hash = "sha256:e8d9a8e08013542e94d3220bc5b62cc3e5ef87c5f74bff367d3fac14fab013e6", size = 11440833, upload-time = "2026-05-14T13:43:59.043Z" },
-    { url = "https://files.pythonhosted.org/packages/e8/31/bf1a0803d077e679cfeee5f2f67290a0fa79c7385b5d9a8c17b9db2c48f0/ruff-0.15.13-py3-none-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:cc411dfebe5eebe55ce041c6ae080eb7668955e866daa2fbb16692a784f1c4ca", size = 11434486, upload-time = "2026-05-14T13:44:27.761Z" },
-    { url = "https://files.pythonhosted.org/packages/e1/4e/62c9b999875d4f14db80f277c030578f5e249c9852d65b7ac7ad0b43c041/ruff-0.15.13-py3-none-manylinux_2_31_riscv64.whl", hash = "sha256:768494eb08b9cee54e2fd27969966f74db5a57f6eaa7a90fcb3306af34dfc4bd", size = 11385189, upload-time = "2026-05-14T13:44:13.704Z" },
-    { url = "https://files.pythonhosted.org/packages/fc/89/7e959047a104df3eb12863447c110140191fc5b6c4f379ea2e803fcdb0e4/ruff-0.15.13-py3-none-musllinux_1_2_aarch64.whl", hash = "sha256:fb75f9a3a7e42ffe117d734494e6c5e5cb3565d66e12612cb63d0e572a41a5b6", size = 10781380, upload-time = "2026-05-14T13:43:56.734Z" },
-    { url = "https://files.pythonhosted.org/packages/ff/52/5fd18f3b88cab63e88aa11516b3b4e1e5f720e5c330f8dbe5c26210f41f8/ruff-0.15.13-py3-none-musllinux_1_2_armv7l.whl", hash = "sha256:8cb74dd33bb2f6613faf7fc03b660053b5ac4f80e706d5788c6335e2a8048d51", size = 10540605, upload-time = "2026-05-14T13:44:20.748Z" },
-    { url = "https://files.pythonhosted.org/packages/e8/e0/9e35f338990d3e41a82875ff7053ffe97541dae81c9d02143177f381d572/ruff-0.15.13-py3-none-musllinux_1_2_i686.whl", hash = "sha256:7ef823f817fcd191dc934e984be9cf4094f808effa16f2542ad8e821ba02bbf2", size = 11036554, upload-time = "2026-05-14T13:44:16.256Z" },
-    { url = "https://files.pythonhosted.org/packages/c2/13/070fb048c24080fba188f66371e2a92785be257ad02242066dc7255ac6e9/ruff-0.15.13-py3-none-musllinux_1_2_x86_64.whl", hash = "sha256:f345a13937bd7f09f6f5d19fa0721b0c103e00e7f62bc67089a8e5e037719e0b", size = 11528133, upload-time = "2026-05-14T13:44:22.808Z" },
-    { url = "https://files.pythonhosted.org/packages/6b/8c/b1e1666aef7fc6555094d73ae6cd981701781ae85b97ceefc0eebd0b4668/ruff-0.15.13-py3-none-win32.whl", hash = "sha256:4044f94208b3b05ba0fc4a4abd0558cf4d6459bd18325eead7fd8cc66f909b41", size = 10721455, upload-time = "2026-05-14T13:44:35.697Z" },
-    { url = "https://files.pythonhosted.org/packages/ab/a6/870a3e8a50590bb92be184ad928c2922f088b00d9dc5c5ec7b924ee08c22/ruff-0.15.13-py3-none-win_amd64.whl", hash = "sha256:7064884d442b7d477b4e7473d12da7f08851d2b1982763c5d3f388a19468a1a4", size = 11900409, upload-time = "2026-05-14T13:44:30.389Z" },
-    { url = "https://files.pythonhosted.org/packages/9b/36/9c015cd052fca743dae8cb2aeb16b551444787467db42ceab0fc968865af/ruff-0.15.13-py3-none-win_arm64.whl", hash = "sha256:2471da9bd1068c8c064b5fd9c0c4b6dddffd6369cb1cd68b29993b1709ff1b21", size = 11179336, upload-time = "2026-05-14T13:44:33.026Z" },
+version = "0.15.15"
+source = { registry = "https://pypi.org/simple" }
+sdist = { url = "https://files.pythonhosted.org/packages/84/6f/a76f7d96e5c962f5b69cee865e49c15c1116897c01990faa8a57edb62e7f/ruff-0.15.15.tar.gz", hash = "sha256:b8dff018130b46d8e5bf0f926ef6b60cf871d6d5ae45fc9334e09632daa741d6", size = 4706985, upload-time = "2026-05-28T14:16:57.784Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/fa/9d/3a45c05b8ab04b4705989de70a79008e27c8003296a0feaee9edc18dd7e9/ruff-0.15.15-py3-none-linux_armv6l.whl", hash = "sha256:cf93e5388f412e1b108b1f8b34a6e036b70fe8aff89393befad96fe48670311b", size = 10710652, upload-time = "2026-05-28T14:16:06.701Z" },
+    { url = "https://files.pythonhosted.org/packages/05/66/da974431624bf3b49f6ee1f9543c02d929ff1cba78b0d5a79c38cf21f744/ruff-0.15.15-py3-none-macosx_10_12_x86_64.whl", hash = "sha256:ac5a646d1f6a7dadd5d50842dae2c1f9862ac887ef5d1b1375e02def791fde6e", size = 11096615, upload-time = "2026-05-28T14:16:23.313Z" },
+    { url = "https://files.pythonhosted.org/packages/8c/09/7443452e5d290230a712103f2fdceeef7184f3ec99a2bd01c8be78aaceb5/ruff-0.15.15-py3-none-macosx_11_0_arm64.whl", hash = "sha256:77d955a431430c66f72dd94e379ad38a16daea3d25094872ac4edf9e797be530", size = 10436683, upload-time = "2026-05-28T14:16:40.974Z" },
+    { url = "https://files.pythonhosted.org/packages/53/01/d330c26a57fa4f3943a14424904027428315b700fe4d14a84bb123a649e5/ruff-0.15.15-py3-none-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:7614ee79c69788cf6cedd568069ade9cecc22a1ad20494efe8d0c9ebb4b622d4", size = 10769064, upload-time = "2026-05-28T14:16:28.905Z" },
+    { url = "https://files.pythonhosted.org/packages/1d/85/cc8770f8bdff541b1da8392d1634141fe4a0e3f4ee596605959b7906c27f/ruff-0.15.15-py3-none-manylinux_2_17_armv7l.manylinux2014_armv7l.whl", hash = "sha256:3cdb1679e06a1f6b47bc384714ae96f6e2fb65ca441eb78c43d2ca554176ce1f", size = 10511987, upload-time = "2026-05-28T14:16:43.732Z" },
+    { url = "https://files.pythonhosted.org/packages/7c/29/8c190c1472b63013583ba391f3342036e02010544c1270455ed8e519bdf3/ruff-0.15.15-py3-none-manylinux_2_17_i686.manylinux2014_i686.whl", hash = "sha256:2728b93d7b23a603ea2c0ac6eb73d760bd38ec9de35f35fb41e18f7a3fee7622", size = 11275100, upload-time = "2026-05-28T14:16:55.244Z" },
+    { url = "https://files.pythonhosted.org/packages/9f/6b/7e145ce2cc8e63d6834eca03d83a0e18d121def5c69f91b4cf4011ed4879/ruff-0.15.15-py3-none-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl", hash = "sha256:be582fcc0db438902c7792b08d6ddf6c9b9e21addaa10092c2c741cfb09e5a45", size = 12176903, upload-time = "2026-05-28T14:16:14.368Z" },
+    { url = "https://files.pythonhosted.org/packages/80/a3/d5974637f68e451f7fadf015cf3101d1cd7d8ba5027cffe0b9e3826ebe6b/ruff-0.15.15-py3-none-manylinux_2_17_s390x.manylinux2014_s390x.whl", hash = "sha256:7aa77465b8ecaf1a27bea098d696f7fed5e1eccbd10b321b682d6de586ae5627", size = 11404550, upload-time = "2026-05-28T14:16:20.138Z" },
+    { url = "https://files.pythonhosted.org/packages/fe/1c/e6e5e568f22be4fb05d6244234aba384c06b451252453b821e1a529263cf/ruff-0.15.15-py3-none-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:48decfa11d740de4889de623be1463308346312f2409a56e24aa280c86162dc4", size = 11382027, upload-time = "2026-05-28T14:16:46.615Z" },
+    { url = "https://files.pythonhosted.org/packages/1d/01/170921b49fcd2e8858825593f91cf7146c3e40a5c3e6df763e4bb0484dde/ruff-0.15.15-py3-none-manylinux_2_31_riscv64.whl", hash = "sha256:a5015088452ca0081387063649ec67f06d3d1d6b8b936a1f836b5e9657ecd48c", size = 11366041, upload-time = "2026-05-28T14:16:26.247Z" },
+    { url = "https://files.pythonhosted.org/packages/87/54/a7bad711d7de93254e15e06a4c375b89a03d18de45d3e5dcc86a4472fb1a/ruff-0.15.15-py3-none-musllinux_1_2_aarch64.whl", hash = "sha256:f5294aab6356c81600fcdea3a62bb1b924dfd5e91767c12318d3f68f86af57cd", size = 10741795, upload-time = "2026-05-28T14:16:17.11Z" },
+    { url = "https://files.pythonhosted.org/packages/c9/31/38c075963668f8b41c6914ee0f6f318727fbe30ab9145cb29e6df464c5fa/ruff-0.15.15-py3-none-musllinux_1_2_armv7l.whl", hash = "sha256:db5bd4d802415cca656dc1616070b725952d6ae95eb5d4831e49fbd94a38f75f", size = 10511117, upload-time = "2026-05-28T14:16:31.767Z" },
+    { url = "https://files.pythonhosted.org/packages/9d/96/6ff689e1f7e375d1d97075eca022f74c2bab59554a432fe4d2e6f091986a/ruff-0.15.15-py3-none-musllinux_1_2_i686.whl", hash = "sha256:587a6278ed42059191c1a466e490bd7930fb50bd2e255398bc29616c895a61cb", size = 10994867, upload-time = "2026-05-28T14:16:35.149Z" },
+    { url = "https://files.pythonhosted.org/packages/c3/c2/5dce0ab9f92a8d534fa62b9bf9caca3eddb8c1a81b616f5e195ada4f0d6e/ruff-0.15.15-py3-none-musllinux_1_2_x86_64.whl", hash = "sha256:df0c1c084f5f4be9812f61518a45c440d3c30d69ce4bf6c5270e66d38338f02a", size = 11482101, upload-time = "2026-05-28T14:16:49.598Z" },
+    { url = "https://files.pythonhosted.org/packages/b1/c0/1003b60edd697c649faf61f1a34094b1abb38fb3d1181e3f895781250a08/ruff-0.15.15-py3-none-win32.whl", hash = "sha256:29428ea79694afbe756d45fd59b36f22b6b020dc0443cf7de0173046236964b9", size = 10716774, upload-time = "2026-05-28T14:16:52.337Z" },
+    { url = "https://files.pythonhosted.org/packages/02/a8/1269eddd6945a06c23f055ef7848886e37cf9d6a8bebb386a3115f01470c/ruff-0.15.15-py3-none-win_amd64.whl", hash = "sha256:8df0323902e15e24bc4bf246da830573d3cf3352bd0b9a164eab335d111ff4a4", size = 11868463, upload-time = "2026-05-28T14:16:11.333Z" },
+    { url = "https://files.pythonhosted.org/packages/4e/b2/920464c907b191e37469d477a1aa8bc048b8f36c4c1610dfa4ab87b39e18/ruff-0.15.15-py3-none-win_arm64.whl", hash = "sha256:3c8ceca6792f38196b8f589bc92eccd03eef286602da92e5dc05cc42ef6441b7", size = 11138498, upload-time = "2026-05-28T14:16:38.425Z" },
 ]
 
 [[package]]