We release patches for security vulnerabilities. Currently supported versions:

Please do not report security vulnerabilities through public GitHub issues.

Instead, please report them responsibly:

1. Email: Send details to the repository maintainer (check GitHub profile for contact)
2. Include:
   • Description of the vulnerability
   • Steps to reproduce
   • Potential impact
   • Suggested fix (if any)
   • Your contact information for follow-up

• Initial Response: Within 48 hours
• Status Update: Within 7 days
• Fix Timeline: Depends on severity
  • Critical: 1-7 days
  • High: 7-30 days
  • Medium/Low: 30-90 days

We follow responsible disclosure practices:

1. You report the vulnerability privately
2. We acknowledge and investigate
3. We develop and test a fix
4. We release the patch
5. We publicly disclose (with credit to you, if desired)
6. You may then publish your findings

We support security research conducted:

• On your own systems or with explicit permission
• In good faith to improve security
• Without violating privacy or destroying data
• With responsible disclosure

Legal Protection: We will not pursue legal action against researchers who:

• Follow this policy
• Act in good faith
• Avoid privacy violations and data destruction

1. Authorization: Only test systems you own or have written permission to test
2. Legal Compliance: Understand and comply with applicable laws
3. Scope Definition: Clearly define testing scope
4. Data Protection: Avoid accessing or modifying sensitive data
5. Documentation: Keep detailed logs of testing activities

1. Rate Limiting: Avoid overwhelming target systems
2. Production Systems: Prefer testing on staging/development environments
3. Data Handling: Don't store or transmit sensitive discovered data
4. Responsible Disclosure: Report findings to system owners
5. Clean Up: Remove any test files or accounts created

1. Secure Reports: Encrypt and secure vulnerability reports
2. Disclosure: Follow responsible disclosure timelines
3. Evidence: Securely delete testing artifacts
4. Communication: Maintain professional communication with affected parties

This tool is designed for web application testing. The following are out of scope:

• Denial of Service (DoS) attacks
• Physical security testing
• Social engineering
• Testing without authorization

The tool may trigger:

• Web Application Firewalls (WAF)
• Intrusion Detection Systems (IDS)
• Rate limiting mechanisms

Use responsibly to avoid service disruption.

1. No Credential Storage: The tool doesn't store credentials by default
2. Session Management: Uses temporary sessions
3. Error Handling: Graceful error handling to prevent crashes
4. Input Validation: Basic input validation for user inputs

1. Virtual Environment: Run in isolated virtual machines
2. VPN/Proxy: Use VPN or proxy for privacy
3. Logging: Enable detailed logging for accountability
4. Review: Manually review automated findings

• Watch the repository for security updates
• Subscribe to release notifications
• Regularly pull latest changes
• Review CHANGELOG for security fixes

Security patches are released as:

• Immediate hotfix for critical vulnerabilities
• Included in regular releases for minor issues
• Documented in release notes

We appreciate security researchers who help improve this tool:

• Public acknowledgment (with permission)
• Credit in release notes
• Recognition in README

For security concerns:

• Check repository for maintainer contact
• Create a private security advisory on GitHub
• Use encrypted communication when possible

By using this tool, you agree to:

1. Use it only for authorized testing
2. Comply with all applicable laws
3. Not hold the authors liable for misuse
4. Report vulnerabilities responsibly

Remember: With great power comes great responsibility. Use this tool ethically and legally.

Last Updated: March 2026