This project is a pentest copilot — security issues are taken seriously and triaged within 7 calendar days.
Do NOT open a public GitHub Issue for security vulnerabilities.
Use GitHub's private vulnerability reporting instead:
- Go to the repository's Security tab
- Click Report a vulnerability
- Fill in the form (severity, affected component, reproduction steps, impact)
- Submit — the report is private and visible only to maintainers until disclosed coordinately
If you cannot use GitHub Security Advisories, contact the maintainer via the email on their GitHub profile.
| Stage | Window |
|---|---|
| Acknowledgement of report | within 7 calendar days |
| Initial triage + severity classification | within 14 calendar days |
| Fix or mitigation pushed | depends on severity (see below) |
| Coordinated disclosure window | 90 days from initial report (negotiable for critical issues with active exploitation) |
| Severity | Definition | Fix target |
|---|---|---|
| Critical | Authentication bypass, secrets leakage, RCE in case_server, verifier evasion enabling fabricated exploit instructions in operator-visible output | 7 days |
| High | Scope-filter bypass that surfaces out-of-scope assets, prompt-injection that bypasses jailbreak detector or regression rules | 30 days |
| Medium | Audit-log information disclosure, denial of service via crafted prompts, verifier false-negatives on a known regression pattern | 60 days |
| Low | Hardening recommendations, defense-in-depth improvements | 90 days |
Vulnerabilities in:
- Authentication / authorization on
case_serverendpoints - Engagement-scope filter (in- and out-of-scope leak paths)
- Provenance verifier (rules that should hard-fail but don't, on inputs that an operator would actually issue)
- Prompt-injection that defeats the jailbreak detector or the regression-pattern rules
- Token / secret leakage in audit logs, case session files, or eval artifacts
- Insecure handling of model-output content in the frontend (XSS in chat rendering, etc.)
- Path traversal or injection in
data/engagements/<case_id>.jsonloading
Issues that should be reported upstream:
- Vulnerabilities in the underlying LLM weights — report to the model vendor (Qwen, Meta, DeepSeek, etc.)
- Vulnerabilities in vLLM — report at https://github.com/vllm-project/vllm/security
- Vulnerabilities in transitive Python or npm dependencies — open a Dependabot alert
- "The system gave me a wrong answer" — that's a quality issue, file a regular Issue or add a regression-pattern rule (see CONTRIBUTING.md)
- "The model refused to help with X" — by design, the jailbreak detector reframes prereq-bypass and "won't be detected" prompts. Not a vulnerability.
Researchers who follow this policy in good faith will not face legal action from the maintainer. Specifically:
- Testing must be against your own deployment (do not test against systems you don't own/operate)
- No exfiltration of secrets, logs, or operator data beyond minimum needed to prove the issue
- No degradation of service for other users (DoS testing must be on your own deployment)
- Coordinated disclosure — wait for the agreed window before publishing details