| Version | Supported |
|---|---|
| 1.2.x | Yes |
| < 1.2 | Best-effort |
Please do not open a public GitHub issue for security-sensitive reports.
Email or message the maintainer via GitHub: @neur0sp1cy — use a private channel when possible (GitHub Security Advisories on this repo if enabled).
Include:
- Cyberknife version (
/api/versionor Update Checker) - OS and Python version
- Steps to reproduce
- Impact (local info disclosure, RCE, SSRF, etc.)
We aim to acknowledge reports within a few days.
Cyberknife is a local security toolkit. Many tools probe networks or the host by design. Reports about “the Port Scanner can scan hosts” are expected behavior — not vulnerabilities — when the operator has authorization.
In scope examples:
- Path traversal or arbitrary file read/write beyond intended tools
- Command injection via form fields
- Secrets leaked into client-visible responses unintentionally
- Dependency CVEs with a clear exploit path in this app
Out of scope:
- Abuse of tools against systems you do not own or lack permission to test
- Missing authentication on the local dashboard (single-user local app by design in 1.x)
- Issues that require already-compromised local access with no further privilege gain
Only use Cyberknife on systems and networks you own or have explicit permission to test. See the README disclaimer.