ZeroHack Security welcomes coordinated disclosure of vulnerabilities in our own tooling.

• Preferred: open a private advisory via GitHub Security Advisories ("Security" → "Report a vulnerability") on this repository.
• Email: security@zerohack.org (PGP available on request).
• Do not open a public issue for an unpatched vulnerability.

Please include: affected file/commit, a clear description, a minimal reproduction, impact assessment, and any suggested remediation. We aim to acknowledge within 3 business days and to provide a remediation timeline within 10 business days. We will credit reporters who wish to be named.

This repository is a defensive research toolkit and field guide. The following are by design and are not reportable:

• Documentation of publicly documented factory-default credentials. These are published by vendors and government advisories; the vulnerability is leaving them unchanged, which is precisely what this toolkit helps you find.
• Educational descriptions of real, already-patched CVEs. We describe the vulnerability class and remediation, not a working exploit.
• The toolkit's ability to send non-destructive requests. It is rate-limited and gated behind an explicit authorisation flag by design.

What is in scope: any defect that makes the toolkit unsafe, destructive, or capable of acting beyond the operator's authorisation; any leaked secret; or any incorrect remediation guidance.

If you believe you have found a vulnerability in a real product, contact the vendor or a national CERT/CSIRT directly. Do not use this repository to test real devices, and do not send us exploit code for third-party products.

We will not pursue or support legal action against researchers who, in good faith and in accordance with this policy, report vulnerabilities in our tooling. Good faith means: only testing systems you are authorised to test, minimising data access, and allowing reasonable time to remediate before disclosure.