CyberTool is security software that includes assessment and simulation capabilities. This policy defines how we handle vulnerabilities, dependencies, privacy, and responsible AI use.
| Version | Supported | Notes |
|---|---|---|
| 1.0.x | Yes | Current public release line |
| < 1.0 | No | Pre-release development |
Security fixes are prioritized on the latest release branch. Upgrade guidance will be published in CHANGELOG.md and GitHub Security Advisories.
Please report security issues through GitHub Security Advisories.
- Undisclosed vulnerabilities
- Leaked secrets or credentials
- Exploitable flaws in authentication, storage, or offensive modules
Public disclosure before coordination may put users at risk.
- Description and impact
- Affected version(s)
- Steps to reproduce (sanitized)
- Suggested fix (optional)
Do not include: production IPs, customer data, live API keys, or real credentials.
We follow coordinated disclosure:
| Phase | Target |
|---|---|
| Acknowledgment | Within 7 business days |
| Triage | Within 14 business days |
| Fix or mitigation | Severity-dependent |
| Advisory publication | After fix or agreed timeline |
Researchers who report in good faith will not be pursued for authorized testing of their own installations or agreed scope.
| Package | Purpose |
|---|---|
| Microsoft.WindowsAppSDK | WinUI 3 runtime |
| Microsoft.Windows.SDK.BuildTools | Windows build |
| System.Management | WMI access |
| System.Diagnostics.EventLog | Local audit checks |
- CI runs
dotnet list package --vulnerableon each build (informational) - Critical CVEs in direct dependencies are addressed in patch releases
- Transitive dependency risk reviewed during release preparation
- No unnecessary packages added to reduce attack surface
Dependency bumps require:
- Successful Release x64 build
- Smoke test of scan and settings flows
- CHANGELOG entry for security-relevant updates
- No hardcoded API keys, tokens, or credentials in tracked source
- DEBUG-only demo authentication (
#if DEBUG) - Generic demo network data only
.gitignoreblocksconfig.json,history.json, build artifacts
PRs touching these areas receive heightened review:
AuthService,ConfigServiceAttackService,SystemEnumerationServiceOpenAIService,RemediationService- File I/O and path handling
- GitHub Actions: Windows runner, Release x64
- No secrets in workflow files
- Build failure blocks merge
| Asset | Risk if Compromised |
|---|---|
| User API keys (local) | Unauthorized OpenAI usage, cost |
| Scan history (local) | Exposure of assessed infrastructure |
| WMI credentials (runtime) | Unauthorized host access |
| AI-generated scripts | Unsafe system changes if executed blindly |
| Threat | Mitigation |
|---|---|
| Secret committed to repo | Sprint cleanup, .gitignore, PR checklist |
| Malicious PR introducing backdoor | Review, CI, community scrutiny |
| User runs tool without authorization | DISCLAIMER, safety docs, UI warnings |
| AI script causes system harm | User review required; rollback scripts provided |
| Local config theft | DPAPI planned v1.1; OS-level disk encryption recommended |
| Misuse of offensive modules | Documentation, authorized-use framing |
- Physical access to the machine
- Compromised Windows user account
- Organizational policy enforcement
- Network-level IDS/IPS response
CyberTool does not include built-in telemetry, analytics, or cloud sync.
| Data | Location | Leaves Device? |
|---|---|---|
| Scan sessions | %AppData%\CyberTool\ |
No |
| Scan history | %LocalAppData%\CyberTool\ |
No |
| API key | %AppData%\CyberTool\config.json |
No (except OpenAI API calls) |
| Error logs | %LocalAppData%\CyberTool\errors.log |
No |
| Exported reports | User Desktop | User-controlled |
- Classify and protect exported reports
- Secure the workstation running CyberTool
- Follow organizational data handling policies
- AI is opt-in via user-provided API key
- Input is minified (port/service summary, not full payloads)
- Output is advisory — not auto-executed
- Fallback templates exist when AI is unavailable
When AI features are enabled:
- User configures their own OpenAI API key
- CyberTool sends scan summaries to
https://api.openai.com/v1/chat/completions - Data handling is governed by OpenAI's terms and your organizational policy
- CyberTool does not store AI responses server-side
- Do not send classified or regulated data without approval
- Use organizational API accounts with appropriate policies
- Disable AI in air-gapped environments
- Review all generated scripts before execution
See docs/safety.md.
CyberTool must only be used on systems you own or have explicit written permission to test.
Maintainers do not condone:
- Unauthorized scanning
- Credential attacks against third parties
- Ransomware simulation on production networks without approval
- Deployment as covert surveillance or malware
See DISCLAIMER.md.
Report vulnerabilities via GitHub Security Advisories only.
For security design discussions (not vulnerabilities), use the security discussion issue template.
We appreciate responsible disclosure from security researchers and contributors who help keep CyberTool safe for authorized users.