Security fixes are applied to the latest state of the default branch. This repository is currently pre-1.0; older snapshots and forks are not supported.

Use a private GitHub Security Advisory to report a suspected vulnerability. If that feature is unavailable, contact the maintainer through the GitHub profile without publishing exploit details.

Do not open a public issue for an unpatched vulnerability and do not include secrets, personal data, or data taken from systems you are not authorized to assess.

Please provide the affected component and revision, reproduction steps, impact, relevant configuration, and a minimal proof of concept that does not harm third parties. Allow time for validation and remediation before discussing the issue publicly.

Reports will be acknowledged and triaged when maintainer availability permits. No fixed response or remediation deadline is promised. The reporter will be updated through the private advisory when the issue is confirmed, disputed, fixed, or otherwise resolved.

In scope are vulnerabilities in code, workflows, packaging, configuration examples, or documentation maintained in this repository that could compromise confidentiality, integrity, or availability in a documented use case.

• Vulnerabilities in unsupported forks or modified deployments
• Social engineering, denial-of-service testing, or attacks against GitHub or dependencies
• Reports based only on automated scanner output without a reproducible security impact
• Findings that require using the tools outside their documented defensive and authorized scope

The tools process untrusted log content locally. Users should apply normal filesystem protections to input and report files, review configuration before use, keep dependencies current, and avoid adding sensitive production logs to the repository.

The HTTP Header Auditor also processes untrusted URLs and response metadata. Its network boundary must reject URL credentials and non-global targets, pin connections to validated addresses, keep TLS verification enabled, avoid redirects, and never retain response bodies, cookies, authentication values, or URL query parameters in reports. Treat changes to URL parsing, DNS resolution, socket handling, TLS, redaction, or report serialization as security-sensitive.

Do not disclose vulnerability details publicly before the maintainer has reviewed the report and a remediation or coordinated disclosure decision has been made.