Skip to content

SECURITY.md

Latest commit

 

History

History
92 lines (64 loc) · 2.59 KB

SECURITY.md

File metadata and controls

92 lines (64 loc) · 2.59 KB
Raw

Security Policy

Reporting a Vulnerability

If you discover a security vulnerability within this skill, please report it responsibly.

Do NOT report security vulnerabilities through public GitHub issues.

Instead, please report them via email to the maintainers.

Please include the following information in your report:

  • Type of vulnerability (e.g., SQL injection, XSS, etc.)
  • Steps to reproduce the issue
  • Potential impact
  • Suggested fix (if any)

Security Guidelines for Users

1. Legal Compliance

  • Only test systems you have authorization to test
  • Comply with all applicable laws and regulations
  • Follow edu.SRC platform rules
  • Do not test prohibited systems (exam, email, OA, academic systems)

2. Responsible Disclosure

  • Report vulnerabilities promptly
  • Do not publicly disclose vulnerabilities
  • Do not download/export real user data
  • Do not perform destructive testing

3. Safe Testing Practices

  • Use proper isolation when testing
  • Control scan speed to avoid DoS
  • Use proxy/VPN to protect your identity
  • Clean up test artifacts after testing

4. Data Protection

  • Do not store real user data
  • Do not exfiltrate sensitive information
  • Use test data when possible
  • Delete test data after completion

Prohibited Activities

The following activities are strictly prohibited:

  1. Brute force attacks (including credential stuffing)
  2. Data exfiltration (downloading/exporting real user data)
  3. Destructive testing (DoS, data deletion, system damage)
  4. Testing prohibited systems (exam, email, OA, academic systems)
  5. Public disclosure of vulnerabilities before修复
  6. Unauthorized access beyond testing scope

Best Practices

Before Testing

  • Confirm target is within edu.SRC scope
  • Review platform rules and guidelines
  • Set up proper testing environment
  • Configure Burp proxy settings

During Testing

  • Use Burp MCP for HTTP operations
  • Collect complete evidence (request/response pairs)
  • Verify vulnerabilities are real and exploitable
  • Avoid unnecessary noise and false positives

After Testing

  • Generate standardized reports
  • Review report quality and completeness
  • Submit to edu.SRC platform
  • Clean up test artifacts

Emergency Contacts

If you encounter a critical security issue:

  1. Stop testing immediately
  2. Do not attempt to exploit further
  3. Report the issue to maintainers
  4. Provide detailed information about the issue

Updates

This security policy will be updated as needed. Please check regularly for changes.

Last updated: 2026-06-10