BoundedScan is currently a pre-1.0 project. Security fixes target the latest 0.1.x release only.

Do not open a public issue for a suspected vulnerability. After the repository is published, use GitHub's Private vulnerability reporting feature. Until that channel is available, contact the maintainer privately through the contact method listed on the maintainer's GitHub profile.

Include the affected version, configuration, impact, reproduction steps and any suggested mitigation. Do not access data that is not yours, disrupt services or test against public deployments without explicit authorization.

The maintainer will aim to acknowledge a report within seven days. This is a personal open-source project, so response and remediation times are best-effort rather than a service-level agreement.

The project is provided as-is and has not undergone an independent audit. Before exposing it beyond localhost:

• replace every example secret;
• terminate TLS at a trusted reverse proxy and set BOUNDEDSCAN_COOKIE_SECURE=true;
• restrict BOUNDEDSCAN_ALLOWED_ORIGINS to the exact dashboard origin;
• protect PostgreSQL, RabbitMQ, Redis, reports and metrics from public access;
• keep demo mode disabled;
• review scopes, request budgets and templates.