AutoPentest Lite is built for:

• Security professionals testing systems they own or have written permission to test
• Bug bounty hunters working within a programme's defined scope
• CTF participants on challenge infrastructure
• Students learning security concepts in isolated lab environments

It is not built for scanning systems you do not own or have explicit permission to test. Unauthorised scanning is illegal in most jurisdictions regardless of intent.

By using this tool you agree to:

• Only scan targets you own or have written authorisation to test
• Comply with all applicable laws and regulations
• Not use this tool to exfiltrate data, deploy payloads, or cause harm

The following controls are active by default and cannot be bypassed through the UI:

Logs are written to backend/logs/autopentest.log in structured JSON format.

• Run in an isolated VM or container, not on a production host
• Do not expose the backend port (8000) to the public internet
• Set TARGET_WHITELIST to only the IPs/ranges you intend to test
• Review backend/logs/autopentest.log regularly for unexpected activity
• Use a firewall to restrict who can reach the UI and API

If you find a security vulnerability in AutoPentest Lite, please do not open a public GitHub issue.

Instead, email the maintainer directly:

Giathi Daniel — open a private security advisory on GitHub.

Please include:

• A description of the vulnerability
• Steps to reproduce
• Potential impact
• Any suggested fix (optional)

You will receive a response within 72 hours. We will coordinate a fix and disclosure timeline with you.

The following are not considered vulnerabilities for this project:

• Findings from scanning targets you do not own
• Rate limit bypass via multiple IPs (this is a self-hosted tool — configure SCAN_RATE_LIMIT appropriately)
• Missing HTTPS (deploy behind a reverse proxy with TLS for production use)