ReconIntel is a security research tool designed for authorized testing environments. If you discover a security vulnerability, please report it privately.

Do not open a public GitHub issue for critical vulnerabilities.

To report a vulnerability:

1. Email the project maintainer (see commit history for contact)
2. Include a detailed description of the vulnerability
3. Include steps to reproduce if possible
4. Include suggested fix or mitigation if available

You can expect:

• Acknowledgment within 48 hours
• A status update within 5 business days
• Credit in release notes for verified reports (if desired)

The following are considered in-scope for security reports:

• Remote code execution
• Authentication/authorization bypasses
• Data exposure of secrets or credentials
• Server-Side Request Forgery (SSRF)
• Command injection
• SQL injection

The following are considered out-of-scope:

• Missing HTTP security headers (CSP, HSTS, etc.)
• Self-XSS
• Rate limiting concerns
• Missing authentication (this is a local/internal tool by design)

We consider security research and vulnerability disclosure activities conducted in accordance with this policy as authorized conduct. We will not pursue legal action against researchers who comply with this policy.