Skip to content

SECURITY.md

Latest commit

 

History

History
151 lines (103 loc) · 6.11 KB

SECURITY.md

File metadata and controls

151 lines (103 loc) · 6.11 KB
Raw

Security Policy

Chinese | English

Security Policy

CyberStrikeAI is a security testing and automation platform. It can execute tools, call MCP servers, manage WebShell connections, and optionally run C2 workflows. Please treat every deployment as a high-privilege security system.

Supported Versions

This project does not currently maintain multiple long-term support branches. Security fixes are expected to land on the latest mainline release/source tree.

If you are running an older version, please reproduce the issue against the latest code before reporting when possible.

Reporting a Vulnerability

Please do not publicly disclose exploitable details before maintainers have had a reasonable chance to investigate.

Preferred report contents:

  • affected version or commit;
  • deployment mode and relevant configuration;
  • clear reproduction steps;
  • impact assessment;
  • affected component, such as auth, MCP, tool execution, WebShell, C2, knowledge base, frontend, or API;
  • whether the issue requires authentication;
  • suggested mitigation, if known.

If the project repository has private vulnerability reporting enabled, use that channel. Otherwise, open a minimal public issue that states there is a security concern and avoid posting exploit details, credentials, target data, or weaponized payloads.

Scope

In scope:

  • authentication and session handling issues;
  • authorization bypass in protected APIs;
  • unsafe command execution behavior;
  • unintended file read/write through tools or Skills;
  • external MCP trust-boundary flaws;
  • WebShell or C2 management vulnerabilities;
  • sensitive data leakage from logs, audit records, uploads, or APIs;
  • cross-site scripting or frontend injection in the Web UI;
  • security-impacting configuration handling bugs.

Out of scope:

  • reports against systems you do not own or are not authorized to test;
  • denial-of-service testing against public services without permission;
  • social engineering, phishing, or credential theft;
  • issues caused only by intentionally disabling documented security controls;
  • vulnerabilities in third-party tools invoked by CyberStrikeAI, unless CyberStrikeAI makes them materially worse.

Authorized Use Boundary

CyberStrikeAI must only be used for education, research, and authorized security testing. Do not use it against systems without explicit permission.

High-risk capabilities such as Shell execution, WebShell management, C2, payload generation, external MCP tools, and batch scanning should be enabled only in controlled, authorized environments.

Deployment Hardening

Before production use:

  • change the default password;
  • use HTTPS or a trusted reverse proxy;
  • restrict access by IP, VPN, or bastion;
  • enable audit logging;
  • keep C2 disabled unless explicitly needed;
  • review external MCP servers before enabling them;
  • keep high-risk tools out of global HITL allowlists;
  • back up config.yaml, data/, and custom resource directories.

See:

security policy

CyberStrikeAI is a security testing and automation platform. It can execute tools, invoke MCP services, manage WebShell connections, and optionally run C2 workflows. Please treat each deployment instance as a high-privilege security system.

Supported version

This project currently does not maintain multiple long-term support branches. Security fixes are usually merged into the latest mainline version or source tree.

If you are running an older version, it is recommended to try to reproduce the problem with the latest code before reporting.

Vulnerability Report

Please do not publicly disclose exploitable details until the maintainer has had reasonable time to investigate.

Suggested report content:

  • Affected version or commit;
  • Deployment methods and related configurations;
  • Clear reproduction steps;
  • impact assessment;
  • Affected components such as authentication, MCP, tool execution, WebShell, C2, knowledge base, frontend or API;
  • Whether login authentication is required;
  • Known mitigation recommendations.

If the repository has private vulnerability reporting enabled, please use this channel first. Otherwise, you can submit a minimal public issue stating that there is a security issue, but do not release exploit details, credentials, targeting data, or weaponized payloads.

scope

Within the range:

  • Authentication and session handling issues;
  • Authorization bypass of protected API;
  • Unsafe command execution behavior;
  • Accidental reading and writing of files through tools or skills;
  • External MCP trust boundary issues;
  • WebShell or C2 management vulnerabilities;
  • Logs, audits, uploaded files or APIs leak sensitive data;
  • XSS or front-end injection of Web UI;
  • Configuration handling flaws affecting security.

Out of range:

  • Reports on unauthorized systems;
  • Unauthorized denial of service testing;
  • Social engineering, phishing or credential theft;
  • Problems caused only by proactively turning off documented security controls;
  • Vulnerabilities in third-party tools themselves, unless CyberStrikeAI clearly amplifies the risk.

Authorization usage boundaries

CyberStrikeAI may be used only for education, research, and authorized security testing. Do not use on systems without explicit authorization.

High-risk capabilities such as shell execution, WebShell management, C2, payload generation, external MCP tools, and batch scanning should only be enabled in a controlled and clearly authorized environment.

Deployment and reinforcement

Before production use:

  • Modify default password;
  • Use HTTPS or a trusted reverse proxy;
  • Restrict access via IP, VPN or bastion host;
  • Turn on audit log;
  • Keep C2 closed when not needed;
  • Review before enabling external MCP;
  • Do not add high-risk tools to the global HITL whitelist;
  • Back up config.yaml, data/ and custom resource directories.

See also: